--- /dev/null
+From ff2b629e23cf57047149fcac86fbffb505567f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 14:30:48 -0700
+Subject: ACPI: CPPC: Replace cppc_attr with kobj_attribute
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 2bc6262c6117dd18106d5aa50d53e945b5d99c51 ]
+
+All of the CPPC sysfs show functions are called via indirect call in
+kobj_attr_show(), where they should be of type
+
+ssize_t (*show)(struct kobject *kobj, struct kobj_attribute *attr, char *buf);
+
+because that is the type of the ->show() member in
+'struct kobj_attribute' but they are actually of type
+
+ssize_t (*show)(struct kobject *kobj, struct attribute *attr, char *buf);
+
+because of the ->show() member in 'struct cppc_attr', resulting in a
+Control Flow Integrity violation [1].
+
+$ cat /sys/devices/system/cpu/cpu0/acpi_cppc/highest_perf
+3400
+
+$ dmesg | grep "CFI failure"
+[ 175.970559] CFI failure (target: show_highest_perf+0x0/0x8):
+
+As far as I can tell, the only difference between 'struct cppc_attr'
+and 'struct kobj_attribute' aside from the type of the attr parameter
+is the type of the count parameter in the ->store() member (ssize_t vs.
+size_t), which does not actually matter because all of these nodes are
+read-only.
+
+Eliminate 'struct cppc_attr' in favor of 'struct kobj_attribute' to fix
+the violation.
+
+[1]: https://lore.kernel.org/r/20210401233216.2540591-1-samitolvanen@google.com/
+
+Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1343
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 69057fcd2c04..a5e6fd0bafa1 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -119,23 +119,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr);
+ */
+ #define NUM_RETRIES 500ULL
+
+-struct cppc_attr {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *kobj,
+- struct attribute *attr, char *buf);
+- ssize_t (*store)(struct kobject *kobj,
+- struct attribute *attr, const char *c, ssize_t count);
+-};
+-
+ #define define_one_cppc_ro(_name) \
+-static struct cppc_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0444, show_##_name, NULL)
+
+ #define to_cpc_desc(a) container_of(a, struct cpc_desc, kobj)
+
+ #define show_cppc_data(access_fn, struct_name, member_name) \
+ static ssize_t show_##member_name(struct kobject *kobj, \
+- struct attribute *attr, char *buf) \
++ struct kobj_attribute *attr, char *buf) \
+ { \
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \
+ struct struct_name st_name = {0}; \
+@@ -161,7 +153,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);
+ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
+
+ static ssize_t show_feedback_ctrs(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj);
+ struct cppc_perf_fb_ctrs fb_ctrs = {0};
+--
+2.30.2
+
--- /dev/null
+From 69c60160d764393fb1d11143126a58eda8af5442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Apr 2021 13:47:08 +0100
+Subject: afs: Fix speculative status fetches
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 22650f148126571be1098d34160eb4931fc77241 ]
+
+The generic/464 xfstest causes kAFS to emit occasional warnings of the
+form:
+
+ kAFS: vnode modified {100055:8a} 30->31 YFS.StoreData64 (c=6015)
+
+This indicates that the data version received back from the server did not
+match the expected value (the DV should be incremented monotonically for
+each individual modification op committed to a vnode).
+
+What is happening is that a lookup call is doing a bulk status fetch
+speculatively on a bunch of vnodes in a directory besides getting the
+status of the vnode it's actually interested in. This is racing with a
+StoreData operation (though it could also occur with, say, a MakeDir op).
+
+On the client, a modification operation locks the vnode, but the bulk
+status fetch only locks the parent directory, so no ordering is imposed
+there (thereby avoiding an avenue to deadlock).
+
+On the server, the StoreData op handler doesn't lock the vnode until it's
+received all the request data, and downgrades the lock after committing the
+data until it has finished sending change notifications to other clients -
+which allows the status fetch to occur before it has finished.
+
+This means that:
+
+ - a status fetch can access the target vnode either side of the exclusive
+ section of the modification
+
+ - the status fetch could start before the modification, yet finish after,
+ and vice-versa.
+
+ - the status fetch and the modification RPCs can complete in either order.
+
+ - the status fetch can return either the before or the after DV from the
+ modification.
+
+ - the status fetch might regress the locally cached DV.
+
+Some of these are handled by the previous fix[1], but that's not sufficient
+because it checks the DV it received against the DV it cached at the start
+of the op, but the DV might've been updated in the meantime by a locally
+generated modification op.
+
+Fix this by the following means:
+
+ (1) Keep track of when we're performing a modification operation on a
+ vnode. This is done by marking vnode parameters with a 'modification'
+ note that causes the AFS_VNODE_MODIFYING flag to be set on the vnode
+ for the duration.
+
+ (2) Alter the speculation race detection to ignore speculative status
+ fetches if either the vnode is marked as being modified or the data
+ version number is not what we expected.
+
+Note that whilst the "vnode modified" warning does get recovered from as it
+causes the client to refetch the status at the next opportunity, it will
+also invalidate the pagecache, so changes might get lost.
+
+Fixes: a9e5c87ca744 ("afs: Fix speculative status fetch going out of order wrt to modifications")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-and-reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/160605082531.252452.14708077925602709042.stgit@warthog.procyon.org.uk/ [1]
+Link: https://lore.kernel.org/linux-fsdevel/161961335926.39335.2552653972195467566.stgit@warthog.procyon.org.uk/ # v1
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 7 +++++++
+ fs/afs/dir_silly.c | 3 +++
+ fs/afs/fs_operation.c | 6 ++++++
+ fs/afs/inode.c | 6 ++++--
+ fs/afs/internal.h | 2 ++
+ fs/afs/write.c | 1 +
+ 6 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 17548c1faf02..31251d11d576 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -1342,6 +1342,7 @@ static int afs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
+
+ afs_op_set_vnode(op, 0, dvnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+ op->dentry = dentry;
+ op->create.mode = S_IFDIR | mode;
+@@ -1423,6 +1424,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)
+
+ afs_op_set_vnode(op, 0, dvnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+
+ op->dentry = dentry;
+@@ -1559,6 +1561,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
+
+ afs_op_set_vnode(op, 0, dvnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+
+ /* Try to make sure we have a callback promise on the victim. */
+@@ -1641,6 +1644,7 @@ static int afs_create(struct user_namespace *mnt_userns, struct inode *dir,
+
+ afs_op_set_vnode(op, 0, dvnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+
+ op->dentry = dentry;
+@@ -1715,6 +1719,7 @@ static int afs_link(struct dentry *from, struct inode *dir,
+ afs_op_set_vnode(op, 0, dvnode);
+ afs_op_set_vnode(op, 1, vnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+ op->file[1].update_ctime = true;
+
+@@ -1910,6 +1915,8 @@ static int afs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ afs_op_set_vnode(op, 1, new_dvnode); /* May be same as orig_dvnode */
+ op->file[0].dv_delta = 1;
+ op->file[1].dv_delta = 1;
++ op->file[0].modification = true;
++ op->file[1].modification = true;
+ op->file[0].update_ctime = true;
+ op->file[1].update_ctime = true;
+
+diff --git a/fs/afs/dir_silly.c b/fs/afs/dir_silly.c
+index 04f75a44f243..dae9a57d7ec0 100644
+--- a/fs/afs/dir_silly.c
++++ b/fs/afs/dir_silly.c
+@@ -73,6 +73,8 @@ static int afs_do_silly_rename(struct afs_vnode *dvnode, struct afs_vnode *vnode
+ afs_op_set_vnode(op, 1, dvnode);
+ op->file[0].dv_delta = 1;
+ op->file[1].dv_delta = 1;
++ op->file[0].modification = true;
++ op->file[1].modification = true;
+ op->file[0].update_ctime = true;
+ op->file[1].update_ctime = true;
+
+@@ -201,6 +203,7 @@ static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnode
+ afs_op_set_vnode(op, 0, dvnode);
+ afs_op_set_vnode(op, 1, vnode);
+ op->file[0].dv_delta = 1;
++ op->file[0].modification = true;
+ op->file[0].update_ctime = true;
+ op->file[1].op_unlinked = true;
+ op->file[1].update_ctime = true;
+diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c
+index 71c58723763d..a82515b47350 100644
+--- a/fs/afs/fs_operation.c
++++ b/fs/afs/fs_operation.c
+@@ -118,6 +118,8 @@ static void afs_prepare_vnode(struct afs_operation *op, struct afs_vnode_param *
+ vp->cb_break_before = afs_calc_vnode_cb_break(vnode);
+ if (vnode->lock_state != AFS_VNODE_LOCK_NONE)
+ op->flags |= AFS_OPERATION_CUR_ONLY;
++ if (vp->modification)
++ set_bit(AFS_VNODE_MODIFYING, &vnode->flags);
+ }
+
+ if (vp->fid.vnode)
+@@ -223,6 +225,10 @@ int afs_put_operation(struct afs_operation *op)
+
+ if (op->ops && op->ops->put)
+ op->ops->put(op);
++ if (op->file[0].modification)
++ clear_bit(AFS_VNODE_MODIFYING, &op->file[0].vnode->flags);
++ if (op->file[1].modification && op->file[1].vnode != op->file[0].vnode)
++ clear_bit(AFS_VNODE_MODIFYING, &op->file[1].vnode->flags);
+ if (op->file[0].put_vnode)
+ iput(&op->file[0].vnode->vfs_inode);
+ if (op->file[1].put_vnode)
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 5a70c09f5325..fddf7d54e0b7 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -293,8 +293,9 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v
+ op->flags &= ~AFS_OPERATION_DIR_CONFLICT;
+ }
+ } else if (vp->scb.have_status) {
+- if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version &&
+- vp->speculative)
++ if (vp->speculative &&
++ (test_bit(AFS_VNODE_MODIFYING, &vnode->flags) ||
++ vp->dv_before != vnode->status.data_version))
+ /* Ignore the result of a speculative bulk status fetch
+ * if it splits around a modification op, thereby
+ * appearing to regress the data version.
+@@ -910,6 +911,7 @@ int afs_setattr(struct user_namespace *mnt_userns, struct dentry *dentry,
+ }
+ op->ctime = attr->ia_ctime;
+ op->file[0].update_ctime = 1;
++ op->file[0].modification = true;
+
+ op->ops = &afs_setattr_operation;
+ ret = afs_do_sync_operation(op);
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 1627b1872812..be981a9a1add 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -640,6 +640,7 @@ struct afs_vnode {
+ #define AFS_VNODE_PSEUDODIR 7 /* set if Vnode is a pseudo directory */
+ #define AFS_VNODE_NEW_CONTENT 8 /* Set if file has new content (create/trunc-0) */
+ #define AFS_VNODE_SILLY_DELETED 9 /* Set if file has been silly-deleted */
++#define AFS_VNODE_MODIFYING 10 /* Set if we're performing a modification op */
+
+ struct list_head wb_keys; /* List of keys available for writeback */
+ struct list_head pending_locks; /* locks waiting to be granted */
+@@ -756,6 +757,7 @@ struct afs_vnode_param {
+ bool set_size:1; /* Must update i_size */
+ bool op_unlinked:1; /* True if file was unlinked by op */
+ bool speculative:1; /* T if speculative status fetch (no vnode lock) */
++ bool modification:1; /* Set if the content gets modified */
+ };
+
+ /*
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index eb737ed63afb..ebe3b6493fce 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -450,6 +450,7 @@ static int afs_store_data(struct address_space *mapping,
+ afs_op_set_vnode(op, 0, vnode);
+ op->file[0].dv_delta = 1;
+ op->store.mapping = mapping;
++ op->file[0].modification = true;
+ op->store.first = first;
+ op->store.last = last;
+ op->store.first_offset = offset;
+--
+2.30.2
+
--- /dev/null
+From 736139f54348bad9d7f0a642cb6364f66f123a79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 08:59:52 +0000
+Subject: afs: Fix updating of i_mode due to 3rd party change
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 6e1eb04a87f954eb06a89ee6034c166351dfff6e ]
+
+Fix afs_apply_status() to mask off the irrelevant bits from status->mode
+when OR'ing them into i_mode. This can happen when a 3rd party chmod
+occurs.
+
+Also fix afs_inode_init_from_status() to mask off the mode bits when
+initialising i_mode.
+
+Fixes: 260a980317da ("[AFS]: Add "directory write" support.")
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 12be88716e4c..5a70c09f5325 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -102,13 +102,13 @@ static int afs_inode_init_from_status(struct afs_operation *op,
+
+ switch (status->type) {
+ case AFS_FTYPE_FILE:
+- inode->i_mode = S_IFREG | status->mode;
++ inode->i_mode = S_IFREG | (status->mode & S_IALLUGO);
+ inode->i_op = &afs_file_inode_operations;
+ inode->i_fop = &afs_file_operations;
+ inode->i_mapping->a_ops = &afs_fs_aops;
+ break;
+ case AFS_FTYPE_DIR:
+- inode->i_mode = S_IFDIR | status->mode;
++ inode->i_mode = S_IFDIR | (status->mode & S_IALLUGO);
+ inode->i_op = &afs_dir_inode_operations;
+ inode->i_fop = &afs_dir_file_operations;
+ inode->i_mapping->a_ops = &afs_dir_aops;
+@@ -198,7 +198,7 @@ static void afs_apply_status(struct afs_operation *op,
+ if (status->mode != vnode->status.mode) {
+ mode = inode->i_mode;
+ mode &= ~S_IALLUGO;
+- mode |= status->mode;
++ mode |= status->mode & S_IALLUGO;
+ WRITE_ONCE(inode->i_mode, mode);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a5088009b6e8e00c2946ddbea0f0acb0f39730d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 13:19:23 +0200
+Subject: ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
+
+From: Jia Zhou <zhou.jia2@zte.com.cn>
+
+[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ]
+
+modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between
+register and disconnect") resulting in this problem.
+
+Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect")
+Signed-off-by: Jia Zhou <zhou.jia2@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/init.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 45f4b01de23f..ef41f5b3a240 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -398,10 +398,8 @@ int snd_card_disconnect(struct snd_card *card)
+ return 0;
+ }
+ card->shutdown = 1;
+- spin_unlock(&card->files_lock);
+
+ /* replace file->f_op with special dummy operations */
+- spin_lock(&card->files_lock);
+ list_for_each_entry(mfile, &card->files_list, list) {
+ /* it's critical part, use endless loop */
+ /* we have no room to fail */
+--
+2.30.2
+
--- /dev/null
+From fdf219bcaf4667f24aa40fd7c2cd88d9ded3b060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 13:35:34 +0200
+Subject: ALSA: usb-audio: Add error checks for usb_driver_claim_interface()
+ calls
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ]
+
+There are a few calls of usb_driver_claim_interface() but all of those
+miss the proper error checks, as reported by Coverity. This patch
+adds those missing checks.
+
+Along with it, replace the magic pointer with -1 with a constant
+USB_AUDIO_IFACE_UNUSED for better readability.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1475943 ("Error handling issues")
+Addresses-Coverity-ID: 1475944 ("Error handling issues")
+Addresses-Coverity-ID: 1475945 ("Error handling issues")
+Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once")
+Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code")
+Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook
+Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 14 +++++++-------
+ sound/usb/quirks.c | 16 ++++++++++++----
+ sound/usb/usbaudio.h | 2 ++
+ 3 files changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 0826a437f8fc..7b7526d3a56e 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -181,9 +181,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+ ctrlif, interface);
+ return -EINVAL;
+ }
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
+-
+- return 0;
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
+@@ -203,7 +202,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+
+ if (! snd_usb_parse_audio_interface(chip, interface)) {
+ usb_set_interface(dev, interface, 0); /* reset the current interface */
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ return 0;
+@@ -862,7 +862,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)
+ struct snd_card *card;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return;
+
+ card = chip->card;
+@@ -992,7 +992,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ struct usb_mixer_interface *mixer;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ if (!chip->num_suspended_intf++) {
+@@ -1022,7 +1022,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+ struct list_head *p;
+ int err = 0;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ atomic_inc(&chip->active); /* avoid autopm */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 176437a441e6..7c6e83eee71d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -55,8 +55,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,
+ if (!iface)
+ continue;
+ if (quirk->ifnum != probed_ifnum &&
+- !usb_interface_claimed(iface))
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ !usb_interface_claimed(iface)) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+@@ -426,8 +430,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,
+ continue;
+
+ err = create_autodetect_quirk(chip, iface, driver);
+- if (err >= 0)
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ if (err >= 0) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 60b9dd7df6bb..8794c8658ab9 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -61,6 +61,8 @@ struct snd_usb_audio {
+ struct media_intf_devnode *ctl_intf_media_devnode;
+ };
+
++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L)
++
+ #define usb_audio_err(chip, fmt, args...) \
+ dev_err(&(chip)->dev->dev, fmt, ##args)
+ #define usb_audio_warn(chip, fmt, args...) \
+--
+2.30.2
+
--- /dev/null
+From 0fba4146d5102882c8ce97d127a54f2e5e1df41a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 14:47:19 +0100
+Subject: ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check
+ fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ]
+
+Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL)
+the error return path returns -ENOMEM via the exit label "error". Other
+uses of the same error exit label set the err variable to -ENOMEM but this
+is not being used. I believe the original intent was for the error exit
+path to return the value in err rather than the hard coded -ENOMEM, so
+return this rather than the hard coded -ENOMEM.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 738d9edcfd44 ("ALSA: usb-audio: Add sanity checks for invalid EPs")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210420134719.381409-1-colin.king@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/midi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 0c23fa6d8525..cd46ca7cd28d 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1332,7 +1332,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
+
+ error:
+ snd_usbmidi_in_endpoint_delete(ep);
+- return -ENOMEM;
++ return err;
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From e5cb8a26dc6da5c09362fbe13d76c5ee2bb343de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 14:43:06 -0500
+Subject: ARM: dts: aspeed: Rainier: Fix humidity sensor bus address
+
+From: Eddie James <eajames@linux.ibm.com>
+
+[ Upstream commit 1d5d46a1adafafce2b0c9105eab563709c84e3db ]
+
+The si7021 was incorrectly placed at 0x20 on i2c bus 7. It is at 0x40.
+
+Fixes: 9c44db7096e0 ("ARM: dts: aspeed: rainier: Add i2c devices")
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts b/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts
+index 6c9804d2f3b4..6df1ce545061 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts
+@@ -713,9 +713,9 @@
+ multi-master;
+ status = "okay";
+
+- si7021-a20@20 {
++ si7021-a20@40 {
+ compatible = "silabs,si7020";
+- reg = <0x20>;
++ reg = <0x40>;
+ };
+
+ tmp275@48 {
+--
+2.30.2
+
--- /dev/null
+From 76bad212b840b3d98485607e8270f515555ecd6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:17 +0100
+Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on
+ GT-I9100
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 46799802136670e00498f19898f1635fbc85f583 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-1-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4210-i9100.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4210-i9100.dts b/arch/arm/boot/dts/exynos4210-i9100.dts
+index 304a8ee2364c..d98c78207aaf 100644
+--- a/arch/arm/boot/dts/exynos4210-i9100.dts
++++ b/arch/arm/boot/dts/exynos4210-i9100.dts
+@@ -136,7 +136,7 @@
+ compatible = "maxim,max17042";
+
+ interrupt-parent = <&gpx2>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+
+ pinctrl-0 = <&max17042_fuel_irq>;
+ pinctrl-names = "default";
+--
+2.30.2
+
--- /dev/null
+From 88cededaace0bb59cda2c3ae32658e464ec2961f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:18 +0100
+Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4
+ Note family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c731a16e2cf424a462c7d42c33d6acd613576508 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: f48b5050c301 ("ARM: dts: exynos: add Samsung's Exynos4412-based P4 Note boards")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-2-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-p4note.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-p4note.dtsi b/arch/arm/boot/dts/exynos4412-p4note.dtsi
+index b2f9d5448a18..5fe371543cbb 100644
+--- a/arch/arm/boot/dts/exynos4412-p4note.dtsi
++++ b/arch/arm/boot/dts/exynos4412-p4note.dtsi
+@@ -146,7 +146,7 @@
+ pinctrl-0 = <&fuel_alert_irq>;
+ pinctrl-names = "default";
+ interrupt-parent = <&gpx2>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ maxim,rsns-microohm = <10000>;
+ maxim,over-heat-temp = <600>;
+ maxim,over-volt = <4300>;
+--
+2.30.2
+
--- /dev/null
+From 66b93617284384b20d2ea71fde60b617dbc0f710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:19 +0100
+Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8a45f33bd36efbb624198cfa9fdf1f66fd1c3d26 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: e8614292cd41 ("ARM: dts: Add Maxim 77693 fuel gauge node for exynos4412-trats2")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-3-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index 111c32bae02c..b8b75dc81aa1 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -221,7 +221,7 @@
+ fuel-gauge@36 {
+ compatible = "maxim,max17047";
+ interrupt-parent = <&gpx2>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_fuel_irq>;
+ reg = <0x36>;
+--
+2.30.2
+
--- /dev/null
+From 58777acac6d4f62c28cf73ef3334622d23be821a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:20 +0100
+Subject: ARM: dts: exynos: correct MUIC interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 15107e443ab8c6cb35eff10438993e4bc944d9ae ]
+
+The Maxim MUIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 7eec1266751b ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-4-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index b8b75dc81aa1..d75f554efde0 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -173,7 +173,7 @@
+ pmic@66 {
+ compatible = "maxim,max77693";
+ interrupt-parent = <&gpx1>;
+- interrupts = <5 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_irq>;
+ reg = <0x66>;
+--
+2.30.2
+
--- /dev/null
+From c51859303933377bec2bf97f0ea773e52dcbddaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:21 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e52dcd6e70fab51f53292e53336ecb007bb60889 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 15dfdfad2d4a ("ARM: dts: Add basic dts for Exynos4412-based Trats 2 board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-5-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index d75f554efde0..fc77c1bfd844 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -665,7 +665,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&max77686_irq>;
+ pinctrl-names = "default";
+ reg = <0x09>;
+--
+2.30.2
+
--- /dev/null
+From 1326e529cf4977c7c6b857e08de0460f21468230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:23 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit fbe9c9bb2e929865500a0985735f81c0142accad ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: f48b5050c301 ("ARM: dts: exynos: add Samsung's Exynos4412-based P4 Note boards")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-7-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-p4note.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-p4note.dtsi b/arch/arm/boot/dts/exynos4412-p4note.dtsi
+index 5fe371543cbb..9e750890edb8 100644
+--- a/arch/arm/boot/dts/exynos4412-p4note.dtsi
++++ b/arch/arm/boot/dts/exynos4412-p4note.dtsi
+@@ -322,7 +322,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&max77686_irq>;
+ pinctrl-names = "default";
+ reg = <0x09>;
+--
+2.30.2
+
--- /dev/null
+From 75af214cf851a6c143cdbcad200f474d360027f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:24 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+index 8b5a79a8720c..39bbe18145cf 100644
+--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+@@ -134,7 +134,7 @@
+ compatible = "maxim,max77686";
+ reg = <0x09>;
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ #clock-cells = <1>;
+--
+2.30.2
+
--- /dev/null
+From ea35edf3e42d0acd8d810d5684644474ca37b366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:22 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: eea6653aae7b ("ARM: dts: Enable PMIC interrupts for exynos4412-odroid-common")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-6-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+index 2b20d9095d9f..eebe6a3952ce 100644
+--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+@@ -278,7 +278,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ reg = <0x09>;
+--
+2.30.2
+
--- /dev/null
+From a2a5b675f0a9ce098ab6cfac4453032ab48b151a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:25 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+index 6635f6184051..2335c4687349 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+@@ -292,7 +292,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ wakeup-source;
+--
+2.30.2
+
--- /dev/null
+From 3c52411782fd7749a54be448df90e103893090cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 19:28:15 +0100
+Subject: ARM: dts: qcom: msm8974-lge-nexus5: correct fuel gauge interrupt
+ trigger level
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 9d816b423dab5b59beec5e39b97428feac599ba7 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: 45dfa741df86 ("ARM: dts: qcom: msm8974-lge-nexus5: Add fuel gauge")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Iskren Chernev <iskren.chernev@gmail.com>
+Link: https://lore.kernel.org/r/20210303182816.137255-1-krzk@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+index 0cda654371ae..56ee02ceba7d 100644
+--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+@@ -575,7 +575,7 @@
+ maxim,rcomp = /bits/ 8 <0x4d>;
+
+ interrupt-parent = <&msmgpio>;
+- interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <9 IRQ_TYPE_LEVEL_LOW>;
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&fuelgauge_pin>;
+--
+2.30.2
+
--- /dev/null
+From 386019517f61fe3fe13d75147af9d805bd474b10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 19:28:16 +0100
+Subject: ARM: dts: qcom: msm8974-samsung-klte: correct fuel gauge interrupt
+ trigger level
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 5fde3361ba57a9b4eb560dabf859176909d61004 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: da8d46992e67 ("ARM: dts: qcom: msm8974-klte: Add fuel gauge")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-By: Iskren Chernev <iskren.chernev@gmail.com>
+Tested-By: Iskren Chernev <iskren.chernev@gmail.com>
+Link: https://lore.kernel.org/r/20210303182816.137255-2-krzk@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts b/arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts
+index a0f7f461f48c..2dadb836c5fe 100644
+--- a/arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts
++++ b/arch/arm/boot/dts/qcom-msm8974-samsung-klte.dts
+@@ -717,7 +717,7 @@
+ maxim,rcomp = /bits/ 8 <0x56>;
+
+ interrupt-parent = <&pma8084_gpios>;
+- interrupts = <21 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&fuelgauge_pin>;
+--
+2.30.2
+
--- /dev/null
+From fd8c4fc48b849900c39f5dc80c72776831effdd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 21:01:56 +0900
+Subject: ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit da926e813fc7f9f0912fa413981a1f5ba63a536d ]
+
+After set PROBE_PREFER_ASYNCHRONOUS flag on the mmc host drivers,
+the order of /dev/mmcblkN was not fixed in some SoCs which have
+multiple SDHI and/or MMCIF controllers. So, we were hard to use
+such a device as rootfs by using the kernel parameter like
+"root=/dev/mmcblkNpM".
+
+According to the discussion on a mainling list [1], we can add
+mmc aliases to fix the issue. So, add such aliases into R-Car Gen2
+board dts files. Note that, since R-Car Gen2 is even more complicated
+about SDHI and/or MMCIF channels variations and they share pins,
+add the aliases into board dts files instead of SoC dtsi files.
+
+[1]
+https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/
+
+Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14")
+Fixes: 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1613131316-30994-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7790-lager.dts | 3 +++
+ arch/arm/boot/dts/r8a7791-koelsch.dts | 3 +++
+ arch/arm/boot/dts/r8a7791-porter.dts | 2 ++
+ arch/arm/boot/dts/r8a7793-gose.dts | 3 +++
+ arch/arm/boot/dts/r8a7794-alt.dts | 3 +++
+ arch/arm/boot/dts/r8a7794-silk.dts | 2 ++
+ 6 files changed, 16 insertions(+)
+
+diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts
+index 09a152b91557..1d6f0c5d02e9 100644
+--- a/arch/arm/boot/dts/r8a7790-lager.dts
++++ b/arch/arm/boot/dts/r8a7790-lager.dts
+@@ -53,6 +53,9 @@
+ i2c11 = &i2cexio1;
+ i2c12 = &i2chdmi;
+ i2c13 = &i2cpwr;
++ mmc0 = &mmcif1;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
+index f603cba5441f..6af1727b8269 100644
+--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
+@@ -53,6 +53,9 @@
+ i2c12 = &i2cexio1;
+ i2c13 = &i2chdmi;
+ i2c14 = &i2cexio4;
++ mmc0 = &sdhi0;
++ mmc1 = &sdhi1;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts
+index c6d563fb7ec7..bf51e29c793a 100644
+--- a/arch/arm/boot/dts/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/r8a7791-porter.dts
+@@ -28,6 +28,8 @@
+ serial0 = &scif0;
+ i2c9 = &gpioi2c2;
+ i2c10 = &i2chdmi;
++ mmc0 = &sdhi0;
++ mmc1 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts
+index abf487e8fe0f..2b59a0491350 100644
+--- a/arch/arm/boot/dts/r8a7793-gose.dts
++++ b/arch/arm/boot/dts/r8a7793-gose.dts
+@@ -49,6 +49,9 @@
+ i2c10 = &gpioi2c4;
+ i2c11 = &i2chdmi;
+ i2c12 = &i2cexio4;
++ mmc0 = &sdhi0;
++ mmc1 = &sdhi1;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm/boot/dts/r8a7794-alt.dts b/arch/arm/boot/dts/r8a7794-alt.dts
+index 3f1cc5bbf329..32025986b3b9 100644
+--- a/arch/arm/boot/dts/r8a7794-alt.dts
++++ b/arch/arm/boot/dts/r8a7794-alt.dts
+@@ -19,6 +19,9 @@
+ i2c10 = &gpioi2c4;
+ i2c11 = &i2chdmi;
+ i2c12 = &i2cexio4;
++ mmc0 = &mmcif0;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi1;
+ };
+
+ chosen {
+diff --git a/arch/arm/boot/dts/r8a7794-silk.dts b/arch/arm/boot/dts/r8a7794-silk.dts
+index 677596f6c9c9..af066ee5e275 100644
+--- a/arch/arm/boot/dts/r8a7794-silk.dts
++++ b/arch/arm/boot/dts/r8a7794-silk.dts
+@@ -31,6 +31,8 @@
+ serial0 = &scif2;
+ i2c9 = &gpioi2c1;
+ i2c10 = &i2chdmi;
++ mmc0 = &mmcif0;
++ mmc1 = &sdhi1;
+ };
+
+ chosen {
+--
+2.30.2
+
--- /dev/null
+From 667703053ebc15cb37bc7f1424bde83e5121a46c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:26 +0100
+Subject: ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on
+ Fascinate family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 214e6ec8c9f5a3353d3282b3ff475d3ee86cc21a ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: 99bb20321f0e ("ARM: dts: s5pv210: Correct fuelgauge definition on Aries")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-10-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/s5pv210-fascinate4g.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/s5pv210-fascinate4g.dts b/arch/arm/boot/dts/s5pv210-fascinate4g.dts
+index ca064359dd30..b47d8300e536 100644
+--- a/arch/arm/boot/dts/s5pv210-fascinate4g.dts
++++ b/arch/arm/boot/dts/s5pv210-fascinate4g.dts
+@@ -115,7 +115,7 @@
+ compatible = "maxim,max77836-battery";
+
+ interrupt-parent = <&gph3>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&fg_irq>;
+--
+2.30.2
+
--- /dev/null
+From a0eaa76fb06e10d669ebbabff7d679e65144b9f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 12:07:03 +0100
+Subject: ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
+
+From: Valentin CARON - foss <valentin.caron@foss.st.com>
+
+[ Upstream commit a1429f3d3029b65cd4032f6218d5290911377ce4 ]
+
+Modify usart 2 & 3 pins to allow wake up from low power mode while the
+hardware flow control is activated. UART RTS pin need to stay configure
+in idle mode to receive characters in order to wake up.
+
+Fixes: 842ed898a757 ("ARM: dts: stm32: add usart2, usart3 and uart7 pins in stm32mp15-pinctrl")
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index 7b4249ed1983..060baa8b7e9d 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1891,10 +1891,15 @@
+ usart2_idle_pins_c: usart2-idle-2 {
+ pins1 {
+ pinmux = <STM32_PINMUX('D', 5, ANALOG)>, /* USART2_TX */
+- <STM32_PINMUX('D', 4, ANALOG)>, /* USART2_RTS */
+ <STM32_PINMUX('D', 3, ANALOG)>; /* USART2_CTS_NSS */
+ };
+ pins2 {
++ pinmux = <STM32_PINMUX('D', 4, AF7)>; /* USART2_RTS */
++ bias-disable;
++ drive-push-pull;
++ slew-rate = <3>;
++ };
++ pins3 {
+ pinmux = <STM32_PINMUX('D', 6, AF7)>; /* USART2_RX */
+ bias-disable;
+ };
+@@ -1940,10 +1945,15 @@
+ usart3_idle_pins_b: usart3-idle-1 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 10, ANALOG)>, /* USART3_TX */
+- <STM32_PINMUX('G', 8, ANALOG)>, /* USART3_RTS */
+ <STM32_PINMUX('I', 10, ANALOG)>; /* USART3_CTS_NSS */
+ };
+ pins2 {
++ pinmux = <STM32_PINMUX('G', 8, AF8)>; /* USART3_RTS */
++ bias-disable;
++ drive-push-pull;
++ slew-rate = <0>;
++ };
++ pins3 {
+ pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
+ bias-disable;
+ };
+@@ -1976,10 +1986,15 @@
+ usart3_idle_pins_c: usart3-idle-2 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 10, ANALOG)>, /* USART3_TX */
+- <STM32_PINMUX('G', 8, ANALOG)>, /* USART3_RTS */
+ <STM32_PINMUX('B', 13, ANALOG)>; /* USART3_CTS_NSS */
+ };
+ pins2 {
++ pinmux = <STM32_PINMUX('G', 8, AF8)>; /* USART3_RTS */
++ bias-disable;
++ drive-push-pull;
++ slew-rate = <0>;
++ };
++ pins3 {
+ pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
+ bias-disable;
+ };
+--
+2.30.2
+
--- /dev/null
+From 265443e5a533da0c8f3a910cbd659e04a7070dc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 02:31:48 +0900
+Subject: ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins
+ for RTL8211E
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ]
+
+UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX
+delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
+
+After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the delays are working correctly, however, "rgmii" means
+no delay and the phy doesn't work. So need to set the phy-mode to
+"rgmii-id" to show that RX/TX delays are enabled.
+
+Fixes: e3cc931921d2 ("ARM: dts: uniphier: add AVE ethernet node")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+index b0b15c97306b..e81e5937a60a 100644
+--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi
++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+@@ -583,7 +583,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+--
+2.30.2
+
--- /dev/null
+From a30dd6f332ad1935ece307db6282cb5412652369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 19:44:09 +0100
+Subject: arm64: dts: broadcom: bcm4908: fix switch parent node name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit a348ff97ffb840b9d74b0e64b3e0e6002187d224 ]
+
+Ethernet switch and MDIO are grouped using "simple-bus". It's not
+allowed to use "ethernet-switch" node name as it isn't a switch. Replace
+it with "bus".
+
+Fixes: 527a3ac9bdf8 ("arm64: dts: broadcom: bcm4908: describe internal switch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+index 9354077f74cd..9e799328c6db 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+@@ -131,7 +131,7 @@
+ status = "disabled";
+ };
+
+- ethernet-switch@80000 {
++ bus@80000 {
+ compatible = "simple-bus";
+ #size-cells = <1>;
+ #address-cells = <1>;
+--
+2.30.2
+
--- /dev/null
+From 30ffd1e988758a8f34bdf2aeef886c07c98d78e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 12:01:20 +0100
+Subject: arm64: dts: broadcom: bcm4908: set Asus GT-AC5300 port 7 PHY mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 5ccb9f9cf05bbd729430c6d6d30d40c96a15c56a ]
+
+Port 7 is connected to the external BCM53134S switch using RGMII.
+
+Fixes: 527a3ac9bdf8 ("arm64: dts: broadcom: bcm4908: describe internal switch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts
+index 6e4ad66ff536..8d5d368dbe90 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts
+@@ -65,6 +65,7 @@
+ port@7 {
+ label = "sw";
+ reg = <7>;
++ phy-mode = "rgmii";
+
+ fixed-link {
+ speed = <1000>;
+--
+2.30.2
+
--- /dev/null
+From 88ada1659c21c6d019b230b9ad4ac70e0db075f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 23:18:26 +0100
+Subject: arm64: dts: mediatek: fix reset GPIO level on pumpkin
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit a7dceafed43a4a610d340da3703653cca2c50c1d ]
+
+The tca6416 chip is active low. Fix the reset-gpios value.
+
+Fixes: e2a8fa1e0faa ("arm64: dts: mediatek: fix tca6416 reset GPIOs in pumpkin")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Link: https://lore.kernel.org/r/20210223221826.2063911-1-fparent@baylibre.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
+index 63fd70086bb8..9f27e7ed5e22 100644
+--- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
++++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
+@@ -56,7 +56,7 @@
+ tca6416: gpio@20 {
+ compatible = "ti,tca6416";
+ reg = <0x20>;
+- reset-gpios = <&pio 65 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&pio 65 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&tca6416_pins>;
+
+--
+2.30.2
+
--- /dev/null
+From f61c27ada0dbd3bd675426157100fa3f50ef52b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 14:18:48 +0800
+Subject: arm64: dts: mt8173: fix wrong power-domain phandle of pmic
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 4db2b9af3ee92e6c51c6a9a5dc2748e4bc1800f9 ]
+
+Due to power domain controller is added, the power domain's
+phanle is also changed from 'scpsys' to 'spm', but forget to
+modify pmic node's
+
+Fixes: 8b6562644df9 ("arm64: dts: mediatek: Add mt8173 power domain controller")
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/1616048328-13579-1-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+index 6dffada2e66b..28aa634c9780 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+@@ -294,7 +294,7 @@
+
+ &pwrap {
+ /* Only MT8173 E1 needs USB power domain */
+- power-domains = <&scpsys MT8173_POWER_DOMAIN_USB>;
++ power-domains = <&spm MT8173_POWER_DOMAIN_USB>;
+
+ pmic: mt6397 {
+ compatible = "mediatek,mt6397";
+--
+2.30.2
+
--- /dev/null
+From d54029f1144e7e69de6670c679dee0c38a93a9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:08:42 +0800
+Subject: arm64: dts: mt8183: Add gce client reg for display subcomponents
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit b7a8f50a1437164607f73831075c06120aa1f3b3 ]
+
+Add mediatek,gce-client-reg for mmsys, ccorr, aal, gamma, dither.
+
+Fixes: 91f9c963ce79 ("arm64: dts: mt8183: Add display nodes for MT8183")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20210324070842.1037233-1-hsinyi@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 80519a145f13..16f4b1fc0fb9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -983,6 +983,9 @@
+ compatible = "mediatek,mt8183-mmsys", "syscon";
+ reg = <0 0x14000000 0 0x1000>;
+ #clock-cells = <1>;
++ mboxes = <&gce 0 CMDQ_THR_PRIO_HIGHEST>,
++ <&gce 1 CMDQ_THR_PRIO_HIGHEST>;
++ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0 0x1000>;
+ };
+
+ ovl0: ovl@14008000 {
+@@ -1058,6 +1061,7 @@
+ interrupts = <GIC_SPI 232 IRQ_TYPE_LEVEL_LOW>;
+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ clocks = <&mmsys CLK_MM_DISP_CCORR0>;
++ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0xf000 0x1000>;
+ };
+
+ aal0: aal@14010000 {
+@@ -1067,6 +1071,7 @@
+ interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_LOW>;
+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ clocks = <&mmsys CLK_MM_DISP_AAL0>;
++ mediatek,gce-client-reg = <&gce SUBSYS_1401XXXX 0 0x1000>;
+ };
+
+ gamma0: gamma@14011000 {
+@@ -1075,6 +1080,7 @@
+ interrupts = <GIC_SPI 234 IRQ_TYPE_LEVEL_LOW>;
+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ clocks = <&mmsys CLK_MM_DISP_GAMMA0>;
++ mediatek,gce-client-reg = <&gce SUBSYS_1401XXXX 0x1000 0x1000>;
+ };
+
+ dither0: dither@14012000 {
+@@ -1083,6 +1089,7 @@
+ interrupts = <GIC_SPI 235 IRQ_TYPE_LEVEL_LOW>;
+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ clocks = <&mmsys CLK_MM_DISP_DITHER0>;
++ mediatek,gce-client-reg = <&gce SUBSYS_1401XXXX 0x2000 0x1000>;
+ };
+
+ dsi0: dsi@14014000 {
+--
+2.30.2
+
--- /dev/null
+From 022f1d4f4441d72be75bad58a4072074cdca15db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 10:20:25 +0000
+Subject: arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit c561740e7cfefaf3003a256f3a0cd9f8a069137c ]
+
+WSA881x powerdown pin is connected to GPIO1 not gpio2, so correct this.
+This was working so far due to a shift bug in gpio driver, however
+once that is fixed this will stop working, so fix this!
+
+Fixes: 89a32a4e769cc ("arm64: dts: qcom: db845c: add analog audio support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210309102025.28405-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index c4ac6f5dc008..96d36b38f269 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -1015,7 +1015,7 @@
+ left_spkr: wsa8810-left{
+ compatible = "sdw10217201000";
+ reg = <0 1>;
+- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrLeft";
+ #sound-dai-cells = <0>;
+@@ -1023,7 +1023,7 @@
+
+ right_spkr: wsa8810-right{
+ compatible = "sdw10217201000";
+- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>;
+ reg = <0 2>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrRight";
+--
+2.30.2
+
--- /dev/null
+From fb32b6dcd8a5bc0a4e2857ebafbdc9f6e8ebfe98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 14:55:09 -0800
+Subject: arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit e440e30e26dd6b0424002ad0ddcbbcea783efd85 ]
+
+At boot time the following happens:
+1. Device core gets ready to probe our SPI driver.
+2. Device core applies SPI controller's "default" pinctrl.
+3. Device core calls the SPI driver's probe() function which will
+ eventually setup the chip select GPIO as "unasserted".
+
+Thinking about the above, we can find:
+a) For SPI devices that the BIOS inits (Cr50 and EC), the BIOS would
+ have had them configured as "GENI" pins and not as "GPIO" pins.
+b) It turns out that our BIOS also happens to init these pins as
+ "output" (even though it doesn't need to since they're not muxed as
+ GPIO) but leaves them at the default state of "low".
+c) As soon as we apply the "default" chip select it'll switch the
+ function to GPIO and stop driving the chip select high (which is
+ how "GENI" was driving it) and start driving it low.
+d) As of commit 9378f46040be ("UPSTREAM: spi: spi-geni-qcom: Use the
+ new method of gpio CS control"), when the SPI core inits things it
+ inits the GPIO to be "deasserted". Prior to that commit the GPIO
+ was left untouched until first use.
+e) When the first transaction happens we'll assert the chip select and
+ then deassert it after done.
+
+So before the commit to change us to use gpio descriptors we used to
+have a _really long_ assertion of chip select before our first
+transaction (because it got pulled down and then the first "assert"
+was a no-op). That wasn't great but (apparently) didn't cause any
+real harm.
+
+After the commit to change us to use gpio descriptors we end up
+glitching the chip select line during probe. It would go low and then
+high with no data transferred. The other side ought to be robust
+against this, but it certainly could cause some confusion. It's known
+to at least cause an error message on the EC console and it's believed
+that, under certain timing conditions, it could be getting the EC into
+a confused state causing the EC driver to fail to probe.
+
+Let's fix things to avoid the glitch. We'll add an extra pinctrl
+entry that sets the value of the pin to output high (CS deasserted)
+before doing anything else. We'll do this in its own pinctrl node
+that comes before the normal pinctrl entries to ensure that the order
+is correct and that this gets applied before the mux change.
+
+This change is in the trogdor board file rather than in the SoC dtsi
+file because chip select polarity can be different depending on what's
+hooked up and it doesn't feel worth it to spam the SoC dtsi file with
+both options. The board file would need to pick the right one anyway.
+
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Fixes: cfbb97fde694 ("arm64: dts: qcom: Switch sc7180-trogdor to control SPI CS via GPIO")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20210218145456.1.I1da01a075dd86e005152f993b2d5d82dd9686238@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 27 +++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+index 753fd320dfbc..b8f7cf5cbdab 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+@@ -770,17 +770,17 @@ hp_i2c: &i2c9 {
+ };
+
+ &spi0 {
+- pinctrl-0 = <&qup_spi0_cs_gpio>;
++ pinctrl-0 = <&qup_spi0_cs_gpio_init_high>, <&qup_spi0_cs_gpio>;
+ cs-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+ };
+
+ &spi6 {
+- pinctrl-0 = <&qup_spi6_cs_gpio>;
++ pinctrl-0 = <&qup_spi6_cs_gpio_init_high>, <&qup_spi6_cs_gpio>;
+ cs-gpios = <&tlmm 62 GPIO_ACTIVE_LOW>;
+ };
+
+ ap_spi_fp: &spi10 {
+- pinctrl-0 = <&qup_spi10_cs_gpio>;
++ pinctrl-0 = <&qup_spi10_cs_gpio_init_high>, <&qup_spi10_cs_gpio>;
+ cs-gpios = <&tlmm 89 GPIO_ACTIVE_LOW>;
+
+ cros_ec_fp: ec@0 {
+@@ -1341,6 +1341,27 @@ ap_spi_fp: &spi10 {
+ };
+ };
+
++ qup_spi0_cs_gpio_init_high: qup-spi0-cs-gpio-init-high {
++ pinconf {
++ pins = "gpio37";
++ output-high;
++ };
++ };
++
++ qup_spi6_cs_gpio_init_high: qup-spi6-cs-gpio-init-high {
++ pinconf {
++ pins = "gpio62";
++ output-high;
++ };
++ };
++
++ qup_spi10_cs_gpio_init_high: qup-spi10-cs-gpio-init-high {
++ pinconf {
++ pins = "gpio89";
++ output-high;
++ };
++ };
++
+ qup_uart3_sleep: qup-uart3-sleep {
+ pinmux {
+ pins = "gpio38", "gpio39",
+--
+2.30.2
+
--- /dev/null
+From 728fac9588f63bc1ee1a3882fe4c73726fbf25df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 10:33:36 -0800
+Subject: arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger
+ thermal zone
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit 38f3267def6511171aef0f056ad172686903603f ]
+
+The trip point configuration of the charger thermal zone for trogdor
+is missing a node for the critical trip point. Add the missing node.
+
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Fixes: bb06eb3607e9 ("arm64: qcom: sc7180: trogdor: Add ADC nodes and thermal zone for charger thermistor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Link: https://lore.kernel.org/r/20210225103330.v2.3.Ife7768b6b4765026c9d233ad4982da0e365ddbca@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+index 07c8b2c926c0..753fd320dfbc 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+@@ -22,9 +22,11 @@
+ thermal-sensors = <&pm6150_adc_tm 1>;
+
+ trips {
+- temperature = <125000>;
+- hysteresis = <1000>;
+- type = "critical";
++ charger-crit {
++ temperature = <125000>;
++ hysteresis = <1000>;
++ type = "critical";
++ };
+ };
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 9767fed72ab88cf2b90db14a2a8ba7253bf63d56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:31:03 +0800
+Subject: arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 02058fc3839df65ff64de2a6b1c5de8c9fd705c1 ]
+
+The last cell of 'gpio-ranges' should be number of GPIO pins, and in
+case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
+than msm_pinctrl_soc_data.ngpio - 1.
+
+This fixes the problem that when the last GPIO pin in the range is
+configured with the following call sequence, it always fails with
+-EPROBE_DEFER.
+
+ pinctrl_gpio_set_config()
+ pinctrl_get_device_gpio_range()
+ pinctrl_match_gpio_range()
+
+Fixes: bc2c806293c6 ("arm64: dts: qcom: sdm845: Add gpio-ranges to TLMM node")
+Cc: Evan Green <evgreen@chromium.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20210303033106.549-2-shawn.guo@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 454f794af547..6a2ed02d383d 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2382,7 +2382,7 @@
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- gpio-ranges = <&tlmm 0 0 150>;
++ gpio-ranges = <&tlmm 0 0 151>;
+ wakeup-parent = <&pdc_intc>;
+
+ cci0_default: cci0-default {
+--
+2.30.2
+
--- /dev/null
+From c16629119bbc9295e6c1189bcd68bbabd69c7787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:31:04 +0800
+Subject: arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit de3abdf3d15c6e7f456e2de3f9da78f3a31414cc ]
+
+The last cell of 'gpio-ranges' should be number of GPIO pins, and in
+case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
+than msm_pinctrl_soc_data.ngpio - 1.
+
+This fixes the problem that when the last GPIO pin in the range is
+configured with the following call sequence, it always fails with
+-EPROBE_DEFER.
+
+ pinctrl_gpio_set_config()
+ pinctrl_get_device_gpio_range()
+ pinctrl_match_gpio_range()
+
+Fixes: e13c6d144fa0 ("arm64: dts: qcom: sm8150: Add base dts file")
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20210303033106.549-3-shawn.guo@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index e5bb17bc2f46..778613d3410b 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -914,7 +914,7 @@
+ <0x0 0x03D00000 0x0 0x300000>;
+ reg-names = "west", "east", "north", "south";
+ interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+- gpio-ranges = <&tlmm 0 0 175>;
++ gpio-ranges = <&tlmm 0 0 176>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+--
+2.30.2
+
--- /dev/null
+From 3559c0fcb6372a07b30e2f84904c7cff1533da83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 15:00:48 +0300
+Subject: arm64: dts: qcom: sm8250: fix display nodes
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 888771a9d04ff7bf96e5ecad37969002c88a95d7 ]
+
+Apply these fixes to the newly added sm8250 display ndoes
+ - Remove "notused" interconnect (which apparently was blindly copied from
+ my old patches)
+ - Use dispcc node example from dt-bindings, removing clocks which aren't
+ documented or used by the driver and fixing the region size.
+
+Fixes: 7c1dffd471b1 ("arm64: dts: qcom: sm8250.dtsi: add display system nodes")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+[DB: compatibility changes split into separate patch]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210329120051.3401567-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 27 ++++++---------------------
+ 1 file changed, 6 insertions(+), 21 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index c30872c94686..46a6c18cea91 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -2327,10 +2327,9 @@
+ reg = <0 0x0ae00000 0 0x1000>;
+ reg-names = "mdss";
+
+- interconnects = <&gem_noc MASTER_AMPSS_M0 &config_noc SLAVE_DISPLAY_CFG>,
+- <&mmss_noc MASTER_MDP_PORT0 &mc_virt SLAVE_EBI_CH0>,
++ interconnects = <&mmss_noc MASTER_MDP_PORT0 &mc_virt SLAVE_EBI_CH0>,
+ <&mmss_noc MASTER_MDP_PORT1 &mc_virt SLAVE_EBI_CH0>;
+- interconnect-names = "notused", "mdp0-mem", "mdp1-mem";
++ interconnect-names = "mdp0-mem", "mdp1-mem";
+
+ power-domains = <&dispcc MDSS_GDSC>;
+
+@@ -2580,7 +2579,7 @@
+
+ dispcc: clock-controller@af00000 {
+ compatible = "qcom,sm8250-dispcc";
+- reg = <0 0x0af00000 0 0x20000>;
++ reg = <0 0x0af00000 0 0x10000>;
+ mmcx-supply = <&mmcx_reg>;
+ clocks = <&rpmhcc RPMH_CXO_CLK>,
+ <&dsi0_phy 0>,
+@@ -2588,28 +2587,14 @@
+ <&dsi1_phy 0>,
+ <&dsi1_phy 1>,
+ <0>,
+- <0>,
+- <0>,
+- <0>,
+- <0>,
+- <0>,
+- <0>,
+- <0>,
+- <&sleep_clk>;
++ <0>;
+ clock-names = "bi_tcxo",
+ "dsi0_phy_pll_out_byteclk",
+ "dsi0_phy_pll_out_dsiclk",
+ "dsi1_phy_pll_out_byteclk",
+ "dsi1_phy_pll_out_dsiclk",
+- "dp_link_clk_divsel_ten",
+- "dp_vco_divided_clk_src_mux",
+- "dptx1_phy_pll_link_clk",
+- "dptx1_phy_pll_vco_div_clk",
+- "dptx2_phy_pll_link_clk",
+- "dptx2_phy_pll_vco_div_clk",
+- "edp_phy_pll_link_clk",
+- "edp_phy_pll_vco_div_clk",
+- "sleep_clk";
++ "dp_phy_pll_link_clk",
++ "dp_phy_pll_vco_div_clk";
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ #power-domain-cells = <1>;
+--
+2.30.2
+
--- /dev/null
+From 5125c32fecf1cd4b55fb22bded27d24389073834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:17:47 +0530
+Subject: arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit 93138ef5ac923b10f81575d35dbcb83136cbfc40 ]
+
+As per interrupt documentation for SM8250 SoC, the polarity
+for level triggered PMU interrupt is low, fix this.
+
+Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Link: https://lore.kernel.org/r/96680a1c6488955c9eef7973c28026462b2a4ec0.1613468366.git.saiprakash.ranjan@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 947e1accae3a..1864c459a563 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -279,7 +279,7 @@
+
+ pmu {
+ compatible = "arm,armv8-pmuv3";
+- interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+ };
+
+ psci {
+--
+2.30.2
+
--- /dev/null
+From cf3a5ad33b5b78616dd11ce2ca333fa20f92c828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:31:05 +0800
+Subject: arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit e526cb03e2aed42866a0919485a3d8ac130972cf ]
+
+The last cell of 'gpio-ranges' should be number of GPIO pins, and in
+case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
+than msm_pinctrl_soc_data.ngpio - 1.
+
+This fixes the problem that when the last GPIO pin in the range is
+configured with the following call sequence, it always fails with
+-EPROBE_DEFER.
+
+ pinctrl_gpio_set_config()
+ pinctrl_get_device_gpio_range()
+ pinctrl_match_gpio_range()
+
+Fixes: 16951b490b20 ("arm64: dts: qcom: sm8250: Add TLMM pinctrl node")
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20210303033106.549-4-shawn.guo@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 3232ac6253bb..c30872c94686 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -2689,7 +2689,7 @@
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- gpio-ranges = <&tlmm 0 0 180>;
++ gpio-ranges = <&tlmm 0 0 181>;
+ wakeup-parent = <&pdc>;
+
+ pri_mi2s_active: pri-mi2s-active {
+--
+2.30.2
+
--- /dev/null
+From 3bd3e4ec3280ae4744ccdccda4b049f607ee2887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:17:49 +0530
+Subject: arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical
+ timer
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit 29a3349543e4ce3fe4e2a761403cc629e3534c67 ]
+
+ARM architected timer interrupts DT property specifies EL2/HYP
+physical interrupt and not EL2/HYP virtual interrupt for the 4th
+interrupt property. As per interrupt documentation for SM8250 SoC,
+the EL2/HYP physical timer interrupt is 10 and EL2/HYP virtual timer
+interrupt is 12, so fix the 4th timer interrupt to be EL2 physical
+timer interrupt (10 in this case).
+
+Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Link: https://lore.kernel.org/r/744e58f725d279eb2b049a7da42b0f09189f4054.1613468366.git.saiprakash.ranjan@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 1864c459a563..3232ac6253bb 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -3754,7 +3754,7 @@
+ (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+ <GIC_PPI 11
+ (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+- <GIC_PPI 12
++ <GIC_PPI 10
+ (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 9b53dfed72807379cae9c117d0f95232606691c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:17:48 +0530
+Subject: arm64: dts: qcom: sm8350: Fix level triggered PMU interrupt polarity
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit 794d3e309e44c99158d0166b1717f297341cf3ab ]
+
+As per interrupt documentation for SM8350 SoC, the polarity
+for level triggered PMU interrupt is low, fix this.
+
+Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC")
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Link: https://lore.kernel.org/r/ca57409198477f7815e32a6a7467dcdc9b93dc4f.1613468366.git.saiprakash.ranjan@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 5ef460458f5c..e8bf3f95c674 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -153,7 +153,7 @@
+
+ pmu {
+ compatible = "arm,armv8-pmuv3";
+- interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+ };
+
+ psci {
+--
+2.30.2
+
--- /dev/null
+From d9dd085bf1cca64b97fce87693e59433c0068f61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:31:06 +0800
+Subject: arm64: dts: qcom: sm8350: fix number of pins in 'gpio-ranges'
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 790158579c8e663081e7d708d57e8ac6d69dca4e ]
+
+The last cell of 'gpio-ranges' should be number of GPIO pins, and in
+case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
+than msm_pinctrl_soc_data.ngpio - 1.
+
+This fixes the problem that when the last GPIO pin in the range is
+configured with the following call sequence, it always fails with
+-EPROBE_DEFER.
+
+ pinctrl_gpio_set_config()
+ pinctrl_get_device_gpio_range()
+ pinctrl_match_gpio_range()
+
+Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC")
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20210303033106.549-5-shawn.guo@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index e8bf3f95c674..e2fca420e518 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -382,7 +382,7 @@
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- gpio-ranges = <&tlmm 0 0 203>;
++ gpio-ranges = <&tlmm 0 0 204>;
+
+ qup_uart3_default_state: qup-uart3-default-state {
+ rx {
+--
+2.30.2
+
--- /dev/null
+From fd545263192f97c70b4ff6abe49344a6bc3f56c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Mar 2021 20:06:26 +0900
+Subject: arm64: dts: renesas: Add mmc aliases into board dts files
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit d765a4f302cc046ca23453ba990d21120ceadbbd ]
+
+After the commit 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS
+for drivers that existed in v4.14"), the order of /dev/mmcblkN
+was not fixed in some SoCs which have multiple sdhi controllers.
+So, we were hard to use an sdhi device as rootfs by using
+the kernel parameter like "root=/dev/mmcblkNpM".
+
+According to the discussion on a mainling list [1], we can add
+mmc aliases to fix the issue. So, add such aliases into Renesas
+arm64 board dts files. Notes that mmc0 is an eMMC channel if
+available.
+
+[1]
+https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/
+
+Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1614596786-22326-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/hihope-common.dtsi | 3 +++
+ arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts | 3 +++
+ arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts | 3 +++
+ arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts | 2 ++
+ arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts | 3 +++
+ arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 3 +++
+ arch/arm64/boot/dts/renesas/salvator-common.dtsi | 3 +++
+ arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 1 +
+ arch/arm64/boot/dts/renesas/ulcb.dtsi | 2 ++
+ 9 files changed, 23 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/hihope-common.dtsi b/arch/arm64/boot/dts/renesas/hihope-common.dtsi
+index 7a3da9b06f67..0c7e6f790590 100644
+--- a/arch/arm64/boot/dts/renesas/hihope-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/hihope-common.dtsi
+@@ -12,6 +12,9 @@
+ aliases {
+ serial0 = &scif2;
+ serial1 = &hscif0;
++ mmc0 = &sdhi3;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
+index 501cb05da228..3cf2e076940f 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
++++ b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts
+@@ -21,6 +21,9 @@
+ serial4 = &hscif2;
+ serial5 = &scif5;
+ ethernet0 = &avb;
++ mmc0 = &sdhi3;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts b/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
+index 71763f4402a7..3c0d59def8ee 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
++++ b/arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dts
+@@ -22,6 +22,9 @@
+ serial5 = &scif5;
+ serial6 = &scif4;
+ ethernet0 = &avb;
++ mmc0 = &sdhi3;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
+index ea87cb5a459c..33257c6440b2 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
++++ b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts
+@@ -17,6 +17,8 @@
+ aliases {
+ serial0 = &scif2;
+ serial1 = &hscif2;
++ mmc0 = &sdhi0;
++ mmc1 = &sdhi3;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts b/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
+index 273f062f2909..7b6649a3ded0 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
++++ b/arch/arm64/boot/dts/renesas/r8a774e1-beacon-rzg2h-kit.dts
+@@ -22,6 +22,9 @@
+ serial5 = &scif5;
+ serial6 = &scif4;
+ ethernet0 = &avb;
++ mmc0 = &sdhi3;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi2;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+index f74f8b9993f1..6d6cdc4c324b 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+@@ -16,6 +16,9 @@
+ aliases {
+ serial0 = &scif2;
+ ethernet0 = &avb;
++ mmc0 = &sdhi3;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi1;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+index c22bb38994e8..15bb1eeb6601 100644
+--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+@@ -36,6 +36,9 @@
+ serial0 = &scif2;
+ serial1 = &hscif1;
+ ethernet0 = &avb;
++ mmc0 = &sdhi2;
++ mmc1 = &sdhi0;
++ mmc2 = &sdhi3;
+ };
+
+ chosen {
+diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+index e9ed2597f1c2..61bd4df09df0 100644
+--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+@@ -16,6 +16,7 @@
+ aliases {
+ serial1 = &hscif0;
+ serial2 = &scif1;
++ mmc2 = &sdhi3;
+ };
+
+ clksndsel: clksndsel {
+diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi
+index a04eae55dd6c..3d88e95c65a5 100644
+--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi
+@@ -23,6 +23,8 @@
+ aliases {
+ serial0 = &scif2;
+ ethernet0 = &avb;
++ mmc0 = &sdhi2;
++ mmc1 = &sdhi0;
+ };
+
+ chosen {
+--
+2.30.2
+
--- /dev/null
+From 5d88e5bde50a4f6f5153e8f33eaf41910a9b05e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 18:47:35 +0100
+Subject: arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
+
+[ Upstream commit c8aebc1346522d3569690867ce3996642ad52e01 ]
+
+This fixes the bindings in media framework:
+The CSI40 is endpoint number 2
+The CSI41 is endpoint number 3
+
+Signed-off-by: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20210312174735.2118212-1-niklas.soderlund+renesas@ragnatech.se
+Fixes: 3182aa4e0bf4d0ee ("arm64: dts: renesas: r8a77980: add CSI2/VIN support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77980.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+index ec7ca72399ec..1ffa4a995a7a 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+@@ -992,8 +992,8 @@
+
+ reg = <1>;
+
+- vin4csi41: endpoint@2 {
+- reg = <2>;
++ vin4csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin4>;
+ };
+ };
+@@ -1020,8 +1020,8 @@
+
+ reg = <1>;
+
+- vin5csi41: endpoint@2 {
+- reg = <2>;
++ vin5csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin5>;
+ };
+ };
+@@ -1048,8 +1048,8 @@
+
+ reg = <1>;
+
+- vin6csi41: endpoint@2 {
+- reg = <2>;
++ vin6csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin6>;
+ };
+ };
+@@ -1076,8 +1076,8 @@
+
+ reg = <1>;
+
+- vin7csi41: endpoint@2 {
+- reg = <2>;
++ vin7csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin7>;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 4f6685620dafd98609dd85d6c3d9446029b8aad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 13:19:49 +0900
+Subject: arm64: dts: renesas: r8a779a0: Fix PMU interrupt
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit bbbf6db5a0b56199702bb225132831bced2eee41 ]
+
+Should use PPI No.7 for the PMU. Otherwise, the perf command didn't
+show any information.
+
+Fixes: 834c310f5418 ("arm64: dts: renesas: Add Renesas R8A779A0 SoC support")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20210325041949.925777-1-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+index dfd6ae8b564f..86ac48e2c849 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+@@ -60,10 +60,7 @@
+
+ pmu_a76 {
+ compatible = "arm,cortex-a76-pmu";
+- interrupts-extended = <&gic GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
+- <&gic GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+- <&gic GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+- <&gic GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts-extended = <&gic GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+ };
+
+ /* External SCIF clock - to be overridden by boards that provide it */
+--
+2.30.2
+
--- /dev/null
+From 7500b42e31cf7541df49eec9971aaeabde649831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 11:11:04 +0530
+Subject: arm64: dts: ti: k3-j721e-main: Update the speed modes supported and
+ their itap delay values for MMCSD subsystems
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit eb8f6194e8074d7b00642dd75cf04d13e1b218e4 ]
+
+According to latest errata of J721e [1], HS400 mode is not supported
+in MMCSD0 subsystem (i2024) and SDR104 mode is not supported in MMCSD1/2
+subsystems (i2090). Therefore, replace mmc-hs400-1_8v with mmc-hs200-1_8v
+in MMCSD0 subsystem and add a sdhci mask to disable SDR104 speed mode.
+
+Also, update the itap delay values for all the MMCSD subsystems according
+the latest J721e data sheet[2]
+
+[1] - https://www.ti.com/lit/er/sprz455/sprz455.pdf
+[2] - https://www.ti.com/lit/ds/symlink/tda4vm.pdf
+
+Fixes: cd48ce86a4d0 ("arm64: dts: ti: k3-j721e-common-proc-board: Add support for SD card UHS modes")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
+Link: https://lore.kernel.org/r/20210305054104.10153-1-a-govindraju@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+index 8c84dafb7125..f1e7da3dfa27 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+@@ -1042,13 +1042,16 @@
+ assigned-clocks = <&k3_clks 91 1>;
+ assigned-clock-parents = <&k3_clks 91 2>;
+ bus-width = <8>;
+- mmc-hs400-1_8v;
++ mmc-hs200-1_8v;
+ mmc-ddr-1_8v;
+ ti,otap-del-sel-legacy = <0xf>;
+ ti,otap-del-sel-mmc-hs = <0xf>;
+ ti,otap-del-sel-ddr52 = <0x5>;
+ ti,otap-del-sel-hs200 = <0x6>;
+ ti,otap-del-sel-hs400 = <0x0>;
++ ti,itap-del-sel-legacy = <0x10>;
++ ti,itap-del-sel-mmc-hs = <0xa>;
++ ti,itap-del-sel-ddr52 = <0x3>;
+ ti,trm-icp = <0x8>;
+ ti,strobe-sel = <0x77>;
+ dma-coherent;
+@@ -1069,9 +1072,15 @@
+ ti,otap-del-sel-sdr25 = <0xf>;
+ ti,otap-del-sel-sdr50 = <0xc>;
+ ti,otap-del-sel-ddr50 = <0xc>;
++ ti,itap-del-sel-legacy = <0x0>;
++ ti,itap-del-sel-sd-hs = <0x0>;
++ ti,itap-del-sel-sdr12 = <0x0>;
++ ti,itap-del-sel-sdr25 = <0x0>;
++ ti,itap-del-sel-ddr50 = <0x2>;
+ ti,trm-icp = <0x8>;
+ ti,clkbuf-sel = <0x7>;
+ dma-coherent;
++ sdhci-caps-mask = <0x2 0x0>;
+ };
+
+ main_sdhci2: mmc@4f98000 {
+@@ -1089,9 +1098,15 @@
+ ti,otap-del-sel-sdr25 = <0xf>;
+ ti,otap-del-sel-sdr50 = <0xc>;
+ ti,otap-del-sel-ddr50 = <0xc>;
++ ti,itap-del-sel-legacy = <0x0>;
++ ti,itap-del-sel-sd-hs = <0x0>;
++ ti,itap-del-sel-sdr12 = <0x0>;
++ ti,itap-del-sel-sdr25 = <0x0>;
++ ti,itap-del-sel-ddr50 = <0x2>;
+ ti,trm-icp = <0x8>;
+ ti,clkbuf-sel = <0x7>;
+ dma-coherent;
++ sdhci-caps-mask = <0x2 0x0>;
+ };
+
+ usbss0: cdns-usb@4104000 {
+--
+2.30.2
+
--- /dev/null
+From 59d749bde4eba556c6331f913e18c65cec3db4b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 02:31:49 +0900
+Subject: arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay
+ pins for RTL8211E
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ]
+
+UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have
+the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY
+pins.
+
+After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the delays are working correctly, however, "rgmii" means
+no delay and the phy doesn't work. So need to set the phy-mode to
+"rgmii-id" to show that RX/TX delays are enabled.
+
+Fixes: c73730ee4c9a ("arm64: dts: uniphier: add AVE ethernet node")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +-
+ arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+index a87b8a678719..8f2c1c1e2c64 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+@@ -734,7 +734,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+index 0e52dadf54b3..be97da132258 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+@@ -564,7 +564,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+@@ -585,7 +585,7 @@
+ clocks = <&sys_clk 7>;
+ reset-names = "ether";
+ resets = <&sys_rst 7>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 1>;
+
+--
+2.30.2
+
--- /dev/null
+From 868a5933ae0b00045203d2a5581c3ef33c35cb75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 14:33:43 +0800
+Subject: ASoC: ak5558: correct reset polarity
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ]
+
+Reset (aka power off) happens when the reset gpio is made active.
+The reset gpio is GPIO_ACTIVE_LOW
+
+Fixes: 920884777480 ("ASoC: ak5558: Add support for AK5558 ADC driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1618382024-31725-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak5558.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c
+index 85bdd0534180..80b3b162ca5b 100644
+--- a/sound/soc/codecs/ak5558.c
++++ b/sound/soc/codecs/ak5558.c
+@@ -272,7 +272,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
+ usleep_range(1000, 2000);
+ }
+
+@@ -281,7 +281,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
+ usleep_range(1000, 2000);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1228d1f41ca4479503defac294ad8a9a433534ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 18:56:53 +0000
+Subject: ASoC: Intel: boards: sof-wm8804: add check for PLL setting
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 1730ef62874dbdc53dc2abfa430f09f0b304bafc ]
+
+Currently the return from snd_soc_dai_set_pll is not checking for
+failure, this is the only driver in the kernel that ignores this,
+so it probably should be added for sake of completeness. Fix this
+by adding an error return check.
+
+Addresses-Coverity: ("Unchecked return value")
+Fixes: f139546fb7d4 ("ASoC: Intel: boards: sof-wm8804: support for Hifiberry Digiplus boards")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210226185653.1071321-1-colin.king@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_wm8804.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_wm8804.c b/sound/soc/intel/boards/sof_wm8804.c
+index a46ba13e8eb0..6a181e45143d 100644
+--- a/sound/soc/intel/boards/sof_wm8804.c
++++ b/sound/soc/intel/boards/sof_wm8804.c
+@@ -124,7 +124,11 @@ static int sof_wm8804_hw_params(struct snd_pcm_substream *substream,
+ }
+
+ snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+- snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++ ret = snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
++ if (ret < 0) {
++ dev_err(rtd->card->dev, "Failed to set WM8804 PLL\n");
++ return ret;
++ }
+
+ ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+ sysclk, SND_SOC_CLOCK_OUT);
+--
+2.30.2
+
--- /dev/null
+From 9a540ddf1afcba484b8d7c494fc2f4f0d2830866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 12:54:41 +0100
+Subject: ASoC: Intel: Skylake: Compile when any configuration is selected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 1b99d50b9709a2cddaba4a7faf1862b4f7bec865 ]
+
+Skylake is dependent on SND_SOC_INTEL_SKYLAKE (aka "all SST platforms")
+whereas selecting specific configuration such as KBL-only will not
+cause driver code to compile. Switch to SND_SOC_INTEL_SKYLAKE_COMMON
+dependency so selecting any configuration causes the driver to be built.
+
+Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Suggested-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Fixes: 35bc99aaa1a3 ("ASoC: Intel: Skylake: Add more platform granularity")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20210125115441.10383-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/Makefile | 2 +-
+ sound/soc/intel/skylake/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/Makefile b/sound/soc/intel/Makefile
+index 4e0248d2accc..7c5038803be7 100644
+--- a/sound/soc/intel/Makefile
++++ b/sound/soc/intel/Makefile
+@@ -5,7 +5,7 @@ obj-$(CONFIG_SND_SOC) += common/
+ # Platform Support
+ obj-$(CONFIG_SND_SST_ATOM_HIFI2_PLATFORM) += atom/
+ obj-$(CONFIG_SND_SOC_INTEL_CATPT) += catpt/
+-obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE) += skylake/
++obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE_COMMON) += skylake/
+ obj-$(CONFIG_SND_SOC_INTEL_KEEMBAY) += keembay/
+
+ # Machine support
+diff --git a/sound/soc/intel/skylake/Makefile b/sound/soc/intel/skylake/Makefile
+index dd39149b89b1..1c4649bccec5 100644
+--- a/sound/soc/intel/skylake/Makefile
++++ b/sound/soc/intel/skylake/Makefile
+@@ -7,7 +7,7 @@ ifdef CONFIG_DEBUG_FS
+ snd-soc-skl-objs += skl-debug.o
+ endif
+
+-obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE) += snd-soc-skl.o
++obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE_COMMON) += snd-soc-skl.o
+
+ #Skylake Clock device support
+ snd-soc-skl-ssp-clk-objs := skl-ssp-clk.o
+--
+2.30.2
+
--- /dev/null
+From f5338682471872aab8568fa16f60b386f2ecee2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 12:28:57 +0300
+Subject: ASoC: q6afe-clocks: fix reprobing of the driver
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 96fadf7e8ff49fdb74754801228942b67c3eeebd ]
+
+Q6afe-clocks driver can get reprobed. For example if the APR services
+are restarted after the firmware crash. However currently Q6afe-clocks
+driver will oops because hw.init will get cleared during first _probe
+call. Rewrite the driver to fill the clock data at runtime rather than
+using big static array of clocks.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Fixes: 520a1c396d19 ("ASoC: q6afe-clocks: add q6afe clock controller")
+Link: https://lore.kernel.org/r/20210327092857.3073879-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6afe-clocks.c | 209 ++++++++++++++--------------
+ sound/soc/qcom/qdsp6/q6afe.c | 2 +-
+ sound/soc/qcom/qdsp6/q6afe.h | 2 +-
+ 3 files changed, 108 insertions(+), 105 deletions(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6afe-clocks.c b/sound/soc/qcom/qdsp6/q6afe-clocks.c
+index f0362f061652..9431656283cd 100644
+--- a/sound/soc/qcom/qdsp6/q6afe-clocks.c
++++ b/sound/soc/qcom/qdsp6/q6afe-clocks.c
+@@ -11,33 +11,29 @@
+ #include <linux/slab.h>
+ #include "q6afe.h"
+
+-#define Q6AFE_CLK(id) &(struct q6afe_clk) { \
++#define Q6AFE_CLK(id) { \
+ .clk_id = id, \
+ .afe_clk_id = Q6AFE_##id, \
+ .name = #id, \
+- .attributes = LPASS_CLK_ATTRIBUTE_COUPLE_NO, \
+ .rate = 19200000, \
+- .hw.init = &(struct clk_init_data) { \
+- .ops = &clk_q6afe_ops, \
+- .name = #id, \
+- }, \
+ }
+
+-#define Q6AFE_VOTE_CLK(id, blkid, n) &(struct q6afe_clk) { \
++#define Q6AFE_VOTE_CLK(id, blkid, n) { \
+ .clk_id = id, \
+ .afe_clk_id = blkid, \
+- .name = #n, \
+- .hw.init = &(struct clk_init_data) { \
+- .ops = &clk_vote_q6afe_ops, \
+- .name = #id, \
+- }, \
++ .name = n, \
+ }
+
+-struct q6afe_clk {
+- struct device *dev;
++struct q6afe_clk_init {
+ int clk_id;
+ int afe_clk_id;
+ char *name;
++ int rate;
++};
++
++struct q6afe_clk {
++ struct device *dev;
++ int afe_clk_id;
+ int attributes;
+ int rate;
+ uint32_t handle;
+@@ -48,8 +44,7 @@ struct q6afe_clk {
+
+ struct q6afe_cc {
+ struct device *dev;
+- struct q6afe_clk **clks;
+- int num_clks;
++ struct q6afe_clk *clks[Q6AFE_MAX_CLK_ID];
+ };
+
+ static int clk_q6afe_prepare(struct clk_hw *hw)
+@@ -105,7 +100,7 @@ static int clk_vote_q6afe_block(struct clk_hw *hw)
+ struct q6afe_clk *clk = to_q6afe_clk(hw);
+
+ return q6afe_vote_lpass_core_hw(clk->dev, clk->afe_clk_id,
+- clk->name, &clk->handle);
++ clk_hw_get_name(&clk->hw), &clk->handle);
+ }
+
+ static void clk_unvote_q6afe_block(struct clk_hw *hw)
+@@ -120,84 +115,76 @@ static const struct clk_ops clk_vote_q6afe_ops = {
+ .unprepare = clk_unvote_q6afe_block,
+ };
+
+-static struct q6afe_clk *q6afe_clks[Q6AFE_MAX_CLK_ID] = {
+- [LPASS_CLK_ID_PRI_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_MI2S_IBIT),
+- [LPASS_CLK_ID_PRI_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_MI2S_EBIT),
+- [LPASS_CLK_ID_SEC_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_MI2S_IBIT),
+- [LPASS_CLK_ID_SEC_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_MI2S_EBIT),
+- [LPASS_CLK_ID_TER_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_MI2S_IBIT),
+- [LPASS_CLK_ID_TER_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_MI2S_EBIT),
+- [LPASS_CLK_ID_QUAD_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_MI2S_IBIT),
+- [LPASS_CLK_ID_QUAD_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_MI2S_EBIT),
+- [LPASS_CLK_ID_SPEAKER_I2S_IBIT] =
+- Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_IBIT),
+- [LPASS_CLK_ID_SPEAKER_I2S_EBIT] =
+- Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_EBIT),
+- [LPASS_CLK_ID_SPEAKER_I2S_OSR] =
+- Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_OSR),
+- [LPASS_CLK_ID_QUI_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_IBIT),
+- [LPASS_CLK_ID_QUI_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_EBIT),
+- [LPASS_CLK_ID_SEN_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEN_MI2S_IBIT),
+- [LPASS_CLK_ID_SEN_MI2S_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEN_MI2S_EBIT),
+- [LPASS_CLK_ID_INT0_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT0_MI2S_IBIT),
+- [LPASS_CLK_ID_INT1_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT1_MI2S_IBIT),
+- [LPASS_CLK_ID_INT2_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT2_MI2S_IBIT),
+- [LPASS_CLK_ID_INT3_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT3_MI2S_IBIT),
+- [LPASS_CLK_ID_INT4_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT4_MI2S_IBIT),
+- [LPASS_CLK_ID_INT5_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT5_MI2S_IBIT),
+- [LPASS_CLK_ID_INT6_MI2S_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_INT6_MI2S_IBIT),
+- [LPASS_CLK_ID_QUI_MI2S_OSR] = Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_OSR),
+- [LPASS_CLK_ID_PRI_PCM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_PCM_IBIT),
+- [LPASS_CLK_ID_PRI_PCM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_PCM_EBIT),
+- [LPASS_CLK_ID_SEC_PCM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_PCM_IBIT),
+- [LPASS_CLK_ID_SEC_PCM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_PCM_EBIT),
+- [LPASS_CLK_ID_TER_PCM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_PCM_IBIT),
+- [LPASS_CLK_ID_TER_PCM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_PCM_EBIT),
+- [LPASS_CLK_ID_QUAD_PCM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_PCM_IBIT),
+- [LPASS_CLK_ID_QUAD_PCM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_PCM_EBIT),
+- [LPASS_CLK_ID_QUIN_PCM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUIN_PCM_IBIT),
+- [LPASS_CLK_ID_QUIN_PCM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUIN_PCM_EBIT),
+- [LPASS_CLK_ID_QUI_PCM_OSR] = Q6AFE_CLK(LPASS_CLK_ID_QUI_PCM_OSR),
+- [LPASS_CLK_ID_PRI_TDM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_TDM_IBIT),
+- [LPASS_CLK_ID_PRI_TDM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_PRI_TDM_EBIT),
+- [LPASS_CLK_ID_SEC_TDM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_TDM_IBIT),
+- [LPASS_CLK_ID_SEC_TDM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_SEC_TDM_EBIT),
+- [LPASS_CLK_ID_TER_TDM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_TDM_IBIT),
+- [LPASS_CLK_ID_TER_TDM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_TER_TDM_EBIT),
+- [LPASS_CLK_ID_QUAD_TDM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_TDM_IBIT),
+- [LPASS_CLK_ID_QUAD_TDM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUAD_TDM_EBIT),
+- [LPASS_CLK_ID_QUIN_TDM_IBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_IBIT),
+- [LPASS_CLK_ID_QUIN_TDM_EBIT] = Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_EBIT),
+- [LPASS_CLK_ID_QUIN_TDM_OSR] = Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_OSR),
+- [LPASS_CLK_ID_MCLK_1] = Q6AFE_CLK(LPASS_CLK_ID_MCLK_1),
+- [LPASS_CLK_ID_MCLK_2] = Q6AFE_CLK(LPASS_CLK_ID_MCLK_2),
+- [LPASS_CLK_ID_MCLK_3] = Q6AFE_CLK(LPASS_CLK_ID_MCLK_3),
+- [LPASS_CLK_ID_MCLK_4] = Q6AFE_CLK(LPASS_CLK_ID_MCLK_4),
+- [LPASS_CLK_ID_INTERNAL_DIGITAL_CODEC_CORE] =
+- Q6AFE_CLK(LPASS_CLK_ID_INTERNAL_DIGITAL_CODEC_CORE),
+- [LPASS_CLK_ID_INT_MCLK_0] = Q6AFE_CLK(LPASS_CLK_ID_INT_MCLK_0),
+- [LPASS_CLK_ID_INT_MCLK_1] = Q6AFE_CLK(LPASS_CLK_ID_INT_MCLK_1),
+- [LPASS_CLK_ID_WSA_CORE_MCLK] = Q6AFE_CLK(LPASS_CLK_ID_WSA_CORE_MCLK),
+- [LPASS_CLK_ID_WSA_CORE_NPL_MCLK] =
+- Q6AFE_CLK(LPASS_CLK_ID_WSA_CORE_NPL_MCLK),
+- [LPASS_CLK_ID_VA_CORE_MCLK] = Q6AFE_CLK(LPASS_CLK_ID_VA_CORE_MCLK),
+- [LPASS_CLK_ID_TX_CORE_MCLK] = Q6AFE_CLK(LPASS_CLK_ID_TX_CORE_MCLK),
+- [LPASS_CLK_ID_TX_CORE_NPL_MCLK] =
+- Q6AFE_CLK(LPASS_CLK_ID_TX_CORE_NPL_MCLK),
+- [LPASS_CLK_ID_RX_CORE_MCLK] = Q6AFE_CLK(LPASS_CLK_ID_RX_CORE_MCLK),
+- [LPASS_CLK_ID_RX_CORE_NPL_MCLK] =
+- Q6AFE_CLK(LPASS_CLK_ID_RX_CORE_NPL_MCLK),
+- [LPASS_CLK_ID_VA_CORE_2X_MCLK] =
+- Q6AFE_CLK(LPASS_CLK_ID_VA_CORE_2X_MCLK),
+- [LPASS_HW_AVTIMER_VOTE] = Q6AFE_VOTE_CLK(LPASS_HW_AVTIMER_VOTE,
+- Q6AFE_LPASS_CORE_AVTIMER_BLOCK,
+- "LPASS_AVTIMER_MACRO"),
+- [LPASS_HW_MACRO_VOTE] = Q6AFE_VOTE_CLK(LPASS_HW_MACRO_VOTE,
+- Q6AFE_LPASS_CORE_HW_MACRO_BLOCK,
+- "LPASS_HW_MACRO"),
+- [LPASS_HW_DCODEC_VOTE] = Q6AFE_VOTE_CLK(LPASS_HW_DCODEC_VOTE,
+- Q6AFE_LPASS_CORE_HW_DCODEC_BLOCK,
+- "LPASS_HW_DCODEC"),
++static const struct q6afe_clk_init q6afe_clks[] = {
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SPEAKER_I2S_OSR),
++ Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEN_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEN_MI2S_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT0_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT1_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT2_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT3_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT4_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT5_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_INT6_MI2S_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUI_MI2S_OSR),
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_PCM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_PCM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_PCM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_PCM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_PCM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_PCM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_PCM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_PCM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUIN_PCM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUIN_PCM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUI_PCM_OSR),
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_TDM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_PRI_TDM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_TDM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_SEC_TDM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_TDM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_TER_TDM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_TDM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUAD_TDM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_IBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_EBIT),
++ Q6AFE_CLK(LPASS_CLK_ID_QUIN_TDM_OSR),
++ Q6AFE_CLK(LPASS_CLK_ID_MCLK_1),
++ Q6AFE_CLK(LPASS_CLK_ID_MCLK_2),
++ Q6AFE_CLK(LPASS_CLK_ID_MCLK_3),
++ Q6AFE_CLK(LPASS_CLK_ID_MCLK_4),
++ Q6AFE_CLK(LPASS_CLK_ID_INTERNAL_DIGITAL_CODEC_CORE),
++ Q6AFE_CLK(LPASS_CLK_ID_INT_MCLK_0),
++ Q6AFE_CLK(LPASS_CLK_ID_INT_MCLK_1),
++ Q6AFE_CLK(LPASS_CLK_ID_WSA_CORE_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_WSA_CORE_NPL_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_VA_CORE_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_TX_CORE_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_TX_CORE_NPL_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_RX_CORE_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_RX_CORE_NPL_MCLK),
++ Q6AFE_CLK(LPASS_CLK_ID_VA_CORE_2X_MCLK),
++ Q6AFE_VOTE_CLK(LPASS_HW_AVTIMER_VOTE,
++ Q6AFE_LPASS_CORE_AVTIMER_BLOCK,
++ "LPASS_AVTIMER_MACRO"),
++ Q6AFE_VOTE_CLK(LPASS_HW_MACRO_VOTE,
++ Q6AFE_LPASS_CORE_HW_MACRO_BLOCK,
++ "LPASS_HW_MACRO"),
++ Q6AFE_VOTE_CLK(LPASS_HW_DCODEC_VOTE,
++ Q6AFE_LPASS_CORE_HW_DCODEC_BLOCK,
++ "LPASS_HW_DCODEC"),
+ };
+
+ static struct clk_hw *q6afe_of_clk_hw_get(struct of_phandle_args *clkspec,
+@@ -207,7 +194,7 @@ static struct clk_hw *q6afe_of_clk_hw_get(struct of_phandle_args *clkspec,
+ unsigned int idx = clkspec->args[0];
+ unsigned int attr = clkspec->args[1];
+
+- if (idx >= cc->num_clks || attr > LPASS_CLK_ATTRIBUTE_COUPLE_DIVISOR) {
++ if (idx >= Q6AFE_MAX_CLK_ID || attr > LPASS_CLK_ATTRIBUTE_COUPLE_DIVISOR) {
+ dev_err(cc->dev, "Invalid clk specifier (%d, %d)\n", idx, attr);
+ return ERR_PTR(-EINVAL);
+ }
+@@ -230,20 +217,36 @@ static int q6afe_clock_dev_probe(struct platform_device *pdev)
+ if (!cc)
+ return -ENOMEM;
+
+- cc->clks = &q6afe_clks[0];
+- cc->num_clks = ARRAY_SIZE(q6afe_clks);
++ cc->dev = dev;
+ for (i = 0; i < ARRAY_SIZE(q6afe_clks); i++) {
+- if (!q6afe_clks[i])
+- continue;
++ unsigned int id = q6afe_clks[i].clk_id;
++ struct clk_init_data init = {
++ .name = q6afe_clks[i].name,
++ };
++ struct q6afe_clk *clk;
++
++ clk = devm_kzalloc(dev, sizeof(*clk), GFP_KERNEL);
++ if (!clk)
++ return -ENOMEM;
++
++ clk->dev = dev;
++ clk->afe_clk_id = q6afe_clks[i].afe_clk_id;
++ clk->rate = q6afe_clks[i].rate;
++ clk->hw.init = &init;
++
++ if (clk->rate)
++ init.ops = &clk_q6afe_ops;
++ else
++ init.ops = &clk_vote_q6afe_ops;
+
+- q6afe_clks[i]->dev = dev;
++ cc->clks[id] = clk;
+
+- ret = devm_clk_hw_register(dev, &q6afe_clks[i]->hw);
++ ret = devm_clk_hw_register(dev, &clk->hw);
+ if (ret)
+ return ret;
+ }
+
+- ret = of_clk_add_hw_provider(dev->of_node, q6afe_of_clk_hw_get, cc);
++ ret = devm_of_clk_add_hw_provider(dev, q6afe_of_clk_hw_get, cc);
+ if (ret)
+ return ret;
+
+diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
+index cad1cd1bfdf0..4327b72162ec 100644
+--- a/sound/soc/qcom/qdsp6/q6afe.c
++++ b/sound/soc/qcom/qdsp6/q6afe.c
+@@ -1681,7 +1681,7 @@ int q6afe_unvote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
+ EXPORT_SYMBOL(q6afe_unvote_lpass_core_hw);
+
+ int q6afe_vote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
+- char *client_name, uint32_t *client_handle)
++ const char *client_name, uint32_t *client_handle)
+ {
+ struct q6afe *afe = dev_get_drvdata(dev->parent);
+ struct afe_cmd_remote_lpass_core_hw_vote_request *vote_cfg;
+diff --git a/sound/soc/qcom/qdsp6/q6afe.h b/sound/soc/qcom/qdsp6/q6afe.h
+index 22e10269aa10..3845b56c0ed3 100644
+--- a/sound/soc/qcom/qdsp6/q6afe.h
++++ b/sound/soc/qcom/qdsp6/q6afe.h
+@@ -236,7 +236,7 @@ int q6afe_port_set_sysclk(struct q6afe_port *port, int clk_id,
+ int q6afe_set_lpass_clock(struct device *dev, int clk_id, int clk_src,
+ int clk_root, unsigned int freq);
+ int q6afe_vote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
+- char *client_name, uint32_t *client_handle);
++ const char *client_name, uint32_t *client_handle);
+ int q6afe_unvote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
+ uint32_t client_handle);
+ #endif /* __Q6AFE_H__ */
+--
+2.30.2
+
--- /dev/null
+From 53fea1fb32c3cf34c5ae3061cf5d65393e766009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:20:27 +0200
+Subject: ASoC: simple-card: fix possible uninitialized single_cpu local
+ variable
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit fa74c223b6fd78a5314b4c61b9abdbed3c2185b4 ]
+
+The 'single_cpu' local variable is assigned by asoc_simple_parse_dai()
+and later used in a asoc_simple_canonicalize_cpu() call, assuming the
+entire function did not exit on errors.
+
+However the first function returns 0 if passed device_node is NULL,
+thus leaving the variable uninitialized and reporting success.
+
+Addresses-Coverity: Uninitialized scalar variable
+Fixes: 8f7f298a3337 ("ASoC: simple-card-utils: separate asoc_simple_card_parse_dai()")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20210407092027.60769-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/audio-graph-card.c | 2 +-
+ sound/soc/generic/simple-card.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 8c5cdcdc8713..e81b5cf0d37a 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -380,7 +380,7 @@ static int graph_dai_link_of(struct asoc_simple_priv *priv,
+ struct device_node *top = dev->of_node;
+ struct asoc_simple_dai *cpu_dai;
+ struct asoc_simple_dai *codec_dai;
+- int ret, single_cpu;
++ int ret, single_cpu = 0;
+
+ /* Do it only CPU turn */
+ if (!li->cpu)
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 75365c7bb393..d916ec69c24f 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -258,7 +258,7 @@ static int simple_dai_link_of(struct asoc_simple_priv *priv,
+ struct device_node *plat = NULL;
+ char prop[128];
+ char *prefix = "";
+- int ret, single_cpu;
++ int ret, single_cpu = 0;
+
+ /*
+ * |CPU |Codec : turn
+--
+2.30.2
+
--- /dev/null
+From ce6a8b4f6426fbc23f7fb5ca40582db43f84bc37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Mar 2021 18:44:45 +0300
+Subject: ASoC: tegra30: i2s: Restore hardware state on runtime PM resume
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 0bbcecaaab15a74ba69f93df46c753f2a64eadca ]
+
+Tegra30 I2S driver syncs regmap cache only on resume from system suspend,
+but hardware is reset across the runtime suspend because RPM of the parent
+AHUB driver resets the I2S hardware, hence h/w state is lost after each
+RPM resume. The problem isn't visible because hardware happens to be fully
+reprogrammed after each RPM resume. Move hardware syncing to RPM resume in
+order to restore h/w state properly.
+
+Fixes: ed9ce1ed2239 ("ASoC: tegra: ahub: Reset hardware properly")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210314154459.15375-4-digetx@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/tegra/tegra30_i2s.c | 40 +++++++++++------------------------
+ 1 file changed, 12 insertions(+), 28 deletions(-)
+
+diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
+index 6740df541508..3d22c1be6f3d 100644
+--- a/sound/soc/tegra/tegra30_i2s.c
++++ b/sound/soc/tegra/tegra30_i2s.c
+@@ -58,8 +58,18 @@ static int tegra30_i2s_runtime_resume(struct device *dev)
+ }
+
+ regcache_cache_only(i2s->regmap, false);
++ regcache_mark_dirty(i2s->regmap);
++
++ ret = regcache_sync(i2s->regmap);
++ if (ret)
++ goto disable_clocks;
+
+ return 0;
++
++disable_clocks:
++ clk_disable_unprepare(i2s->clk_i2s);
++
++ return ret;
+ }
+
+ static int tegra30_i2s_set_fmt(struct snd_soc_dai *dai,
+@@ -551,37 +561,11 @@ static int tegra30_i2s_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+-static int tegra30_i2s_suspend(struct device *dev)
+-{
+- struct tegra30_i2s *i2s = dev_get_drvdata(dev);
+-
+- regcache_mark_dirty(i2s->regmap);
+-
+- return 0;
+-}
+-
+-static int tegra30_i2s_resume(struct device *dev)
+-{
+- struct tegra30_i2s *i2s = dev_get_drvdata(dev);
+- int ret;
+-
+- ret = pm_runtime_get_sync(dev);
+- if (ret < 0) {
+- pm_runtime_put(dev);
+- return ret;
+- }
+- ret = regcache_sync(i2s->regmap);
+- pm_runtime_put(dev);
+-
+- return ret;
+-}
+-#endif
+-
+ static const struct dev_pm_ops tegra30_i2s_pm_ops = {
+ SET_RUNTIME_PM_OPS(tegra30_i2s_runtime_suspend,
+ tegra30_i2s_runtime_resume, NULL)
+- SET_SYSTEM_SLEEP_PM_OPS(tegra30_i2s_suspend, tegra30_i2s_resume)
++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
+ };
+
+ static struct platform_driver tegra30_i2s_driver = {
+--
+2.30.2
+
--- /dev/null
+From 01f88e26a0c161e19c17bd8d4272e874c00d9efc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:07:42 +0800
+Subject: ASoC: wm8960: Remove bitclk relax condition in
+ wm8960_configure_sysclk
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 99067c07e8d877035f6249d194a317c78b7d052d ]
+
+The call sequence in wm8960_configure_clocking is
+
+ ret = wm8960_configure_sysclk();
+ if (ret >= 0)
+ goto configure_clock;
+
+ ....
+
+ ret = wm8960_configure_pll();
+
+configure_clock:
+ ...
+
+wm8960_configure_sysclk is called before wm8960_configure_pll, as
+there is bitclk relax on both functions, so wm8960_configure_sysclk
+always return success, then wm8960_configure_pll() never be called.
+
+With this case:
+aplay -Dhw:0,0 -d 5 -r 48000 -f S24_LE -c 2 audio48k24b2c.wav
+the required bitclk is 48000 * 24 * 2 = 2304000, bitclk got from
+wm8960_configure_sysclk is 3072000, but if go to wm8960_configure_pll.
+it can get correct bitclk 2304000.
+
+So bitclk relax condition should be removed in wm8960_configure_sysclk,
+then wm8960_configure_pll can be called, and there is also bitclk relax
+function in wm8960_configure_pll.
+
+Fixes: 3c01b9ee2ab9 ("ASoC: codec: wm8960: Relax bit clock computation")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1614740862-30196-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8960.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index cda9cd935d4f..9e621a254392 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -608,10 +608,6 @@ static const int bclk_divs[] = {
+ * - lrclk = sysclk / dac_divs
+ * - 10 * bclk = sysclk / bclk_divs
+ *
+- * If we cannot find an exact match for (sysclk, lrclk, bclk)
+- * triplet, we relax the bclk such that bclk is chosen as the
+- * closest available frequency greater than expected bclk.
+- *
+ * @wm8960: codec private data
+ * @mclk: MCLK used to derive sysclk
+ * @sysclk_idx: sysclk_divs index for found sysclk
+@@ -629,7 +625,7 @@ int wm8960_configure_sysclk(struct wm8960_priv *wm8960, int mclk,
+ {
+ int sysclk, bclk, lrclk;
+ int i, j, k;
+- int diff, closest = mclk;
++ int diff;
+
+ /* marker for no match */
+ *bclk_idx = -1;
+@@ -653,12 +649,6 @@ int wm8960_configure_sysclk(struct wm8960_priv *wm8960, int mclk,
+ *bclk_idx = k;
+ break;
+ }
+- if (diff > 0 && closest > diff) {
+- *sysclk_idx = i;
+- *dac_idx = j;
+- *bclk_idx = k;
+- closest = diff;
+- }
+ }
+ if (k != ARRAY_SIZE(bclk_divs))
+ break;
+--
+2.30.2
+
--- /dev/null
+From a0a68222fff111fa93fd48f035a7d02eaf2891f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Mar 2021 23:15:06 +0300
+Subject: ata: libahci_platform: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ]
+
+Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0
+early (as if the call was successful). Override IRQ0 with -EINVAL instead
+as the 'libata' regards 0 as "no IRQ" (thus polling) anyway...
+
+Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci_platform.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index de638dafce21..b2f552088291 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -582,11 +582,13 @@ int ahci_platform_init_host(struct platform_device *pdev,
+ int i, irq, n_ports, rc;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ if (irq < 0) {
+ if (irq != -EPROBE_DEFER)
+ dev_err(dev, "no irq\n");
+ return irq;
+ }
++ if (!irq)
++ return -EINVAL;
+
+ hpriv->irq = irq;
+
+--
+2.30.2
+
--- /dev/null
+From ac9adc608c3c607a4f18f17fbf6f8c596a59c8ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 13:19:45 +0300
+Subject: ataflop: fix off by one in ataflop_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b777f4c47781df6b23e3f4df6fdb92d9aceac7bb ]
+
+Smatch complains that the "type > NUM_DISK_MINORS" should be >=
+instead of >. We also need to subtract one from "type" at the start.
+
+Fixes: bf9c0538e485 ("ataflop: use a separate gendisk for each media format")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ataflop.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
+index aed2c2a4f4ea..d601e49f80e0 100644
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -2001,7 +2001,10 @@ static void ataflop_probe(dev_t dev)
+ int drive = MINOR(dev) & 3;
+ int type = MINOR(dev) >> 2;
+
+- if (drive >= FD_MAX_UNITS || type > NUM_DISK_MINORS)
++ if (type)
++ type--;
++
++ if (drive >= FD_MAX_UNITS || type >= NUM_DISK_MINORS)
+ return;
+ mutex_lock(&ataflop_probe_lock);
+ if (!unit[drive].disk[type]) {
+--
+2.30.2
+
--- /dev/null
+From 656bb68b94450aef79442dc524693bafcda910c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 13:18:35 +0300
+Subject: ataflop: potential out of bounds in do_format()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1ffec389a6431782a8a28805830b6fae9bf00af1 ]
+
+The function uses "type" as an array index:
+
+ q = unit[drive].disk[type]->queue;
+
+Unfortunately the bounds check on "type" isn't done until later in the
+function. Fix this by moving the bounds check to the start.
+
+Fixes: bf9c0538e485 ("ataflop: use a separate gendisk for each media format")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ataflop.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
+index 104b713f4055..aed2c2a4f4ea 100644
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -729,8 +729,12 @@ static int do_format(int drive, int type, struct atari_format_descr *desc)
+ unsigned long flags;
+ int ret;
+
+- if (type)
++ if (type) {
+ type--;
++ if (type >= NUM_DISK_MINORS ||
++ minor2disktype[type].drive_types > DriveType)
++ return -EINVAL;
++ }
+
+ q = unit[drive].disk[type]->queue;
+ blk_mq_freeze_queue(q);
+@@ -742,11 +746,6 @@ static int do_format(int drive, int type, struct atari_format_descr *desc)
+ local_irq_restore(flags);
+
+ if (type) {
+- if (type >= NUM_DISK_MINORS ||
+- minor2disktype[type].drive_types > DriveType) {
+- ret = -EINVAL;
+- goto out;
+- }
+ type = minor2disktype[type].index;
+ UDT = &atari_disk_type[type];
+ }
+--
+2.30.2
+
--- /dev/null
+From 4da938850ef57ec79bdf049194b7798b17ab61b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 05:01:54 -0700
+Subject: ath10k: Fix a use after free in ath10k_htc_send_bundle
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 8392df5d7e0b6a7d21440da1fc259f9938f4dec3 ]
+
+In ath10k_htc_send_bundle, the bundle_skb could be freed by
+dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
+by bundle_skb->len.
+
+As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
+skb_len after the bundle_skb was freed.
+
+Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210329120154.8963-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/htc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
+index 0a37be6a7d33..fab398046a3f 100644
+--- a/drivers/net/wireless/ath/ath10k/htc.c
++++ b/drivers/net/wireless/ath/ath10k/htc.c
+@@ -669,7 +669,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,
+
+ ath10k_dbg(ar, ATH10K_DBG_HTC,
+ "bundle tx status %d eid %d req count %d count %d len %d\n",
+- ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len);
++ ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 21dc16de9f71806d319b515fb2cb5565548f7499 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 17:02:28 -0600
+Subject: ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without
+ lock
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ]
+
+ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock
+winthout locking it first when peer reason doesn't match the valid
+cases for this function.
+
+Add a default case to return without unlocking.
+
+Fixes: 09078368d516 ("ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()")
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210406230228.31301-1-skhan@linuxfoundation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index d97b33f789e4..7efbe03fbca8 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -592,6 +592,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
+ GFP_ATOMIC
+ );
+ break;
++ default:
++ kfree(tb);
++ return;
+ }
+
+ exit:
+--
+2.30.2
+
--- /dev/null
+From 12b5679b45cdc3fb3767dfca3d2a672ec2de2132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 19:08:19 +0100
+Subject: ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]
+
+When the error check in ath9k_hw_read_revisions() was added, it checked for
+-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However,
+for plain ath9k, the register read function uses ioread32(), which just
+returns -1 on error. So if such a read fails, it still gets passed through
+and ends up as a weird mac revision in the log output.
+
+Fix this by changing ath9k_regread() to return -1 on error like ioread32()
+does, and fix the error check to look for that instead of -EIO.
+
+Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
+ drivers/net/wireless/ath/ath9k/hw.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index db0c6fa9c9dc..ff61ae34ecdf 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
+ if (unlikely(r)) {
+ ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n",
+ reg_offset, r);
+- return -EIO;
++ return -1;
+ }
+
+ return be32_to_cpu(val);
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 5abc2a5526ec..2ca3b86714a9 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -286,7 +286,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+
+ srev = REG_READ(ah, AR_SREV);
+
+- if (srev == -EIO) {
++ if (srev == -1) {
+ ath_err(ath9k_hw_common(ah),
+ "Failed to read SREV register");
+ return false;
+--
+2.30.2
+
--- /dev/null
+From 83d10e06e99e3ceab40693c20a8f7c8b6ab62817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Apr 2021 21:43:15 +0800
+Subject: bcache: Use 64-bit arithmetic instead of 32-bit
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 62594f189e81caffa6a3bfa2fdb08eec2e347c76 ]
+
+Cast multiple variables to (int64_t) in order to give the compiler
+complete information about the proper arithmetic to use. Notice that
+these variables are being used in contexts that expect expressions of
+type int64_t (64 bit, signed). And currently, such expressions are
+being evaluated using 32-bit arithmetic.
+
+Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support")
+Addresses-Coverity-ID: 1501724 ("Unintentional integer overflow")
+Addresses-Coverity-ID: 1501725 ("Unintentional integer overflow")
+Addresses-Coverity-ID: 1501726 ("Unintentional integer overflow")
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Coly Li <colyli@suse.de>
+Link: https://lore.kernel.org/r/20210411134316.80274-7-colyli@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/writeback.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 82d4e0880a99..4fb635c0baa0 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -110,13 +110,13 @@ static void __update_writeback_rate(struct cached_dev *dc)
+ int64_t fps;
+
+ if (c->gc_stats.in_use <= BCH_WRITEBACK_FRAGMENT_THRESHOLD_MID) {
+- fp_term = dc->writeback_rate_fp_term_low *
++ fp_term = (int64_t)dc->writeback_rate_fp_term_low *
+ (c->gc_stats.in_use - BCH_WRITEBACK_FRAGMENT_THRESHOLD_LOW);
+ } else if (c->gc_stats.in_use <= BCH_WRITEBACK_FRAGMENT_THRESHOLD_HIGH) {
+- fp_term = dc->writeback_rate_fp_term_mid *
++ fp_term = (int64_t)dc->writeback_rate_fp_term_mid *
+ (c->gc_stats.in_use - BCH_WRITEBACK_FRAGMENT_THRESHOLD_MID);
+ } else {
+- fp_term = dc->writeback_rate_fp_term_high *
++ fp_term = (int64_t)dc->writeback_rate_fp_term_high *
+ (c->gc_stats.in_use - BCH_WRITEBACK_FRAGMENT_THRESHOLD_HIGH);
+ }
+ fps = div_s64(dirty, dirty_buckets) * fp_term;
+--
+2.30.2
+
--- /dev/null
+From 19c49105b9431aa695234c748c609b5cbe615fcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 09:37:21 +0200
+Subject: block/rnbd-clt-sysfs: Remove copy buffer overlap in
+ rnbd_clt_get_path_name
+
+From: Dima Stepanov <dmitrii.stepanov@cloud.ionos.com>
+
+[ Upstream commit 3db7cf55d532a15ea26b4a14e8f8729ccd96fd22 ]
+
+cppcheck report the following error:
+ rnbd/rnbd-clt-sysfs.c:522:36: error: The variable 'buf' is used both
+ as a parameter and as destination in snprintf(). The origin and
+ destination buffers overlap. Quote from glibc (C-library)
+ documentation
+ (http://www.gnu.org/software/libc/manual/html_mono/libc.html#Formatted-Output-Functions):
+ "If copying takes place between objects that overlap as a result of a
+ call to sprintf() or snprintf(), the results are undefined."
+ [sprintfOverlappingData]
+Fix it by initializing the buf variable in the first snprintf call.
+
+Fixes: 91f4acb2801c ("block/rnbd-clt: support mapping two devices")
+Signed-off-by: Dima Stepanov <dmitrii.stepanov@ionos.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Link: https://lore.kernel.org/r/20210419073722.15351-19-gi-oh.kim@ionos.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-clt-sysfs.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
+index 526c77cd7a50..49ad400a5225 100644
+--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
++++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
+@@ -483,11 +483,7 @@ static int rnbd_clt_get_path_name(struct rnbd_clt_dev *dev, char *buf,
+ while ((s = strchr(pathname, '/')))
+ s[0] = '!';
+
+- ret = snprintf(buf, len, "%s", pathname);
+- if (ret >= len)
+- return -ENAMETOOLONG;
+-
+- ret = snprintf(buf, len, "%s@%s", buf, dev->sess->sessname);
++ ret = snprintf(buf, len, "%s@%s", pathname, dev->sess->sessname);
+ if (ret >= len)
+ return -ENAMETOOLONG;
+
+--
+2.30.2
+
--- /dev/null
+From 7df9c1835d279cc8949ae59458b0f75a688864be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 15:08:00 +0100
+Subject: Bluetooth: avoid deadlock between hci_dev->lock and socket lock
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+[ Upstream commit 17486960d79b900c45e0bb8fbcac0262848582ba ]
+
+Commit eab2404ba798 ("Bluetooth: Add BT_PHY socket option") added a
+dependency between socket lock and hci_dev->lock that could lead to
+deadlock.
+
+It turns out that hci_conn_get_phy() is not in any way relying on hdev
+being immutable during the runtime of this function, neither does it even
+look at any of the members of hdev, and as such there is no need to hold
+that lock.
+
+This fixes the lockdep splat below:
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 5.12.0-rc1-00026-g73d464503354 #10 Not tainted
+ ------------------------------------------------------
+ bluetoothd/1118 is trying to acquire lock:
+ ffff8f078383c078 (&hdev->lock){+.+.}-{3:3}, at: hci_conn_get_phy+0x1c/0x150 [bluetooth]
+
+ but task is already holding lock:
+ ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #3 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}:
+ lock_sock_nested+0x72/0xa0
+ l2cap_sock_ready_cb+0x18/0x70 [bluetooth]
+ l2cap_config_rsp+0x27a/0x520 [bluetooth]
+ l2cap_sig_channel+0x658/0x1330 [bluetooth]
+ l2cap_recv_frame+0x1ba/0x310 [bluetooth]
+ hci_rx_work+0x1cc/0x640 [bluetooth]
+ process_one_work+0x244/0x5f0
+ worker_thread+0x3c/0x380
+ kthread+0x13e/0x160
+ ret_from_fork+0x22/0x30
+
+ -> #2 (&chan->lock#2/1){+.+.}-{3:3}:
+ __mutex_lock+0xa3/0xa10
+ l2cap_chan_connect+0x33a/0x940 [bluetooth]
+ l2cap_sock_connect+0x141/0x2a0 [bluetooth]
+ __sys_connect+0x9b/0xc0
+ __x64_sys_connect+0x16/0x20
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ -> #1 (&conn->chan_lock){+.+.}-{3:3}:
+ __mutex_lock+0xa3/0xa10
+ l2cap_chan_connect+0x322/0x940 [bluetooth]
+ l2cap_sock_connect+0x141/0x2a0 [bluetooth]
+ __sys_connect+0x9b/0xc0
+ __x64_sys_connect+0x16/0x20
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ -> #0 (&hdev->lock){+.+.}-{3:3}:
+ __lock_acquire+0x147a/0x1a50
+ lock_acquire+0x277/0x3d0
+ __mutex_lock+0xa3/0xa10
+ hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ l2cap_sock_getsockopt+0x5a9/0x610 [bluetooth]
+ __sys_getsockopt+0xcc/0x200
+ __x64_sys_getsockopt+0x20/0x30
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &hdev->lock --> &chan->lock#2/1 --> sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);
+ lock(&chan->lock#2/1);
+ lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);
+ lock(&hdev->lock);
+
+ *** DEADLOCK ***
+
+ 1 lock held by bluetoothd/1118:
+ #0: ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610 [bluetooth]
+
+ stack backtrace:
+ CPU: 3 PID: 1118 Comm: bluetoothd Not tainted 5.12.0-rc1-00026-g73d464503354 #10
+ Hardware name: LENOVO 20K5S22R00/20K5S22R00, BIOS R0IET38W (1.16 ) 05/31/2017
+ Call Trace:
+ dump_stack+0x7f/0xa1
+ check_noncircular+0x105/0x120
+ ? __lock_acquire+0x147a/0x1a50
+ __lock_acquire+0x147a/0x1a50
+ lock_acquire+0x277/0x3d0
+ ? hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ ? __lock_acquire+0x2e1/0x1a50
+ ? lock_is_held_type+0xb4/0x120
+ ? hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ __mutex_lock+0xa3/0xa10
+ ? hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ ? lock_acquire+0x277/0x3d0
+ ? mark_held_locks+0x49/0x70
+ ? mark_held_locks+0x49/0x70
+ ? hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ hci_conn_get_phy+0x1c/0x150 [bluetooth]
+ l2cap_sock_getsockopt+0x5a9/0x610 [bluetooth]
+ __sys_getsockopt+0xcc/0x200
+ __x64_sys_getsockopt+0x20/0x30
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7fb73df33eee
+ Code: 48 8b 0d 85 0f 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 52 0f 0c 00 f7 d8 64 89 01 48
+ RSP: 002b:00007fffcfbbbf08 EFLAGS: 00000203 ORIG_RAX: 0000000000000037
+ RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007fb73df33eee
+ RDX: 000000000000000e RSI: 0000000000000112 RDI: 0000000000000018
+ RBP: 0000000000000000 R08: 00007fffcfbbbf44 R09: 0000000000000000
+ R10: 00007fffcfbbbf3c R11: 0000000000000203 R12: 0000000000000000
+ R13: 0000000000000018 R14: 0000000000000000 R15: 0000556fcefc70d0
+
+Fixes: eab2404ba798 ("Bluetooth: Add BT_PHY socket option")
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 6ffa89e3ba0a..f72646690539 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1830,8 +1830,6 @@ u32 hci_conn_get_phy(struct hci_conn *conn)
+ {
+ u32 phys = 0;
+
+- hci_dev_lock(conn->hdev);
+-
+ /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
+ * Table 6.2: Packets defined for synchronous, asynchronous, and
+ * CSB logical transport types.
+@@ -1928,7 +1926,5 @@ u32 hci_conn_get_phy(struct hci_conn *conn)
+ break;
+ }
+
+- hci_dev_unlock(conn->hdev);
+-
+ return phys;
+ }
+--
+2.30.2
+
--- /dev/null
+From 66aca48930cf68e0b1a13d8aadb9cd5422be7bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 18:13:19 -0400
+Subject: bnxt_en: Fix RX consumer index logic in the error path.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit bbd6f0a948139970f4a615dff189d9a503681a39 ]
+
+In bnxt_rx_pkt(), the RX buffers are expected to complete in order.
+If the RX consumer index indicates an out of order buffer completion,
+it means we are hitting a hardware bug and the driver will abort all
+remaining RX packets and reset the RX ring. The RX consumer index
+that we pass to bnxt_discard_rx() is not correct. We should be
+passing the current index (tmp_raw_cons) instead of the old index
+(raw_cons). This bug can cause us to be at the wrong index when
+trying to abort the next RX packet. It can crash like this:
+
+ #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007
+ #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232
+ #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e
+ #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978
+ #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0
+ #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e
+ #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24
+ #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e
+ #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12
+ #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5
+ [exception RIP: bnxt_rx_pkt+237]
+ RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213
+ RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000
+ RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000
+ RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d
+ R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0
+ R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+
+Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index aeb8c61c0f87..73239d3eaca1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1732,14 +1732,16 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+
+ cons = rxcmp->rx_cmp_opaque;
+ if (unlikely(cons != rxr->rx_next_cons)) {
+- int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
++ int rc1 = bnxt_discard_rx(bp, cpr, &tmp_raw_cons, rxcmp);
+
+ /* 0xffff is forced error, don't print it */
+ if (rxr->rx_next_cons != 0xffff)
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+ cons, rxr->rx_next_cons);
+ bnxt_sched_reset(bp, rxr);
+- return rc1;
++ if (rc1)
++ return rc1;
++ goto next_rx_no_prod_no_len;
+ }
+ rx_buf = &rxr->rx_buf_ring[cons];
+ data = rx_buf->data;
+--
+2.30.2
+
--- /dev/null
+From 8cad75d4244e9689dbc414775a3723917b131438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 12:10:28 +0300
+Subject: bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ]
+
+The problem is that bnxt_show_temp() returns long but "rc" is an int
+and "len" is a u32. With ternary operations the type promotion is quite
+tricky. The negative "rc" is first promoted to u32 and then to long so
+it ends up being a high positive value instead of a a negative as we
+intended.
+
+Fix this by removing the ternary.
+
+Fixes: d69753fa1ecb ("bnxt_en: return proper error codes in bnxt_show_temp")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index b53a0d87371a..aeb8c61c0f87 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -9736,7 +9736,9 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ if (!rc)
+ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+- return rc ?: len;
++ if (rc)
++ return rc;
++ return len;
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+--
+2.30.2
+
--- /dev/null
+From a3391d1073f0dcf5e7bd829a42a734bee32bddb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 13:59:55 +0000
+Subject: bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 10bf4e83167cc68595b85fd73bb91e8f2c086e36 ]
+
+Similarly as b02709587ea3 ("bpf: Fix propagation of 32-bit signed bounds
+from 64-bit bounds."), we also need to fix the propagation of 32 bit
+unsigned bounds from 64 bit counterparts. That is, really only set the
+u32_{min,max}_value when /both/ {umin,umax}_value safely fit in 32 bit
+space. For example, the register with a umin_value == 1 does /not/ imply
+that u32_min_value is also equal to 1, since umax_value could be much
+larger than 32 bit subregister can hold, and thus u32_min_value is in
+the interval [0,1] instead.
+
+Before fix, invalid tracking result of R2_w=inv1:
+
+ [...]
+ 5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
+ 5: (35) if r2 >= 0x1 goto pc+1
+ [...] // goto path
+ 7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
+ 7: (b6) if w2 <= 0x1 goto pc+1
+ [...] // goto path
+ 9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smin_value=-9223372036854775807,smax_value=9223372032559808513,umin_value=1,umax_value=18446744069414584321,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_max_value=1) R10=fp0
+ 9: (bc) w2 = w2
+ 10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv1 R10=fp0
+ [...]
+
+After fix, correct tracking result of R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)):
+
+ [...]
+ 5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
+ 5: (35) if r2 >= 0x1 goto pc+1
+ [...] // goto path
+ 7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
+ 7: (b6) if w2 <= 0x1 goto pc+1
+ [...] // goto path
+ 9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smax_value=9223372032559808513,umax_value=18446744069414584321,var_off=(0x0; 0xffffffff00000001),s32_min_value=0,s32_max_value=1,u32_max_value=1) R10=fp0
+ 9: (bc) w2 = w2
+ 10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) R10=fp0
+ [...]
+
+Thus, same issue as in b02709587ea3 holds for unsigned subregister tracking.
+Also, align __reg64_bound_u32() similarly to __reg64_bound_s32() as done in
+b02709587ea3 to make them uniform again.
+
+Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
+Reported-by: Manfred Paul (@_manfp)
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 8 +++-----
+ tools/testing/selftests/bpf/verifier/array_access.c | 2 +-
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a2ed7a7e27e2..42ec080b0ced 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1362,9 +1362,7 @@ static bool __reg64_bound_s32(s64 a)
+
+ static bool __reg64_bound_u32(u64 a)
+ {
+- if (a > U32_MIN && a < U32_MAX)
+- return true;
+- return false;
++ return a > U32_MIN && a < U32_MAX;
+ }
+
+ static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
+@@ -1375,10 +1373,10 @@ static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
+ reg->s32_min_value = (s32)reg->smin_value;
+ reg->s32_max_value = (s32)reg->smax_value;
+ }
+- if (__reg64_bound_u32(reg->umin_value))
++ if (__reg64_bound_u32(reg->umin_value) && __reg64_bound_u32(reg->umax_value)) {
+ reg->u32_min_value = (u32)reg->umin_value;
+- if (__reg64_bound_u32(reg->umax_value))
+ reg->u32_max_value = (u32)reg->umax_value;
++ }
+
+ /* Intersecting with the old var_off might have improved our bounds
+ * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
+index 1b138cd2b187..1b1c798e9248 100644
+--- a/tools/testing/selftests/bpf/verifier/array_access.c
++++ b/tools/testing/selftests/bpf/verifier/array_access.c
+@@ -186,7 +186,7 @@
+ },
+ .fixup_map_hash_48b = { 3 },
+ .errstr_unpriv = "R0 leaks addr",
+- .errstr = "invalid access to map value, value_size=48 off=44 size=8",
++ .errstr = "R0 unbounded memory access",
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+--
+2.30.2
+
--- /dev/null
+From 0bd2d5fa0e9826be40baf2bb7ef7865f98674571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Mar 2021 13:09:18 -0800
+Subject: bpftool: Fix maybe-uninitialized warnings
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 4bbb3583687051ef99966ddaeb1730441b777d40 ]
+
+Somehow when bpftool is compiled in -Og mode, compiler produces new warnings
+about possibly uninitialized variables. Fix all the reported problems.
+
+Fixes: 2119f2189df1 ("bpftool: add C output format option to btf dump subcommand")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210313210920.1959628-3-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf.c | 3 +++
+ tools/bpf/bpftool/main.c | 3 +--
+ tools/bpf/bpftool/map.c | 2 +-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
+index fe9e7b3a4b50..1326fff3629b 100644
+--- a/tools/bpf/bpftool/btf.c
++++ b/tools/bpf/bpftool/btf.c
+@@ -538,6 +538,7 @@ static int do_dump(int argc, char **argv)
+ NEXT_ARG();
+ if (argc < 1) {
+ p_err("expecting value for 'format' option\n");
++ err = -EINVAL;
+ goto done;
+ }
+ if (strcmp(*argv, "c") == 0) {
+@@ -547,11 +548,13 @@ static int do_dump(int argc, char **argv)
+ } else {
+ p_err("unrecognized format specifier: '%s', possible values: raw, c",
+ *argv);
++ err = -EINVAL;
+ goto done;
+ }
+ NEXT_ARG();
+ } else {
+ p_err("unrecognized option: '%s'", *argv);
++ err = -EINVAL;
+ goto done;
+ }
+ }
+diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
+index b86f450e6fce..d9afb730136a 100644
+--- a/tools/bpf/bpftool/main.c
++++ b/tools/bpf/bpftool/main.c
+@@ -276,7 +276,7 @@ static int do_batch(int argc, char **argv)
+ int n_argc;
+ FILE *fp;
+ char *cp;
+- int err;
++ int err = 0;
+ int i;
+
+ if (argc < 2) {
+@@ -370,7 +370,6 @@ static int do_batch(int argc, char **argv)
+ } else {
+ if (!json_output)
+ printf("processed %d commands\n", lines);
+- err = 0;
+ }
+ err_close:
+ if (fp != stdin)
+diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
+index b400364ee054..09ae0381205b 100644
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -100,7 +100,7 @@ static int do_dump_btf(const struct btf_dumper *d,
+ void *value)
+ {
+ __u32 value_id;
+- int ret;
++ int ret = 0;
+
+ /* start of key-value pair */
+ jsonw_start_object(d->jw);
+--
+2.30.2
+
--- /dev/null
+From f09d1bbfbce6ed644e2b2929fb9b60f0c1ef86d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 15:31:19 +0100
+Subject: btrfs: zoned: bail out in btrfs_alloc_chunk for bad input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bb05b298af8b2330db2b39971bf0029798e7ad59 ]
+
+gcc complains that the ctl->max_chunk_size member might be used
+uninitialized when none of the three conditions for initializing it in
+init_alloc_chunk_ctl_policy_zoned() are true:
+
+In function ‘init_alloc_chunk_ctl_policy_zoned’,
+ inlined from ‘init_alloc_chunk_ctl’ at fs/btrfs/volumes.c:5023:3,
+ inlined from ‘btrfs_alloc_chunk’ at fs/btrfs/volumes.c:5340:2:
+include/linux/compiler-gcc.h:48:45: error: ‘ctl.max_chunk_size’ may be used uninitialized [-Werror=maybe-uninitialized]
+ 4998 | ctl->max_chunk_size = min(limit, ctl->max_chunk_size);
+ | ^~~
+fs/btrfs/volumes.c: In function ‘btrfs_alloc_chunk’:
+fs/btrfs/volumes.c:5316:32: note: ‘ctl’ declared here
+ 5316 | struct alloc_chunk_ctl ctl;
+ | ^~~
+
+If we ever get into this condition, something is seriously
+wrong, as validity is checked in the callers
+
+ btrfs_alloc_chunk
+ init_alloc_chunk_ctl
+ init_alloc_chunk_ctl_policy_zoned
+
+so the same logic as in init_alloc_chunk_ctl_policy_regular()
+and a few other places should be applied. This avoids both further
+data corruption, and the compile-time warning.
+
+Fixes: 1cd6121f2a38 ("btrfs: zoned: implement zoned chunk allocator")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 1c6810bbaf8b..3912eda7905f 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4989,6 +4989,8 @@ static void init_alloc_chunk_ctl_policy_zoned(
+ ctl->max_chunk_size = 2 * ctl->max_stripe_size;
+ ctl->devs_max = min_t(int, ctl->devs_max,
+ BTRFS_MAX_DEVS_SYS_CHUNK);
++ } else {
++ BUG();
+ }
+
+ /* We don't want a chunk larger than 10% of writable space */
+--
+2.30.2
+
--- /dev/null
+From b2031ce1f9f0839a1fe3dd78f7ece2fc0186b86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 23:23:11 +0900
+Subject: btrfs: zoned: move log tree node allocation out of
+ log_root_tree->log_mutex
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+[ Upstream commit e75f9fd194090e69c5ffd856ba89160683d343da ]
+
+Commit 6e37d2459941 ("btrfs: zoned: fix deadlock on log sync") pointed out
+a deadlock warning and removed mutex_{lock,unlock} of fs_info::tree_root->log_mutex.
+While it looks like it always cause a deadlock, we didn't see actual
+deadlock in fstests runs. The reason is log_root_tree->log_mutex !=
+fs_info->tree_root->log_mutex, not taking the same lock. So, the warning
+was actually a false-positive.
+
+Since btrfs_alloc_log_tree_node() is protected only by
+fs_info->tree_root->log_mutex, we can (and should) move the code out of
+the lock scope of log_root_tree->log_mutex and silence the warning.
+
+Fixes: 6e37d2459941 ("btrfs: zoned: fix deadlock on log sync")
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 92a368627791..72c4b66ed516 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3165,20 +3165,22 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ */
+ mutex_unlock(&root->log_mutex);
+
+- btrfs_init_log_ctx(&root_log_ctx, NULL);
+-
+- mutex_lock(&log_root_tree->log_mutex);
+-
+ if (btrfs_is_zoned(fs_info)) {
++ mutex_lock(&fs_info->tree_root->log_mutex);
+ if (!log_root_tree->node) {
+ ret = btrfs_alloc_log_tree_node(trans, log_root_tree);
+ if (ret) {
+- mutex_unlock(&log_root_tree->log_mutex);
++ mutex_unlock(&fs_info->tree_log_mutex);
+ goto out;
+ }
+ }
++ mutex_unlock(&fs_info->tree_root->log_mutex);
+ }
+
++ btrfs_init_log_ctx(&root_log_ctx, NULL);
++
++ mutex_lock(&log_root_tree->log_mutex);
++
+ index2 = log_root_tree->log_transid % 2;
+ list_add_tail(&root_log_ctx.list, &log_root_tree->log_ctxs[index2]);
+ root_log_ctx.log_transid = log_root_tree->log_transid;
+--
+2.30.2
+
--- /dev/null
+From 032447f8231b9af6badb6ec8be3bad13cce59408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 14:33:07 +0000
+Subject: bug: Remove redundant condition check in report_bug
+
+From: Andrew Scull <ascull@google.com>
+
+[ Upstream commit 3ad1a6cb0abc63d036fc866bd7c2c5983516dec5 ]
+
+report_bug() will return early if it cannot find a bug corresponding to
+the provided address. The subsequent test for the bug will always be
+true so remove it.
+
+Fixes: 1b4cfe3c0a30d ("lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()")
+Signed-off-by: Andrew Scull <ascull@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210318143311.839894-2-ascull@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/bug.c | 33 +++++++++++++++------------------
+ 1 file changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/lib/bug.c b/lib/bug.c
+index 8f9d537bfb2a..b92da1f6e21b 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -155,30 +155,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
+
+ file = NULL;
+ line = 0;
+- warning = 0;
+
+- if (bug) {
+ #ifdef CONFIG_DEBUG_BUGVERBOSE
+ #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS
+- file = bug->file;
++ file = bug->file;
+ #else
+- file = (const char *)bug + bug->file_disp;
++ file = (const char *)bug + bug->file_disp;
+ #endif
+- line = bug->line;
++ line = bug->line;
+ #endif
+- warning = (bug->flags & BUGFLAG_WARNING) != 0;
+- once = (bug->flags & BUGFLAG_ONCE) != 0;
+- done = (bug->flags & BUGFLAG_DONE) != 0;
+-
+- if (warning && once) {
+- if (done)
+- return BUG_TRAP_TYPE_WARN;
+-
+- /*
+- * Since this is the only store, concurrency is not an issue.
+- */
+- bug->flags |= BUGFLAG_DONE;
+- }
++ warning = (bug->flags & BUGFLAG_WARNING) != 0;
++ once = (bug->flags & BUGFLAG_ONCE) != 0;
++ done = (bug->flags & BUGFLAG_DONE) != 0;
++
++ if (warning && once) {
++ if (done)
++ return BUG_TRAP_TYPE_WARN;
++
++ /*
++ * Since this is the only store, concurrency is not an issue.
++ */
++ bug->flags |= BUGFLAG_DONE;
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 1522e4cffead7eeef58794a563ebca1156026bcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 03:49:07 -0800
+Subject: bus: qcom: Put child node before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 ]
+
+Put child node before return to fix potential reference count leak.
+Generally, the reference count of child is incremented and decremented
+automatically in the macro for_each_available_child_of_node() and should
+be decremented manually if the loop is broken in loop body.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Fixes: 335a12754808 ("bus: qcom: add EBI2 driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/qcom-ebi2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
+index 03ddcf426887..0b8f53a688b8 100644
+--- a/drivers/bus/qcom-ebi2.c
++++ b/drivers/bus/qcom-ebi2.c
+@@ -353,8 +353,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
+
+ /* Figure out the chipselect */
+ ret = of_property_read_u32(child, "reg", &csindex);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ return ret;
++ }
+
+ if (csindex > 5) {
+ dev_err(dev,
+--
+2.30.2
+
--- /dev/null
+From 57daf6c0612748ffc4dc90f71fc08c649468202d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:35:06 +0200
+Subject: bus: ti-sysc: Fix initializing module_pa for modules without sysc
+ register
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7bad5af826aba00487fed9a3300d3f43f0cba11b ]
+
+We have interconnect target modules with no known registers using only
+clocks and resets, but we still want to detect them based on the module
+IO range. So let's call sysc_parse_and_check_child_range() earlier so we
+have module_pa properly initialized.
+
+Fixes: 2928135c93f8 ("bus: ti-sysc: Support modules without control registers")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 9e535336689f..68145e326eb9 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -901,9 +901,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
+ struct device_node *np = ddata->dev->of_node;
+ int error;
+
+- if (!of_get_property(np, "reg", NULL))
+- return 0;
+-
+ error = sysc_parse_and_check_child_range(ddata);
+ if (error)
+ return error;
+@@ -914,6 +911,9 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
+
+ sysc_check_children(ddata);
+
++ if (!of_get_property(np, "reg", NULL))
++ return 0;
++
+ error = sysc_parse_registers(ddata);
+ if (error)
+ return error;
+--
+2.30.2
+
--- /dev/null
+From fca5972175cecf70e0486169fe53905609d598df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 09:12:01 +0800
+Subject: char: tpm: fix error return code in tpm_cr50_i2c_tis_recv()
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 3d785d73b4c1014839d9f9af0ee526f8d5706a73 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 3a253caaad11 ("char: tpm: add i2c driver for cr50")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index ec9a65e7887d..f19c227d20f4 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -483,6 +483,7 @@ static int tpm_cr50_i2c_tis_recv(struct tpm_chip *chip, u8 *buf, size_t buf_len)
+ expected = be32_to_cpup((__be32 *)(buf + 2));
+ if (expected > buf_len) {
+ dev_err(&chip->dev, "Buffer too small to receive i2c data\n");
++ rc = -E2BIG;
+ goto out_err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4c032d05a9e140a38b2a8ebadfb8a3614828f1d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Mar 2021 06:28:17 -0600
+Subject: clk: imx: Fix reparenting of UARTs not associated with stdout
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 379c9a24cc239000b1dec53db02fe17a86947423 ]
+
+Most if not all i.MX SoC's call a function which enables all UARTS.
+This is a problem for users who need to re-parent the clock source,
+because any attempt to change the parent results in an busy error
+due to the fact that the clocks have been enabled already.
+
+ clk: failed to reparent uart1 to sys_pll1_80m: -16
+
+Instead of pre-initializing all UARTS, scan the device tree to see
+which UART clocks are associated to stdout, and only enable those
+UART clocks if it's needed early. This will move initialization of
+the remaining clocks until after the parenting of the clocks.
+
+When the clocks are shutdown, this mechanism will also disable any
+clocks that were pre-initialized.
+
+Fixes: 9461f7b33d11c ("clk: fix CLK_SET_RATE_GATE with clock rate protection")
+Suggested-by: Aisheng Dong <aisheng.dong@nxp.com>
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx25.c | 12 +---------
+ drivers/clk/imx/clk-imx27.c | 13 +----------
+ drivers/clk/imx/clk-imx35.c | 10 +--------
+ drivers/clk/imx/clk-imx5.c | 30 +++----------------------
+ drivers/clk/imx/clk-imx6q.c | 16 +-------------
+ drivers/clk/imx/clk-imx6sl.c | 16 +-------------
+ drivers/clk/imx/clk-imx6sll.c | 24 +-------------------
+ drivers/clk/imx/clk-imx6sx.c | 16 +-------------
+ drivers/clk/imx/clk-imx7d.c | 22 +------------------
+ drivers/clk/imx/clk-imx7ulp.c | 31 ++------------------------
+ drivers/clk/imx/clk-imx8mm.c | 18 ++-------------
+ drivers/clk/imx/clk-imx8mn.c | 18 ++-------------
+ drivers/clk/imx/clk-imx8mp.c | 17 +--------------
+ drivers/clk/imx/clk-imx8mq.c | 18 ++-------------
+ drivers/clk/imx/clk.c | 41 +++++++++++++++++++++++++++--------
+ drivers/clk/imx/clk.h | 4 ++--
+ 16 files changed, 54 insertions(+), 252 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx25.c b/drivers/clk/imx/clk-imx25.c
+index a66cabfbf94f..66192fe0a898 100644
+--- a/drivers/clk/imx/clk-imx25.c
++++ b/drivers/clk/imx/clk-imx25.c
+@@ -73,16 +73,6 @@ enum mx25_clks {
+
+ static struct clk *clk[clk_max];
+
+-static struct clk ** const uart_clks[] __initconst = {
+- &clk[uart_ipg_per],
+- &clk[uart1_ipg],
+- &clk[uart2_ipg],
+- &clk[uart3_ipg],
+- &clk[uart4_ipg],
+- &clk[uart5_ipg],
+- NULL
+-};
+-
+ static int __init __mx25_clocks_init(void __iomem *ccm_base)
+ {
+ BUG_ON(!ccm_base);
+@@ -228,7 +218,7 @@ static int __init __mx25_clocks_init(void __iomem *ccm_base)
+ */
+ clk_set_parent(clk[cko_sel], clk[ipg]);
+
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(6);
+
+ return 0;
+ }
+diff --git a/drivers/clk/imx/clk-imx27.c b/drivers/clk/imx/clk-imx27.c
+index 5585ded8b8c6..56a5fc402b10 100644
+--- a/drivers/clk/imx/clk-imx27.c
++++ b/drivers/clk/imx/clk-imx27.c
+@@ -49,17 +49,6 @@ static const char *ssi_sel_clks[] = { "spll_gate", "mpll", };
+ static struct clk *clk[IMX27_CLK_MAX];
+ static struct clk_onecell_data clk_data;
+
+-static struct clk ** const uart_clks[] __initconst = {
+- &clk[IMX27_CLK_PER1_GATE],
+- &clk[IMX27_CLK_UART1_IPG_GATE],
+- &clk[IMX27_CLK_UART2_IPG_GATE],
+- &clk[IMX27_CLK_UART3_IPG_GATE],
+- &clk[IMX27_CLK_UART4_IPG_GATE],
+- &clk[IMX27_CLK_UART5_IPG_GATE],
+- &clk[IMX27_CLK_UART6_IPG_GATE],
+- NULL
+-};
+-
+ static void __init _mx27_clocks_init(unsigned long fref)
+ {
+ BUG_ON(!ccm);
+@@ -176,7 +165,7 @@ static void __init _mx27_clocks_init(unsigned long fref)
+
+ clk_prepare_enable(clk[IMX27_CLK_EMI_AHB_GATE]);
+
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(7);
+
+ imx_print_silicon_rev("i.MX27", mx27_revision());
+ }
+diff --git a/drivers/clk/imx/clk-imx35.c b/drivers/clk/imx/clk-imx35.c
+index c1df03665c09..0fe5ac210156 100644
+--- a/drivers/clk/imx/clk-imx35.c
++++ b/drivers/clk/imx/clk-imx35.c
+@@ -82,14 +82,6 @@ enum mx35_clks {
+
+ static struct clk *clk[clk_max];
+
+-static struct clk ** const uart_clks[] __initconst = {
+- &clk[ipg],
+- &clk[uart1_gate],
+- &clk[uart2_gate],
+- &clk[uart3_gate],
+- NULL
+-};
+-
+ static void __init _mx35_clocks_init(void)
+ {
+ void __iomem *base;
+@@ -243,7 +235,7 @@ static void __init _mx35_clocks_init(void)
+ */
+ clk_prepare_enable(clk[scc_gate]);
+
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(4);
+
+ imx_print_silicon_rev("i.MX35", mx35_revision());
+ }
+diff --git a/drivers/clk/imx/clk-imx5.c b/drivers/clk/imx/clk-imx5.c
+index 01e079b81026..e4493846454d 100644
+--- a/drivers/clk/imx/clk-imx5.c
++++ b/drivers/clk/imx/clk-imx5.c
+@@ -128,30 +128,6 @@ static const char *ieee1588_sels[] = { "pll3_sw", "pll4_sw", "dummy" /* usbphy2_
+ static struct clk *clk[IMX5_CLK_END];
+ static struct clk_onecell_data clk_data;
+
+-static struct clk ** const uart_clks_mx51[] __initconst = {
+- &clk[IMX5_CLK_UART1_IPG_GATE],
+- &clk[IMX5_CLK_UART1_PER_GATE],
+- &clk[IMX5_CLK_UART2_IPG_GATE],
+- &clk[IMX5_CLK_UART2_PER_GATE],
+- &clk[IMX5_CLK_UART3_IPG_GATE],
+- &clk[IMX5_CLK_UART3_PER_GATE],
+- NULL
+-};
+-
+-static struct clk ** const uart_clks_mx50_mx53[] __initconst = {
+- &clk[IMX5_CLK_UART1_IPG_GATE],
+- &clk[IMX5_CLK_UART1_PER_GATE],
+- &clk[IMX5_CLK_UART2_IPG_GATE],
+- &clk[IMX5_CLK_UART2_PER_GATE],
+- &clk[IMX5_CLK_UART3_IPG_GATE],
+- &clk[IMX5_CLK_UART3_PER_GATE],
+- &clk[IMX5_CLK_UART4_IPG_GATE],
+- &clk[IMX5_CLK_UART4_PER_GATE],
+- &clk[IMX5_CLK_UART5_IPG_GATE],
+- &clk[IMX5_CLK_UART5_PER_GATE],
+- NULL
+-};
+-
+ static void __init mx5_clocks_common_init(void __iomem *ccm_base)
+ {
+ clk[IMX5_CLK_DUMMY] = imx_clk_fixed("dummy", 0);
+@@ -382,7 +358,7 @@ static void __init mx50_clocks_init(struct device_node *np)
+ r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
+ clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+
+- imx_register_uart_clocks(uart_clks_mx50_mx53);
++ imx_register_uart_clocks(5);
+ }
+ CLK_OF_DECLARE(imx50_ccm, "fsl,imx50-ccm", mx50_clocks_init);
+
+@@ -488,7 +464,7 @@ static void __init mx51_clocks_init(struct device_node *np)
+ val |= 1 << 23;
+ writel(val, MXC_CCM_CLPCR);
+
+- imx_register_uart_clocks(uart_clks_mx51);
++ imx_register_uart_clocks(3);
+ }
+ CLK_OF_DECLARE(imx51_ccm, "fsl,imx51-ccm", mx51_clocks_init);
+
+@@ -633,6 +609,6 @@ static void __init mx53_clocks_init(struct device_node *np)
+ r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
+ clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+
+- imx_register_uart_clocks(uart_clks_mx50_mx53);
++ imx_register_uart_clocks(5);
+ }
+ CLK_OF_DECLARE(imx53_ccm, "fsl,imx53-ccm", mx53_clocks_init);
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index 521d6136d22c..496900de0b0b 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -140,13 +140,6 @@ static inline int clk_on_imx6dl(void)
+ return of_machine_is_compatible("fsl,imx6dl");
+ }
+
+-static const int uart_clk_ids[] __initconst = {
+- IMX6QDL_CLK_UART_IPG,
+- IMX6QDL_CLK_UART_SERIAL,
+-};
+-
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata;
+-
+ static int ldb_di_sel_by_clock_id(int clock_id)
+ {
+ switch (clock_id) {
+@@ -440,7 +433,6 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ struct device_node *np;
+ void __iomem *anatop_base, *base;
+ int ret;
+- int i;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX6QDL_CLK_END), GFP_KERNEL);
+@@ -982,12 +974,6 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ hws[IMX6QDL_CLK_PLL3_USB_OTG]->clk);
+ }
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(1);
+ }
+ CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init);
+diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c
+index 29eab05c9068..277365970320 100644
+--- a/drivers/clk/imx/clk-imx6sl.c
++++ b/drivers/clk/imx/clk-imx6sl.c
+@@ -179,19 +179,11 @@ void imx6sl_set_wait_clk(bool enter)
+ imx6sl_enable_pll_arm(false);
+ }
+
+-static const int uart_clk_ids[] __initconst = {
+- IMX6SL_CLK_UART,
+- IMX6SL_CLK_UART_SERIAL,
+-};
+-
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata;
+-
+ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
+ {
+ struct device_node *np;
+ void __iomem *base;
+ int ret;
+- int i;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX6SL_CLK_END), GFP_KERNEL);
+@@ -448,12 +440,6 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
+ clk_set_parent(hws[IMX6SL_CLK_LCDIF_AXI_SEL]->clk,
+ hws[IMX6SL_CLK_PLL2_PFD2]->clk);
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(2);
+ }
+ CLK_OF_DECLARE(imx6sl, "fsl,imx6sl-ccm", imx6sl_clocks_init);
+diff --git a/drivers/clk/imx/clk-imx6sll.c b/drivers/clk/imx/clk-imx6sll.c
+index 8e8288bda4d0..31d777f30039 100644
+--- a/drivers/clk/imx/clk-imx6sll.c
++++ b/drivers/clk/imx/clk-imx6sll.c
+@@ -76,26 +76,10 @@ static u32 share_count_ssi1;
+ static u32 share_count_ssi2;
+ static u32 share_count_ssi3;
+
+-static const int uart_clk_ids[] __initconst = {
+- IMX6SLL_CLK_UART1_IPG,
+- IMX6SLL_CLK_UART1_SERIAL,
+- IMX6SLL_CLK_UART2_IPG,
+- IMX6SLL_CLK_UART2_SERIAL,
+- IMX6SLL_CLK_UART3_IPG,
+- IMX6SLL_CLK_UART3_SERIAL,
+- IMX6SLL_CLK_UART4_IPG,
+- IMX6SLL_CLK_UART4_SERIAL,
+- IMX6SLL_CLK_UART5_IPG,
+- IMX6SLL_CLK_UART5_SERIAL,
+-};
+-
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata;
+-
+ static void __init imx6sll_clocks_init(struct device_node *ccm_node)
+ {
+ struct device_node *np;
+ void __iomem *base;
+- int i;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX6SLL_CLK_END), GFP_KERNEL);
+@@ -356,13 +340,7 @@ static void __init imx6sll_clocks_init(struct device_node *ccm_node)
+
+ of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(5);
+
+ /* Lower the AHB clock rate before changing the clock source. */
+ clk_set_rate(hws[IMX6SLL_CLK_AHB]->clk, 99000000);
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index 20dcce526d07..fc1bd23d4583 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -117,18 +117,10 @@ static u32 share_count_ssi3;
+ static u32 share_count_sai1;
+ static u32 share_count_sai2;
+
+-static const int uart_clk_ids[] __initconst = {
+- IMX6SX_CLK_UART_IPG,
+- IMX6SX_CLK_UART_SERIAL,
+-};
+-
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata;
+-
+ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ {
+ struct device_node *np;
+ void __iomem *base;
+- int i;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX6SX_CLK_CLK_END), GFP_KERNEL);
+@@ -556,12 +548,6 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ clk_set_parent(hws[IMX6SX_CLK_QSPI1_SEL]->clk, hws[IMX6SX_CLK_PLL2_BUS]->clk);
+ clk_set_parent(hws[IMX6SX_CLK_QSPI2_SEL]->clk, hws[IMX6SX_CLK_PLL2_BUS]->clk);
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(2);
+ }
+ CLK_OF_DECLARE(imx6sx, "fsl,imx6sx-ccm", imx6sx_clocks_init);
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index 22d24a6a05e7..c4e0f1c07192 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -377,23 +377,10 @@ static const char *pll_video_bypass_sel[] = { "pll_video_main", "pll_video_main_
+ static struct clk_hw **hws;
+ static struct clk_hw_onecell_data *clk_hw_data;
+
+-static const int uart_clk_ids[] __initconst = {
+- IMX7D_UART1_ROOT_CLK,
+- IMX7D_UART2_ROOT_CLK,
+- IMX7D_UART3_ROOT_CLK,
+- IMX7D_UART4_ROOT_CLK,
+- IMX7D_UART5_ROOT_CLK,
+- IMX7D_UART6_ROOT_CLK,
+- IMX7D_UART7_ROOT_CLK,
+-};
+-
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata;
+-
+ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ {
+ struct device_node *np;
+ void __iomem *base;
+- int i;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX7D_CLK_END), GFP_KERNEL);
+@@ -897,14 +884,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ hws[IMX7D_USB1_MAIN_480M_CLK] = imx_clk_hw_fixed_factor("pll_usb1_main_clk", "osc", 20, 1);
+ hws[IMX7D_USB_MAIN_480M_CLK] = imx_clk_hw_fixed_factor("pll_usb_main_clk", "osc", 20, 1);
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(7);
+
+ }
+ CLK_OF_DECLARE(imx7d, "fsl,imx7d-ccm", imx7d_clocks_init);
+diff --git a/drivers/clk/imx/clk-imx7ulp.c b/drivers/clk/imx/clk-imx7ulp.c
+index 634c0b6636b0..779e09105da7 100644
+--- a/drivers/clk/imx/clk-imx7ulp.c
++++ b/drivers/clk/imx/clk-imx7ulp.c
+@@ -43,19 +43,6 @@ static const struct clk_div_table ulp_div_table[] = {
+ { /* sentinel */ },
+ };
+
+-static const int pcc2_uart_clk_ids[] __initconst = {
+- IMX7ULP_CLK_LPUART4,
+- IMX7ULP_CLK_LPUART5,
+-};
+-
+-static const int pcc3_uart_clk_ids[] __initconst = {
+- IMX7ULP_CLK_LPUART6,
+- IMX7ULP_CLK_LPUART7,
+-};
+-
+-static struct clk **pcc2_uart_clks[ARRAY_SIZE(pcc2_uart_clk_ids) + 1] __initdata;
+-static struct clk **pcc3_uart_clks[ARRAY_SIZE(pcc3_uart_clk_ids) + 1] __initdata;
+-
+ static void __init imx7ulp_clk_scg1_init(struct device_node *np)
+ {
+ struct clk_hw_onecell_data *clk_data;
+@@ -150,7 +137,6 @@ static void __init imx7ulp_clk_pcc2_init(struct device_node *np)
+ struct clk_hw_onecell_data *clk_data;
+ struct clk_hw **hws;
+ void __iomem *base;
+- int i;
+
+ clk_data = kzalloc(struct_size(clk_data, hws, IMX7ULP_CLK_PCC2_END),
+ GFP_KERNEL);
+@@ -190,13 +176,7 @@ static void __init imx7ulp_clk_pcc2_init(struct device_node *np)
+
+ of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data);
+
+- for (i = 0; i < ARRAY_SIZE(pcc2_uart_clk_ids); i++) {
+- int index = pcc2_uart_clk_ids[i];
+-
+- pcc2_uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(pcc2_uart_clks);
++ imx_register_uart_clocks(2);
+ }
+ CLK_OF_DECLARE(imx7ulp_clk_pcc2, "fsl,imx7ulp-pcc2", imx7ulp_clk_pcc2_init);
+
+@@ -205,7 +185,6 @@ static void __init imx7ulp_clk_pcc3_init(struct device_node *np)
+ struct clk_hw_onecell_data *clk_data;
+ struct clk_hw **hws;
+ void __iomem *base;
+- int i;
+
+ clk_data = kzalloc(struct_size(clk_data, hws, IMX7ULP_CLK_PCC3_END),
+ GFP_KERNEL);
+@@ -244,13 +223,7 @@ static void __init imx7ulp_clk_pcc3_init(struct device_node *np)
+
+ of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data);
+
+- for (i = 0; i < ARRAY_SIZE(pcc3_uart_clk_ids); i++) {
+- int index = pcc3_uart_clk_ids[i];
+-
+- pcc3_uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(pcc3_uart_clks);
++ imx_register_uart_clocks(7);
+ }
+ CLK_OF_DECLARE(imx7ulp_clk_pcc3, "fsl,imx7ulp-pcc3", imx7ulp_clk_pcc3_init);
+
+diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c
+index 6a01eec36dd0..f1919fafb124 100644
+--- a/drivers/clk/imx/clk-imx8mm.c
++++ b/drivers/clk/imx/clk-imx8mm.c
+@@ -296,20 +296,12 @@ static const char * const clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "
+ static struct clk_hw_onecell_data *clk_hw_data;
+ static struct clk_hw **hws;
+
+-static const int uart_clk_ids[] = {
+- IMX8MM_CLK_UART1_ROOT,
+- IMX8MM_CLK_UART2_ROOT,
+- IMX8MM_CLK_UART3_ROOT,
+- IMX8MM_CLK_UART4_ROOT,
+-};
+-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1];
+-
+ static int imx8mm_clocks_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+ void __iomem *base;
+- int ret, i;
++ int ret;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX8MM_CLK_END), GFP_KERNEL);
+@@ -634,13 +626,7 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)
+ goto unregister_hws;
+ }
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_hws[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_hws);
++ imx_register_uart_clocks(4);
+
+ return 0;
+
+diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
+index 324c5fd0aa04..88f6630cd472 100644
+--- a/drivers/clk/imx/clk-imx8mn.c
++++ b/drivers/clk/imx/clk-imx8mn.c
+@@ -289,20 +289,12 @@ static const char * const clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "
+ static struct clk_hw_onecell_data *clk_hw_data;
+ static struct clk_hw **hws;
+
+-static const int uart_clk_ids[] = {
+- IMX8MN_CLK_UART1_ROOT,
+- IMX8MN_CLK_UART2_ROOT,
+- IMX8MN_CLK_UART3_ROOT,
+- IMX8MN_CLK_UART4_ROOT,
+-};
+-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1];
+-
+ static int imx8mn_clocks_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+ void __iomem *base;
+- int ret, i;
++ int ret;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX8MN_CLK_END), GFP_KERNEL);
+@@ -585,13 +577,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
+ goto unregister_hws;
+ }
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_hws[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_hws);
++ imx_register_uart_clocks(4);
+
+ return 0;
+
+diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
+index 2f4e1d674e1c..3e6557e7d559 100644
+--- a/drivers/clk/imx/clk-imx8mp.c
++++ b/drivers/clk/imx/clk-imx8mp.c
+@@ -414,20 +414,11 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r
+ static struct clk_hw **hws;
+ static struct clk_hw_onecell_data *clk_hw_data;
+
+-static const int uart_clk_ids[] = {
+- IMX8MP_CLK_UART1_ROOT,
+- IMX8MP_CLK_UART2_ROOT,
+- IMX8MP_CLK_UART3_ROOT,
+- IMX8MP_CLK_UART4_ROOT,
+-};
+-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1];
+-
+ static int imx8mp_clocks_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np;
+ void __iomem *anatop_base, *ccm_base;
+- int i;
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop");
+ anatop_base = of_iomap(np, 0);
+@@ -737,13 +728,7 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
+
+ of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data);
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_clks[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_clks);
++ imx_register_uart_clocks(4);
+
+ return 0;
+ }
+diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
+index 4dd4ae9d022b..3e1a10d3f55c 100644
+--- a/drivers/clk/imx/clk-imx8mq.c
++++ b/drivers/clk/imx/clk-imx8mq.c
+@@ -281,20 +281,12 @@ static const char * const pllout_monitor_sels[] = {"osc_25m", "osc_27m", "dummy"
+ static struct clk_hw_onecell_data *clk_hw_data;
+ static struct clk_hw **hws;
+
+-static const int uart_clk_ids[] = {
+- IMX8MQ_CLK_UART1_ROOT,
+- IMX8MQ_CLK_UART2_ROOT,
+- IMX8MQ_CLK_UART3_ROOT,
+- IMX8MQ_CLK_UART4_ROOT,
+-};
+-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1];
+-
+ static int imx8mq_clocks_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+ void __iomem *base;
+- int err, i;
++ int err;
+
+ clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
+ IMX8MQ_CLK_END), GFP_KERNEL);
+@@ -629,13 +621,7 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+ goto unregister_hws;
+ }
+
+- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) {
+- int index = uart_clk_ids[i];
+-
+- uart_hws[i] = &hws[index]->clk;
+- }
+-
+- imx_register_uart_clocks(uart_hws);
++ imx_register_uart_clocks(4);
+
+ return 0;
+
+diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
+index 47882c51cb85..7cc669934253 100644
+--- a/drivers/clk/imx/clk.c
++++ b/drivers/clk/imx/clk.c
+@@ -147,8 +147,10 @@ void imx_cscmr1_fixup(u32 *val)
+ }
+
+ #ifndef MODULE
+-static int imx_keep_uart_clocks;
+-static struct clk ** const *imx_uart_clocks;
++
++static bool imx_keep_uart_clocks;
++static int imx_enabled_uart_clocks;
++static struct clk **imx_uart_clocks;
+
+ static int __init imx_keep_uart_clocks_param(char *str)
+ {
+@@ -161,24 +163,45 @@ __setup_param("earlycon", imx_keep_uart_earlycon,
+ __setup_param("earlyprintk", imx_keep_uart_earlyprintk,
+ imx_keep_uart_clocks_param, 0);
+
+-void imx_register_uart_clocks(struct clk ** const clks[])
++void imx_register_uart_clocks(unsigned int clk_count)
+ {
++ imx_enabled_uart_clocks = 0;
++
++/* i.MX boards use device trees now. For build tests without CONFIG_OF, do nothing */
++#ifdef CONFIG_OF
+ if (imx_keep_uart_clocks) {
+ int i;
+
+- imx_uart_clocks = clks;
+- for (i = 0; imx_uart_clocks[i]; i++)
+- clk_prepare_enable(*imx_uart_clocks[i]);
++ imx_uart_clocks = kcalloc(clk_count, sizeof(struct clk *), GFP_KERNEL);
++
++ if (!of_stdout)
++ return;
++
++ for (i = 0; i < clk_count; i++) {
++ imx_uart_clocks[imx_enabled_uart_clocks] = of_clk_get(of_stdout, i);
++
++ /* Stop if there are no more of_stdout references */
++ if (IS_ERR(imx_uart_clocks[imx_enabled_uart_clocks]))
++ return;
++
++ /* Only enable the clock if it's not NULL */
++ if (imx_uart_clocks[imx_enabled_uart_clocks])
++ clk_prepare_enable(imx_uart_clocks[imx_enabled_uart_clocks++]);
++ }
+ }
++#endif
+ }
+
+ static int __init imx_clk_disable_uart(void)
+ {
+- if (imx_keep_uart_clocks && imx_uart_clocks) {
++ if (imx_keep_uart_clocks && imx_enabled_uart_clocks) {
+ int i;
+
+- for (i = 0; imx_uart_clocks[i]; i++)
+- clk_disable_unprepare(*imx_uart_clocks[i]);
++ for (i = 0; i < imx_enabled_uart_clocks; i++) {
++ clk_disable_unprepare(imx_uart_clocks[i]);
++ clk_put(imx_uart_clocks[i]);
++ }
++ kfree(imx_uart_clocks);
+ }
+
+ return 0;
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index 4f04c8287286..7571603bee23 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -11,9 +11,9 @@ extern spinlock_t imx_ccm_lock;
+ void imx_check_clocks(struct clk *clks[], unsigned int count);
+ void imx_check_clk_hws(struct clk_hw *clks[], unsigned int count);
+ #ifndef MODULE
+-void imx_register_uart_clocks(struct clk ** const clks[]);
++void imx_register_uart_clocks(unsigned int clk_count);
+ #else
+-static inline void imx_register_uart_clocks(struct clk ** const clks[])
++static inline void imx_register_uart_clocks(unsigned int clk_count)
+ {
+ }
+ #endif
+--
+2.30.2
+
--- /dev/null
+From 35391362cb11ed04b882a651de10f8649ddb1b2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:18 +0200
+Subject: clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz
+ to 1 GHz
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 4decb9187589f61fe9fc2bc4d9b01160b0a610c5 ]
+
+It was observed that the workaround introduced by commit 61c40f35f5cd
+("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to
+1.2GHz") when base CPU frequency is 1.2 GHz is also required when base
+CPU frequency is 1 GHz. Otherwise switching CPU frequency directly from
+L2 (250 MHz) to L0 (1 GHz) causes a crash.
+
+When base CPU frequency is just 800 MHz no crashed were observed during
+switch from L2 to L0.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index 6507bd2c5f31..b15e177bea7e 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -487,8 +487,10 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ /*
+- * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+- * respectively) to L0 frequency (1.2 Ghz) requires a significant
++ * Workaround when base CPU frequnecy is 1000 or 1200 MHz
++ *
++ * Switching the CPU from the L2 or L3 frequencies (250/300 or 200 MHz
++ * respectively) to L0 frequency (1/1.2 GHz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+@@ -498,15 +500,15 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+- * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
++ * 1. First switch from L2/L3 (200/250/300 MHz) to L1 (500/600 MHz)
+ * 2. Sleep 20ms for stabling VDD voltage
+- * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
++ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz).
+ */
+ static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
+ {
+ unsigned int cur_level;
+
+- if (rate != 1200 * 1000 * 1000)
++ if (rate < 1000 * 1000 * 1000)
+ return;
+
+ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+--
+2.30.2
+
--- /dev/null
+From 78acaadae49d8e65112d9f60e9efe64a7de48986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:19 +0200
+Subject: clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1
+ to L0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit e93033aff684641f71a436ca7a9d2a742126baaf ]
+
+When CPU frequency is at 250 MHz and set_rate() is called with 500 MHz (L1)
+quickly followed by a call with 1 GHz (L0), the CPU does not necessarily
+stay in L1 for at least 20ms as is required by Marvell errata.
+
+This situation happens frequently with the ondemand cpufreq governor and
+can be also reproduced with userspace governor. In most cases it causes CPU
+to crash.
+
+This change fixes the above issue and ensures that the CPU always stays in
+L1 for at least 20ms when switching from any state to L0.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 61c40f35f5cd ("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to 1.2GHz")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 45 ++++++++++++++++++++++----
+ 1 file changed, 39 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index b15e177bea7e..32ac6b6b7530 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -84,6 +84,7 @@ struct clk_pm_cpu {
+ void __iomem *reg_div;
+ u8 shift_div;
+ struct regmap *nb_pm_base;
++ unsigned long l1_expiration;
+ };
+
+ #define to_clk_double_div(_hw) container_of(_hw, struct clk_double_div, hw)
+@@ -504,22 +505,52 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ * 2. Sleep 20ms for stabling VDD voltage
+ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz).
+ */
+-static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
++static void clk_pm_cpu_set_rate_wa(struct clk_pm_cpu *pm_cpu,
++ unsigned int new_level, unsigned long rate,
++ struct regmap *base)
+ {
+ unsigned int cur_level;
+
+- if (rate < 1000 * 1000 * 1000)
+- return;
+-
+ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+ cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+- if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
++
++ if (cur_level == new_level)
++ return;
++
++ /*
++ * System wants to go to L1 on its own. If we are going from L2/L3,
++ * remember when 20ms will expire. If from L0, set the value so that
++ * next switch to L0 won't have to wait.
++ */
++ if (new_level == ARMADA_37XX_DVFS_LOAD_1) {
++ if (cur_level == ARMADA_37XX_DVFS_LOAD_0)
++ pm_cpu->l1_expiration = jiffies;
++ else
++ pm_cpu->l1_expiration = jiffies + msecs_to_jiffies(20);
+ return;
++ }
++
++ /*
++ * If we are setting to L2/L3, just invalidate L1 expiration time,
++ * sleeping is not needed.
++ */
++ if (rate < 1000*1000*1000)
++ goto invalidate_l1_exp;
++
++ /*
++ * We are going to L0 with rate >= 1GHz. Check whether we have been at
++ * L1 for long enough time. If not, go to L1 for 20ms.
++ */
++ if (pm_cpu->l1_expiration && jiffies >= pm_cpu->l1_expiration)
++ goto invalidate_l1_exp;
+
+ regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+ ARMADA_37XX_NB_CPU_LOAD_MASK,
+ ARMADA_37XX_DVFS_LOAD_1);
+ msleep(20);
++
++invalidate_l1_exp:
++ pm_cpu->l1_expiration = 0;
+ }
+
+ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -553,7 +584,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+ reg = ARMADA_37XX_NB_CPU_LOAD;
+ mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+- clk_pm_cpu_set_rate_wa(rate, base);
++ /* Apply workaround when base CPU frequency is 1000 or 1200 MHz */
++ if (parent_rate >= 1000*1000*1000)
++ clk_pm_cpu_set_rate_wa(pm_cpu, load_level, rate, base);
+
+ regmap_update_bits(base, reg, mask, load_level);
+
+--
+2.30.2
+
--- /dev/null
+From ab73f1d7b1657bb5d9db1aabf1b8bd52841b48a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:16 +0200
+Subject: clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM
+ clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 4e435a9dd26c46ac018997cc0562d50b1a96f372 ]
+
+Remove the .set_parent method in clk_pm_cpu_ops.
+
+This method was supposed to be needed by the armada-37xx-cpufreq driver,
+but was never actually called due to wrong assumptions in the cpufreq
+driver. After this was fixed in the cpufreq driver, this method is not
+needed anymore.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Pali Rohár <pali@kernel.org>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 28 --------------------------
+ 1 file changed, 28 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index f5746f9ea929..6507bd2c5f31 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -440,33 +440,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw)
+ return val;
+ }
+
+-static int clk_pm_cpu_set_parent(struct clk_hw *hw, u8 index)
+-{
+- struct clk_pm_cpu *pm_cpu = to_clk_pm_cpu(hw);
+- struct regmap *base = pm_cpu->nb_pm_base;
+- int load_level;
+-
+- /*
+- * We set the clock parent only if the DVFS is available but
+- * not enabled.
+- */
+- if (IS_ERR(base) || armada_3700_pm_dvfs_is_enabled(base))
+- return -EINVAL;
+-
+- /* Set the parent clock for all the load level */
+- for (load_level = 0; load_level < LOAD_LEVEL_NR; load_level++) {
+- unsigned int reg, mask, val,
+- offset = ARMADA_37XX_NB_TBG_SEL_OFF;
+-
+- armada_3700_pm_dvfs_update_regs(load_level, ®, &offset);
+-
+- val = index << offset;
+- mask = ARMADA_37XX_NB_TBG_SEL_MASK << offset;
+- regmap_update_bits(base, reg, mask, val);
+- }
+- return 0;
+-}
+-
+ static unsigned long clk_pm_cpu_recalc_rate(struct clk_hw *hw,
+ unsigned long parent_rate)
+ {
+@@ -592,7 +565,6 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops clk_pm_cpu_ops = {
+ .get_parent = clk_pm_cpu_get_parent,
+- .set_parent = clk_pm_cpu_set_parent,
+ .round_rate = clk_pm_cpu_round_rate,
+ .set_rate = clk_pm_cpu_set_rate,
+ .recalc_rate = clk_pm_cpu_recalc_rate,
+--
+2.30.2
+
--- /dev/null
+From 23818bb3ac2a13ff55b654661dcc46b9c872f4a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 16:23:51 +0800
+Subject: clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
+
+From: Chen Hui <clare.chenhui@huawei.com>
+
+[ Upstream commit 790b516ada10a4dcc0f0a56dc0ced475d86d5820 ]
+
+CONFIG_QCOM_A53PLL is tristate option and therefore this driver can be
+compiled as a module. This patch adds missing MODULE_DEVICE_TABLE
+definition which generates correct modalias for automatic loading of
+this driver when it is built as an external module.
+
+Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support")
+Signed-off-by: Chen Hui <clare.chenhui@huawei.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210409082352.233810-3-clare.chenhui@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/a53-pll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c
+index 45cfc57bff92..af6ac17c7dae 100644
+--- a/drivers/clk/qcom/a53-pll.c
++++ b/drivers/clk/qcom/a53-pll.c
+@@ -93,6 +93,7 @@ static const struct of_device_id qcom_a53pll_match_table[] = {
+ { .compatible = "qcom,msm8916-a53pll" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, qcom_a53pll_match_table);
+
+ static struct platform_driver qcom_a53pll_driver = {
+ .probe = qcom_a53pll_probe,
+--
+2.30.2
+
--- /dev/null
+From 4608c481391abc3b0e9cd030e69f0efdf8c7a8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 16:23:50 +0800
+Subject: clk: qcom: a7-pll: Add missing MODULE_DEVICE_TABLE
+
+From: Chen Hui <clare.chenhui@huawei.com>
+
+[ Upstream commit 77a618b1481f6fdb41b7585ed0f67c47fb8401e5 ]
+
+CONFIG_QCOM_A7PLL is tristate option and therefore this driver can be
+compiled as a module. This patch adds missing MODULE_DEVICE_TABLE
+definition which generates correct modalias for automatic loading of
+this driver when it is built as an external module.
+
+Fixes: 5a5223ffd7ef ("clk: qcom: Add A7 PLL support")
+Signed-off-by: Chen Hui <clare.chenhui@huawei.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210409082352.233810-2-clare.chenhui@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/a7-pll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/a7-pll.c b/drivers/clk/qcom/a7-pll.c
+index e171d3caf2cf..c4a53e5db229 100644
+--- a/drivers/clk/qcom/a7-pll.c
++++ b/drivers/clk/qcom/a7-pll.c
+@@ -86,6 +86,7 @@ static const struct of_device_id qcom_a7pll_match_table[] = {
+ { .compatible = "qcom,sdx55-a7pll" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, qcom_a7pll_match_table);
+
+ static struct platform_driver qcom_a7pll_driver = {
+ .probe = qcom_a7pll_probe,
+--
+2.30.2
+
--- /dev/null
+From 278ba75aa7bef901cdefb071d52d826253335472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 16:23:52 +0800
+Subject: clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE
+
+From: Chen Hui <clare.chenhui@huawei.com>
+
+[ Upstream commit d0a859edda46b45baeab9687d173102300d76e2b ]
+
+CONFIG_IPQ_APSS_PLL is tristate option and therefore this driver can
+be compiled as a module. This patch adds missing MODULE_DEVICE_TABLE
+definition which generates correct modalias for automatic loading of
+this driver when it is built as an external module.
+
+Fixes: ecd2bacfbbc4 ("clk: qcom: Add ipq apss pll driver")
+Signed-off-by: Chen Hui <clare.chenhui@huawei.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210409082352.233810-4-clare.chenhui@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/apss-ipq-pll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/apss-ipq-pll.c b/drivers/clk/qcom/apss-ipq-pll.c
+index 30be87fb222a..bef7899ad0d6 100644
+--- a/drivers/clk/qcom/apss-ipq-pll.c
++++ b/drivers/clk/qcom/apss-ipq-pll.c
+@@ -81,6 +81,7 @@ static const struct of_device_id apss_ipq_pll_match_table[] = {
+ { .compatible = "qcom,ipq6018-a53pll" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, apss_ipq_pll_match_table);
+
+ static struct platform_driver apss_ipq_pll_driver = {
+ .probe = apss_ipq_pll_probe,
+--
+2.30.2
+
--- /dev/null
+From 76c46cf2089b031f510ba2d5c7981ac7a4da1eda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 10:01:03 +0100
+Subject: clk: uniphier: Fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f6b1340dc751a6caa2a0567b667d0f4f4172cd58 ]
+
+The for-loop iterates with a u8 loop counter i and compares this
+with the loop upper limit of num_parents that is an int type.
+There is a potential infinite loop if num_parents is larger than
+the u8 loop counter. Fix this by making the loop counter the same
+type as num_parents. Also make num_parents an unsigned int to
+match the return type of the call to clk_hw_get_num_parents.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Link: https://lore.kernel.org/r/20210409090104.629722-1-colin.king@canonical.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c
+index 462c84321b2d..1998e9d4cfc0 100644
+--- a/drivers/clk/uniphier/clk-uniphier-mux.c
++++ b/drivers/clk/uniphier/clk-uniphier-mux.c
+@@ -31,10 +31,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
+ {
+ struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
+- int num_parents = clk_hw_get_num_parents(hw);
++ unsigned int num_parents = clk_hw_get_num_parents(hw);
+ int ret;
+ unsigned int val;
+- u8 i;
++ unsigned int i;
+
+ ret = regmap_read(mux->regmap, mux->reg, &val);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From a291f1b71a82d0526dc82e6358c7f2030c84bb72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 23:40:15 +0800
+Subject: clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit d7fd3f9f53df8bb2212dff70f66f12cae0e1a653 ]
+
+The round_rate callback should only perform rate calculation and not
+involve calling zynqmp_pll_set_mode to change the pll mode. So let's
+move zynqmp_pll_set_mode out of round_rate and to set_rate callback.
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210406154015.602779-1-quanyang.wang@windriver.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/pll.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c
+index 92f449ed38e5..03bfe62c1e62 100644
+--- a/drivers/clk/zynqmp/pll.c
++++ b/drivers/clk/zynqmp/pll.c
+@@ -100,9 +100,7 @@ static long zynqmp_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+ /* Enable the fractional mode if needed */
+ rate_div = (rate * FRAC_DIV) / *prate;
+ f = rate_div % FRAC_DIV;
+- zynqmp_pll_set_mode(hw, !!f);
+-
+- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) {
++ if (f) {
+ if (rate > PS_PLL_VCO_MAX) {
+ fbdiv = rate / PS_PLL_VCO_MAX;
+ rate = rate / (fbdiv + 1);
+@@ -173,10 +171,12 @@ static int zynqmp_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ long rate_div, frac, m, f;
+ int ret;
+
+- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) {
+- rate_div = (rate * FRAC_DIV) / parent_rate;
++ rate_div = (rate * FRAC_DIV) / parent_rate;
++ f = rate_div % FRAC_DIV;
++ zynqmp_pll_set_mode(hw, !!f);
++
++ if (f) {
+ m = rate_div / FRAC_DIV;
+- f = rate_div % FRAC_DIV;
+ m = clamp_t(u32, m, (PLL_FBDIV_MIN), (PLL_FBDIV_MAX));
+ rate = parent_rate * m;
+ frac = (parent_rate * f) / FRAC_DIV;
+--
+2.30.2
+
--- /dev/null
+From 2707354ae58864a3709362df436a072d0dd96c2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 23:31:31 +0800
+Subject: clk: zynqmp: pll: add set_pll_mode to check condition in
+ zynqmp_pll_enable
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 394cdb69a3c30b33524cf1204afe5cceaba69cdc ]
+
+If there is a IOCTL_SET_PLL_FRAC_MODE request sent to ATF ever,
+we shouldn't skip invoking PM_CLOCK_ENABLE fn even though this
+pll has been enabled. In ATF implementation, it will only assign
+the mode to the variable (struct pm_pll *)pll->mode when handling
+IOCTL_SET_PLL_FRAC_MODE call. Invoking PM_CLOCK_ENABLE can force
+ATF send request to PWU to set the pll mode to PLL's register.
+
+There is a scenario that happens in enabling VPLL_INT(clk_id:96):
+1) VPLL_INT has been enabled during booting.
+2) A driver calls clk_set_rate and according to the rate, the VPLL_INT
+ should be set to FRAC mode. Then zynqmp_pll_set_mode is called
+ to pass IOCTL_SET_PLL_FRAC_MODE to ATF. Note that at this point
+ ATF just stores the mode to a variable.
+3) This driver calls clk_prepare_enable and zynqmp_pll_enable is
+ called to try to enable VPLL_INT pll. Because of 1), the function
+ zynqmp_pll_enable just returns without doing anything after checking
+ that this pll has been enabled.
+
+In the scenario above, the pll mode of VPLL_INT will never be set
+successfully. So adding set_pll_mode to check condition to fix it.
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20210406153131.601701-1-quanyang.wang@windriver.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/pll.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c
+index 03bfe62c1e62..abe6afbf3407 100644
+--- a/drivers/clk/zynqmp/pll.c
++++ b/drivers/clk/zynqmp/pll.c
+@@ -14,10 +14,12 @@
+ * struct zynqmp_pll - PLL clock
+ * @hw: Handle between common and hardware-specific interfaces
+ * @clk_id: PLL clock ID
++ * @set_pll_mode: Whether an IOCTL_SET_PLL_FRAC_MODE request be sent to ATF
+ */
+ struct zynqmp_pll {
+ struct clk_hw hw;
+ u32 clk_id;
++ bool set_pll_mode;
+ };
+
+ #define to_zynqmp_pll(_hw) container_of(_hw, struct zynqmp_pll, hw)
+@@ -81,6 +83,8 @@ static inline void zynqmp_pll_set_mode(struct clk_hw *hw, bool on)
+ if (ret)
+ pr_warn_once("%s() PLL set frac mode failed for %s, ret = %d\n",
+ __func__, clk_name, ret);
++ else
++ clk->set_pll_mode = true;
+ }
+
+ /**
+@@ -240,9 +244,15 @@ static int zynqmp_pll_enable(struct clk_hw *hw)
+ u32 clk_id = clk->clk_id;
+ int ret;
+
+- if (zynqmp_pll_is_enabled(hw))
++ /*
++ * Don't skip enabling clock if there is an IOCTL_SET_PLL_FRAC_MODE request
++ * that has been sent to ATF.
++ */
++ if (zynqmp_pll_is_enabled(hw) && (!clk->set_pll_mode))
+ return 0;
+
++ clk->set_pll_mode = false;
++
+ ret = zynqmp_pm_clock_enable(clk_id);
+ if (ret)
+ pr_warn_once("%s() clock enable failed for %s, ret = %d\n",
+--
+2.30.2
+
--- /dev/null
+From 3eff536d715637ea158939f3343f48cd61227369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 12:30:31 +0000
+Subject: clocksource/drivers/ingenic_ost: Fix return value check in
+ ingenic_ost_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 2a65f7e2772613debd03fa2492e76a635aa04545 ]
+
+In case of error, the function device_node_to_regmap() returns
+ERR_PTR() and never returns NULL. The NULL test in the return
+value check should be replaced with IS_ERR().
+
+Fixes: ca7b72b5a5f2 ("clocksource: Add driver for the Ingenic JZ47xx OST")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210308123031.2285083-1-weiyongjun1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/ingenic-ost.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clocksource/ingenic-ost.c b/drivers/clocksource/ingenic-ost.c
+index 029efc2731b4..6af2470136bd 100644
+--- a/drivers/clocksource/ingenic-ost.c
++++ b/drivers/clocksource/ingenic-ost.c
+@@ -88,9 +88,9 @@ static int __init ingenic_ost_probe(struct platform_device *pdev)
+ return PTR_ERR(ost->regs);
+
+ map = device_node_to_regmap(dev->parent->of_node);
+- if (!map) {
++ if (IS_ERR(map)) {
+ dev_err(dev, "regmap not found");
+- return -EINVAL;
++ return PTR_ERR(map);
+ }
+
+ ost->clk = devm_clk_get(dev, "ost");
+--
+2.30.2
+
--- /dev/null
+From e6990e76861994544f8c128ed568e0faee61234d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 09:21:35 +0200
+Subject: clocksource/drivers/timer-ti-dm: Add missing
+ set_state_oneshot_stopped
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit ac4daf737674b4d29e19b7c300caff3bcf7160d8 ]
+
+To avoid spurious timer interrupts when KTIME_MAX is used, we need to
+configure set_state_oneshot_stopped(). Although implementing this is
+optional, it still affects things like power management for the extra
+timer interrupt.
+
+For more information, please see commit 8fff52fd5093 ("clockevents:
+Introduce CLOCK_EVT_STATE_ONESHOT_STOPPED state") and commit cf8c5009ee37
+("clockevents/drivers/arm_arch_timer: Implement
+->set_state_oneshot_stopped()").
+
+Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210304072135.52712-4-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-ti-dm-systimer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c
+index 422376680c8a..3fae9ebb58b8 100644
+--- a/drivers/clocksource/timer-ti-dm-systimer.c
++++ b/drivers/clocksource/timer-ti-dm-systimer.c
+@@ -554,6 +554,7 @@ static int __init dmtimer_clockevent_init(struct device_node *np)
+ dev->set_state_shutdown = dmtimer_clockevent_shutdown;
+ dev->set_state_periodic = dmtimer_set_periodic;
+ dev->set_state_oneshot = dmtimer_clockevent_shutdown;
++ dev->set_state_oneshot_stopped = dmtimer_clockevent_shutdown;
+ dev->tick_resume = dmtimer_clockevent_shutdown;
+ dev->cpumask = cpu_possible_mask;
+
+--
+2.30.2
+
--- /dev/null
+From 760b28f342f129599e5263c397e8ed8ba4eb4785 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 09:21:33 +0200
+Subject: clocksource/drivers/timer-ti-dm: Fix posted mode status check order
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 212709926c5493a566ca4086ad4f4b0d4e66b553 ]
+
+When the timer is configured in posted mode, we need to check the write-
+posted status register (TWPS) before writing to the register.
+
+We now check TWPS after the write starting with commit 52762fbd1c47
+("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource
+support").
+
+For example, in the TRM for am571x the following is documented in chapter
+"22.2.4.13.1.1 Write Posting Synchronization Mode":
+
+"For each register, a status bit is provided in the timer write-posted
+ status (TWPS) register. In this mode, it is mandatory that software check
+ this status bit before any write access. If a write is attempted to a
+ register with a previous access pending, the previous access is discarded
+ without notice."
+
+The regression happened when I updated the code to use standard read/write
+accessors for the driver instead of using __omap_dm_timer_load_start().
+We have__omap_dm_timer_load_start() check the TWPS status correctly using
+__omap_dm_timer_write().
+
+Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210304072135.52712-2-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-ti-dm-systimer.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c
+index 33b3e8aa2cc5..422376680c8a 100644
+--- a/drivers/clocksource/timer-ti-dm-systimer.c
++++ b/drivers/clocksource/timer-ti-dm-systimer.c
+@@ -449,13 +449,13 @@ static int dmtimer_set_next_event(unsigned long cycles,
+ struct dmtimer_systimer *t = &clkevt->t;
+ void __iomem *pend = t->base + t->pend;
+
+- writel_relaxed(0xffffffff - cycles, t->base + t->counter);
+ while (readl_relaxed(pend) & WP_TCRR)
+ cpu_relax();
++ writel_relaxed(0xffffffff - cycles, t->base + t->counter);
+
+- writel_relaxed(OMAP_TIMER_CTRL_ST, t->base + t->ctrl);
+ while (readl_relaxed(pend) & WP_TCLR)
+ cpu_relax();
++ writel_relaxed(OMAP_TIMER_CTRL_ST, t->base + t->ctrl);
+
+ return 0;
+ }
+@@ -490,18 +490,18 @@ static int dmtimer_set_periodic(struct clock_event_device *evt)
+ dmtimer_clockevent_shutdown(evt);
+
+ /* Looks like we need to first set the load value separately */
+- writel_relaxed(clkevt->period, t->base + t->load);
+ while (readl_relaxed(pend) & WP_TLDR)
+ cpu_relax();
++ writel_relaxed(clkevt->period, t->base + t->load);
+
+- writel_relaxed(clkevt->period, t->base + t->counter);
+ while (readl_relaxed(pend) & WP_TCRR)
+ cpu_relax();
++ writel_relaxed(clkevt->period, t->base + t->counter);
+
+- writel_relaxed(OMAP_TIMER_CTRL_AR | OMAP_TIMER_CTRL_ST,
+- t->base + t->ctrl);
+ while (readl_relaxed(pend) & WP_TCLR)
+ cpu_relax();
++ writel_relaxed(OMAP_TIMER_CTRL_AR | OMAP_TIMER_CTRL_ST,
++ t->base + t->ctrl);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From f466695bf1f95b61b92cb44922ff6eaa51260dcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:21 +0200
+Subject: cpufreq: armada-37xx: Fix determining base CPU frequency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 8bad3bf23cbc40abe1d24cec08a114df6facf858 ]
+
+When current CPU load is not L0 then loading armada-37xx-cpufreq.ko driver
+fails with following error:
+
+ # modprobe armada-37xx-cpufreq
+ [ 502.702097] Unsupported CPU frequency 250 MHz
+
+This issue was partially fixed by commit 8db82563451f ("cpufreq:
+armada-37xx: fix frequency calculation for opp"), but only for calculating
+CPU frequency for opp.
+
+Fix this also for determination of base CPU frequency.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 1ab2113daef5..e4782f562e7a 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -469,7 +469,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ return -EINVAL;
+ }
+
+- dvfs = armada_37xx_cpu_freq_info_get(cur_frequency);
++ dvfs = armada_37xx_cpu_freq_info_get(base_frequency);
+ if (!dvfs) {
+ clk_put(clk);
+ return -EINVAL;
+--
+2.30.2
+
--- /dev/null
+From a44a430fd3926dda1d44691d7c6671b49a40f9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:20 +0200
+Subject: cpufreq: armada-37xx: Fix driver cleanup when registration failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 92963903a8e11b9576eb7249f8e81eefa93b6f96 ]
+
+Commit 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for
+opp") changed calculation of frequency passed to the dev_pm_opp_add()
+function call. But the code for dev_pm_opp_remove() function call was not
+updated, so the driver cleanup phase does not work when registration fails.
+
+This fixes the issue by using the same frequency in both calls.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for opp")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index c7683d447b11..1ab2113daef5 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -521,7 +521,7 @@ disable_dvfs:
+ remove_opp:
+ /* clean-up the already added opp before leaving */
+ while (load_lvl-- > ARMADA_37XX_DVFS_LOAD_0) {
+- freq = cur_frequency / dvfs->divider[load_lvl];
++ freq = base_frequency / dvfs->divider[load_lvl];
+ dev_pm_opp_remove(cpu_dev, freq);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From dd76792699909a7a92fd81b233e890352f5aa413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:15 +0200
+Subject: cpufreq: armada-37xx: Fix setting TBG parent for load levels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 22592df194e31baf371906cc720da38fa0ab68f5 ]
+
+With CPU frequency determining software [1] we have discovered that
+after this driver does one CPU frequency change, the base frequency of
+the CPU is set to the frequency of TBG-A-P clock, instead of the TBG
+that is parent to the CPU.
+
+This can be reproduced on EspressoBIN and Turris MOX:
+ cd /sys/devices/system/cpu/cpufreq/policy0
+ echo powersave >scaling_governor
+ echo performance >scaling_governor
+
+Running the mhz tool before this driver is loaded reports 1000 MHz, and
+after loading the driver and executing commands above the tool reports
+800 MHz.
+
+The change of TBG clock selector is supposed to happen in function
+armada37xx_cpufreq_dvfs_setup. Before the function returns, it does
+this:
+ parent = clk_get_parent(clk);
+ clk_set_parent(clk, parent);
+
+The armada-37xx-periph clock driver has the .set_parent method
+implemented correctly for this, so if the method was actually called,
+this would work. But since the introduction of the common clock
+framework in commit b2476490ef11 ("clk: introduce the common clock..."),
+the clk_set_parent function checks whether the parent is actually
+changing, and if the requested new parent is same as the old parent
+(which is obviously the case for the code above), the .set_parent method
+is not called at all.
+
+This patch fixes this issue by filling the correct TBG clock selector
+directly in the armada37xx_cpufreq_dvfs_setup during the filling of
+other registers at the same address. But the determination of CPU TBG
+index cannot be done via the common clock framework, therefore we need
+to access the North Bridge Peripheral Clock registers directly in this
+driver.
+
+[1] https://github.com/wtarreau/mhz
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Pali Rohár <pali@kernel.org>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 35 ++++++++++++++++++---------
+ 1 file changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index b4af4094309b..b8dc6c849579 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -25,6 +25,10 @@
+
+ #include "cpufreq-dt.h"
+
++/* Clk register set */
++#define ARMADA_37XX_CLK_TBG_SEL 0
++#define ARMADA_37XX_CLK_TBG_SEL_CPU_OFF 22
++
+ /* Power management in North Bridge register set */
+ #define ARMADA_37XX_NB_L0L1 0x18
+ #define ARMADA_37XX_NB_L2L3 0x1C
+@@ -120,10 +124,15 @@ static struct armada_37xx_dvfs *armada_37xx_cpu_freq_info_get(u32 freq)
+ * will be configured then the DVFS will be enabled.
+ */
+ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+- struct clk *clk, u8 *divider)
++ struct regmap *clk_base, u8 *divider)
+ {
++ u32 cpu_tbg_sel;
+ int load_lvl;
+- struct clk *parent;
++
++ /* Determine to which TBG clock is CPU connected */
++ regmap_read(clk_base, ARMADA_37XX_CLK_TBG_SEL, &cpu_tbg_sel);
++ cpu_tbg_sel >>= ARMADA_37XX_CLK_TBG_SEL_CPU_OFF;
++ cpu_tbg_sel &= ARMADA_37XX_NB_TBG_SEL_MASK;
+
+ for (load_lvl = 0; load_lvl < LOAD_LEVEL_NR; load_lvl++) {
+ unsigned int reg, mask, val, offset = 0;
+@@ -142,6 +151,11 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+ mask = (ARMADA_37XX_NB_CLK_SEL_MASK
+ << ARMADA_37XX_NB_CLK_SEL_OFF);
+
++ /* Set TBG index, for all levels we use the same TBG */
++ val = cpu_tbg_sel << ARMADA_37XX_NB_TBG_SEL_OFF;
++ mask = (ARMADA_37XX_NB_TBG_SEL_MASK
++ << ARMADA_37XX_NB_TBG_SEL_OFF);
++
+ /*
+ * Set cpu divider based on the pre-computed array in
+ * order to have balanced step.
+@@ -160,14 +174,6 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+
+ regmap_update_bits(base, reg, mask, val);
+ }
+-
+- /*
+- * Set cpu clock source, for all the level we keep the same
+- * clock source that the one already configured. For this one
+- * we need to use the clock framework
+- */
+- parent = clk_get_parent(clk);
+- clk_set_parent(clk, parent);
+ }
+
+ /*
+@@ -358,11 +364,16 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ struct platform_device *pdev;
+ unsigned long freq;
+ unsigned int cur_frequency, base_frequency;
+- struct regmap *nb_pm_base, *avs_base;
++ struct regmap *nb_clk_base, *nb_pm_base, *avs_base;
+ struct device *cpu_dev;
+ int load_lvl, ret;
+ struct clk *clk, *parent;
+
++ nb_clk_base =
++ syscon_regmap_lookup_by_compatible("marvell,armada-3700-periph-clock-nb");
++ if (IS_ERR(nb_clk_base))
++ return -ENODEV;
++
+ nb_pm_base =
+ syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm");
+
+@@ -439,7 +450,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ armada37xx_cpufreq_avs_configure(avs_base, dvfs);
+ armada37xx_cpufreq_avs_setup(avs_base, dvfs);
+
+- armada37xx_cpufreq_dvfs_setup(nb_pm_base, clk, dvfs->divider);
++ armada37xx_cpufreq_dvfs_setup(nb_pm_base, nb_clk_base, dvfs->divider);
+ clk_put(clk);
+
+ for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR;
+--
+2.30.2
+
--- /dev/null
+From 70490e4110c3326df99a72e17001b3d33b29329f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:17 +0200
+Subject: cpufreq: armada-37xx: Fix the AVS value for load L1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit d118ac2062b5b8331c8768ac81e016617e0996ee ]
+
+The original CPU voltage value for load L1 is too low for Armada 37xx SoC
+when base CPU frequency is 1000 or 1200 MHz. It leads to instabilities
+where CPU gets stuck soon after dynamic voltage scaling from load L1 to L0.
+
+Update the CPU voltage value for load L1 accordingly when base frequency is
+1000 or 1200 MHz. The minimal L1 value for base CPU frequency 1000 MHz is
+updated from the original 1.05V to 1.108V and for 1200 MHz is updated to
+1.155V. This minimal L1 value is used only in the case when it is lower
+than value for L0.
+
+This change fixes CPU instability issues on 1 GHz and 1.2 GHz variants of
+Espressobin and 1 GHz Turris Mox.
+
+Marvell previously for 1 GHz variant of Espressobin provided a patch [1]
+suitable only for their Marvell Linux kernel 4.4 fork which workarounded
+this issue. Patch forced CPU voltage value to 1.108V in all loads. But
+such change does not fix CPU instability issues on 1.2 GHz variants of
+Armada 3720 SoC.
+
+During testing we come to the conclusion that using 1.108V as minimal
+value for L1 load makes 1 GHz variants of Espressobin and Turris Mox boards
+stable. And similarly 1.155V for 1.2 GHz variant of Espressobin.
+
+These two values 1.108V and 1.155V are documented in Armada 3700 Hardware
+Specifications as typical initial CPU voltage values.
+
+Discussion about this issue is also at the Armbian forum [2].
+
+[1] - https://github.com/MarvellEmbeddedProcessors/linux-marvell/commit/dc33b62c90696afb6adc7dbcc4ebbd48bedec269
+[2] - https://forum.armbian.com/topic/10429-how-to-make-espressobin-v7-stable/
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 1c3528232f4b ("cpufreq: armada-37xx: Add AVS support")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 37 +++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index b8dc6c849579..c7683d447b11 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -73,6 +73,8 @@
+ #define LOAD_LEVEL_NR 4
+
+ #define MIN_VOLT_MV 1000
++#define MIN_VOLT_MV_FOR_L1_1000MHZ 1108
++#define MIN_VOLT_MV_FOR_L1_1200MHZ 1155
+
+ /* AVS value for the corresponding voltage (in mV) */
+ static int avs_map[] = {
+@@ -208,6 +210,8 @@ static u32 armada_37xx_avs_val_match(int target_vm)
+ * - L2 & L3 voltage should be about 150mv smaller than L0 voltage.
+ * This function calculates L1 & L2 & L3 AVS values dynamically based
+ * on L0 voltage and fill all AVS values to the AVS value table.
++ * When base CPU frequency is 1000 or 1200 MHz then there is additional
++ * minimal avs value for load L1.
+ */
+ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ struct armada_37xx_dvfs *dvfs)
+@@ -239,6 +243,19 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ for (load_level = 1; load_level < LOAD_LEVEL_NR; load_level++)
+ dvfs->avs[load_level] = avs_min;
+
++ /*
++ * Set the avs values for load L0 and L1 when base CPU frequency
++ * is 1000/1200 MHz to its typical initial values according to
++ * the Armada 3700 Hardware Specifications.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++ dvfs->avs[0] = dvfs->avs[1] = avs_min;
++ }
++
+ return;
+ }
+
+@@ -258,6 +275,26 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ target_vm = avs_map[l0_vdd_min] - 150;
+ target_vm = target_vm > MIN_VOLT_MV ? target_vm : MIN_VOLT_MV;
+ dvfs->avs[2] = dvfs->avs[3] = armada_37xx_avs_val_match(target_vm);
++
++ /*
++ * Fix the avs value for load L1 when base CPU frequency is 1000/1200 MHz,
++ * otherwise the CPU gets stuck when switching from load L1 to load L0.
++ * Also ensure that avs value for load L1 is not higher than for L0.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ u32 avs_min_l1;
++
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++
++ if (avs_min_l1 > dvfs->avs[0])
++ avs_min_l1 = dvfs->avs[0];
++
++ if (dvfs->avs[1] < avs_min_l1)
++ dvfs->avs[1] = avs_min_l1;
++ }
+ }
+
+ static void __init armada37xx_cpufreq_avs_setup(struct regmap *base,
+--
+2.30.2
+
--- /dev/null
+From 6752788426aaf0bc63b5937a5064a662003ced6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 08:33:28 -0400
+Subject: cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration
+
+From: He Ying <heying24@huawei.com>
+
+[ Upstream commit 498ba2a8a2756694b6f3888857426dbc8a5e6b6c ]
+
+When CONFIG_ARM_QCOM_SPM_CPUIDLE is y and CONFIG_MMU is not set,
+compiling errors are encountered as follows:
+
+drivers/cpuidle/cpuidle-qcom-spm.o: In function `spm_dev_probe':
+cpuidle-qcom-spm.c:(.text+0x140): undefined reference to `cpu_resume_arm'
+cpuidle-qcom-spm.c:(.text+0x148): undefined reference to `cpu_resume_arm'
+
+Note that cpu_resume_arm is defined when MMU is set. So, add dependency
+on MMU in ARM_QCOM_SPM_CPUIDLE configuration.
+
+Fixes: a871be6b8eee ("cpuidle: Convert Qualcomm SPM driver to a generic CPUidle driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: He Ying <heying24@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210406123328.92904-1-heying24@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/Kconfig.arm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/Kconfig.arm b/drivers/cpuidle/Kconfig.arm
+index 0844fadc4be8..334f83e56120 100644
+--- a/drivers/cpuidle/Kconfig.arm
++++ b/drivers/cpuidle/Kconfig.arm
+@@ -107,7 +107,7 @@ config ARM_TEGRA_CPUIDLE
+
+ config ARM_QCOM_SPM_CPUIDLE
+ bool "CPU Idle Driver for Qualcomm Subsystem Power Manager (SPM)"
+- depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64
++ depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64 && MMU
+ select ARM_CPU_SUSPEND
+ select CPU_IDLE_MULTIPLE_DRIVERS
+ select DT_IDLE_STATES
+--
+2.30.2
+
--- /dev/null
+From b8d10635d7e3d60bd81ca91f5db49e5d283251a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 22:12:00 +0200
+Subject: crypto: allwinner - add missing CRYPTO_ prefix
+
+From: Corentin Labbe <clabbe.montjoie@gmail.com>
+
+[ Upstream commit ac1af1a788b2002eb9d6f5ca6054517ad27f1930 ]
+
+Some CONFIG select miss CRYPTO_.
+
+Reported-by: Chen-Yu Tsai <wens@csie.org>
+Fixes: 56f6d5aee88d1 ("crypto: sun8i-ce - support hash algorithms")
+Fixes: d9b45418a9177 ("crypto: sun8i-ss - support hash algorithms")
+Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/Kconfig | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/Kconfig b/drivers/crypto/allwinner/Kconfig
+index 856fb2045656..b8e75210a0e3 100644
+--- a/drivers/crypto/allwinner/Kconfig
++++ b/drivers/crypto/allwinner/Kconfig
+@@ -71,10 +71,10 @@ config CRYPTO_DEV_SUN8I_CE_DEBUG
+ config CRYPTO_DEV_SUN8I_CE_HASH
+ bool "Enable support for hash on sun8i-ce"
+ depends on CRYPTO_DEV_SUN8I_CE
+- select MD5
+- select SHA1
+- select SHA256
+- select SHA512
++ select CRYPTO_MD5
++ select CRYPTO_SHA1
++ select CRYPTO_SHA256
++ select CRYPTO_SHA512
+ help
+ Say y to enable support for hash algorithms.
+
+@@ -132,8 +132,8 @@ config CRYPTO_DEV_SUN8I_SS_PRNG
+ config CRYPTO_DEV_SUN8I_SS_HASH
+ bool "Enable support for hash on sun8i-ss"
+ depends on CRYPTO_DEV_SUN8I_SS
+- select MD5
+- select SHA1
+- select SHA256
++ select CRYPTO_MD5
++ select CRYPTO_SHA1
++ select CRYPTO_SHA256
+ help
+ Say y to enable support for hash algorithms.
+--
+2.30.2
+
--- /dev/null
+From 713886241af06e11d4fdf63448833486fe275878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 23:27:26 -0800
+Subject: crypto: arm/blake2s - fix for big endian
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit d2f2516a3882c0c6463e33c9b112b39bd483f821 ]
+
+The new ARM BLAKE2s code doesn't work correctly (fails the self-tests)
+in big endian kernel builds because it doesn't swap the endianness of
+the message words when loading them. Fix this.
+
+Fixes: 5172d322d34c ("crypto: arm/blake2s - add ARM scalar optimized BLAKE2s")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/blake2s-core.S | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/arm/crypto/blake2s-core.S b/arch/arm/crypto/blake2s-core.S
+index bed897e9a181..86345751bbf3 100644
+--- a/arch/arm/crypto/blake2s-core.S
++++ b/arch/arm/crypto/blake2s-core.S
+@@ -8,6 +8,7 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+
+ // Registers used to hold message words temporarily. There aren't
+ // enough ARM registers to hold the whole message block, so we have to
+@@ -38,6 +39,23 @@
+ #endif
+ .endm
+
++.macro _le32_bswap a, tmp
++#ifdef __ARMEB__
++ rev_l \a, \tmp
++#endif
++.endm
++
++.macro _le32_bswap_8x a, b, c, d, e, f, g, h, tmp
++ _le32_bswap \a, \tmp
++ _le32_bswap \b, \tmp
++ _le32_bswap \c, \tmp
++ _le32_bswap \d, \tmp
++ _le32_bswap \e, \tmp
++ _le32_bswap \f, \tmp
++ _le32_bswap \g, \tmp
++ _le32_bswap \h, \tmp
++.endm
++
+ // Execute a quarter-round of BLAKE2s by mixing two columns or two diagonals.
+ // (a0, b0, c0, d0) and (a1, b1, c1, d1) give the registers containing the two
+ // columns/diagonals. s0-s1 are the word offsets to the message words the first
+@@ -180,8 +198,10 @@ ENTRY(blake2s_compress_arch)
+ tst r1, #3
+ bne .Lcopy_block_misaligned
+ ldmia r1!, {r2-r9}
++ _le32_bswap_8x r2, r3, r4, r5, r6, r7, r8, r9, r14
+ stmia r12!, {r2-r9}
+ ldmia r1!, {r2-r9}
++ _le32_bswap_8x r2, r3, r4, r5, r6, r7, r8, r9, r14
+ stmia r12, {r2-r9}
+ .Lcopy_block_done:
+ str r1, [sp, #68] // Update message pointer
+@@ -268,6 +288,7 @@ ENTRY(blake2s_compress_arch)
+ 1:
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ ldr r3, [r1], #4
++ _le32_bswap r3, r4
+ #else
+ ldrb r3, [r1, #0]
+ ldrb r4, [r1, #1]
+--
+2.30.2
+
--- /dev/null
+From e8823544da148173bd89bcffbeb8cf66fc0e335a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 16:25:23 +0200
+Subject: crypto: arm64/aes-ce - deal with oversight in new CTR carry code
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 0f19dbc994dcb7f7137f2e056e813c84530b7538 ]
+
+The new carry handling code in the CTR driver can deal with a carry
+occurring in the 4x/5x parallel code path, by using a computed goto to
+jump into the carry sequence at the right place as to only apply the
+carry to a subset of the blocks being processed.
+
+If the lower half of the counter wraps and ends up at exactly 0x0, a
+carry needs to be applied to the counter, but not to the counter values
+taken for the 4x/5x parallel sequence. In this case, the computed goto
+skips all register assignments, and branches straight to the jump
+instruction that gets us back to the fast path. This produces the
+correct result, but due to the fact that this branch target does not
+carry the correct BTI annotation, this fails when BTI is enabled.
+
+Let's omit the computed goto entirely in this case, and jump straight
+back to the fast path after applying the carry to the main counter.
+
+Fixes: 5318d3db465d ("crypto: arm64/aes-ctr - improve tail handling")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/crypto/aes-modes.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
+index bbdb54702aa7..247011356d11 100644
+--- a/arch/arm64/crypto/aes-modes.S
++++ b/arch/arm64/crypto/aes-modes.S
+@@ -359,6 +359,7 @@ ST5( mov v4.16b, vctr.16b )
+ ins vctr.d[0], x8
+
+ /* apply carry to N counter blocks for N := x12 */
++ cbz x12, 2f
+ adr x16, 1f
+ sub x16, x16, x12, lsl #3
+ br x16
+--
+2.30.2
+
--- /dev/null
+From 74ab93ed61a53a9886e196b763783681fe964c6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 15:49:46 -0700
+Subject: crypto: ccp: Detect and reject "invalid" addresses destined for PSP
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 74c1f1366eb7714b8b211554f6c5cee315ff3fbc ]
+
+Explicitly reject using pointers that are not virt_to_phys() friendly
+as the source for SEV commands that are sent to the PSP. The PSP works
+with physical addresses, and __pa()/virt_to_phys() will not return the
+correct address in these cases, e.g. for a vmalloc'd pointer. At best,
+the bogus address will cause the command to fail, and at worst lead to
+system instability.
+
+While it's unlikely that callers will deliberately use a bad pointer for
+SEV buffers, a caller can easily use a vmalloc'd pointer unknowingly when
+running with CONFIG_VMAP_STACK=y as it's not obvious that putting the
+command buffers on the stack would be bad. The command buffers are
+relative small and easily fit on the stack, and the APIs to do not
+document that the incoming pointer must be a physically contiguous,
+__pa() friendly pointer.
+
+Cc: Brijesh Singh <brijesh.singh@amd.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Fixes: 200664d5237f ("crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210406224952.4177376-3-seanjc@google.com>
+Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index cb9b4c4e371e..8fd43c1acac1 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -150,6 +150,9 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
+
+ sev = psp->sev_data;
+
++ if (data && WARN_ON_ONCE(!virt_addr_valid(data)))
++ return -EINVAL;
++
+ /* Get the physical address of the command buffer */
+ phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0;
+ phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0;
+--
+2.30.2
+
--- /dev/null
+From b88d4cee5f43558a9c5a16c90919ebbe2f13430b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Mar 2021 13:55:29 +0530
+Subject: crypto: ccp - fix command queuing to TEE ring buffer
+
+From: Rijo Thomas <Rijo-john.Thomas@amd.com>
+
+[ Upstream commit 00aa6e65aa04e500a11a2c91e92a11c37b9e234d ]
+
+Multiple threads or clients can submit a command to the TEE ring
+buffer. This patch helps to synchronize command submission to the
+ring.
+
+One thread shall write a command to a TEE ring buffer entry only if:
+
+ - Trusted OS has notified that the TEE command for the given entry
+ has been processed and driver has copied the TEE response into
+ client buffer.
+
+ - The command entry is empty and can be written into.
+
+After a command has been written to the TEE ring buffer, the global
+wptr (mutex protected) shall be incremented for use by next client.
+
+If PSP became unresponsive while processing TEE request from a
+client, then further command submission to queue will be disabled.
+
+Fixes: 33960acccfbd (crypto: ccp - add TEE support for Raven Ridge)
+Reviewed-by: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
+Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/tee-dev.c | 49 +++++++++++++++++++++++++-----------
+ drivers/crypto/ccp/tee-dev.h | 20 +++++++++++++--
+ 2 files changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/crypto/ccp/tee-dev.c b/drivers/crypto/ccp/tee-dev.c
+index 5e697a90ea7f..bcb81fef4211 100644
+--- a/drivers/crypto/ccp/tee-dev.c
++++ b/drivers/crypto/ccp/tee-dev.c
+@@ -36,6 +36,7 @@ static int tee_alloc_ring(struct psp_tee_device *tee, int ring_size)
+ if (!start_addr)
+ return -ENOMEM;
+
++ memset(start_addr, 0x0, ring_size);
+ rb_mgr->ring_start = start_addr;
+ rb_mgr->ring_size = ring_size;
+ rb_mgr->ring_pa = __psp_pa(start_addr);
+@@ -244,41 +245,54 @@ static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id,
+ void *buf, size_t len, struct tee_ring_cmd **resp)
+ {
+ struct tee_ring_cmd *cmd;
+- u32 rptr, wptr;
+ int nloop = 1000, ret = 0;
++ u32 rptr;
+
+ *resp = NULL;
+
+ mutex_lock(&tee->rb_mgr.mutex);
+
+- wptr = tee->rb_mgr.wptr;
+-
+- /* Check if ring buffer is full */
++ /* Loop until empty entry found in ring buffer */
+ do {
++ /* Get pointer to ring buffer command entry */
++ cmd = (struct tee_ring_cmd *)
++ (tee->rb_mgr.ring_start + tee->rb_mgr.wptr);
++
+ rptr = ioread32(tee->io_regs + tee->vdata->ring_rptr_reg);
+
+- if (!(wptr + sizeof(struct tee_ring_cmd) == rptr))
++ /* Check if ring buffer is full or command entry is waiting
++ * for response from TEE
++ */
++ if (!(tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
++ cmd->flag == CMD_WAITING_FOR_RESPONSE))
+ break;
+
+- dev_info(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
+- rptr, wptr);
++ dev_dbg(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
++ rptr, tee->rb_mgr.wptr);
+
+- /* Wait if ring buffer is full */
++ /* Wait if ring buffer is full or TEE is processing data */
+ mutex_unlock(&tee->rb_mgr.mutex);
+ schedule_timeout_interruptible(msecs_to_jiffies(10));
+ mutex_lock(&tee->rb_mgr.mutex);
+
+ } while (--nloop);
+
+- if (!nloop && (wptr + sizeof(struct tee_ring_cmd) == rptr)) {
+- dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
+- rptr, wptr);
++ if (!nloop &&
++ (tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
++ cmd->flag == CMD_WAITING_FOR_RESPONSE)) {
++ dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u response flag %u\n",
++ rptr, tee->rb_mgr.wptr, cmd->flag);
+ ret = -EBUSY;
+ goto unlock;
+ }
+
+- /* Pointer to empty data entry in ring buffer */
+- cmd = (struct tee_ring_cmd *)(tee->rb_mgr.ring_start + wptr);
++ /* Do not submit command if PSP got disabled while processing any
++ * command in another thread
++ */
++ if (psp_dead) {
++ ret = -EBUSY;
++ goto unlock;
++ }
+
+ /* Write command data into ring buffer */
+ cmd->cmd_id = cmd_id;
+@@ -286,6 +300,9 @@ static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id,
+ memset(&cmd->buf[0], 0, sizeof(cmd->buf));
+ memcpy(&cmd->buf[0], buf, len);
+
++ /* Indicate driver is waiting for response */
++ cmd->flag = CMD_WAITING_FOR_RESPONSE;
++
+ /* Update local copy of write pointer */
+ tee->rb_mgr.wptr += sizeof(struct tee_ring_cmd);
+ if (tee->rb_mgr.wptr >= tee->rb_mgr.ring_size)
+@@ -353,12 +370,16 @@ int psp_tee_process_cmd(enum tee_cmd_id cmd_id, void *buf, size_t len,
+ return ret;
+
+ ret = tee_wait_cmd_completion(tee, resp, TEE_DEFAULT_TIMEOUT);
+- if (ret)
++ if (ret) {
++ resp->flag = CMD_RESPONSE_TIMEDOUT;
+ return ret;
++ }
+
+ memcpy(buf, &resp->buf[0], len);
+ *status = resp->status;
+
++ resp->flag = CMD_RESPONSE_COPIED;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(psp_tee_process_cmd);
+diff --git a/drivers/crypto/ccp/tee-dev.h b/drivers/crypto/ccp/tee-dev.h
+index f09960112115..49d26158b71e 100644
+--- a/drivers/crypto/ccp/tee-dev.h
++++ b/drivers/crypto/ccp/tee-dev.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: MIT */
+ /*
+- * Copyright 2019 Advanced Micro Devices, Inc.
++ * Copyright (C) 2019,2021 Advanced Micro Devices, Inc.
+ *
+ * Author: Rijo Thomas <Rijo-john.Thomas@amd.com>
+ * Author: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
+@@ -18,7 +18,7 @@
+ #include <linux/mutex.h>
+
+ #define TEE_DEFAULT_TIMEOUT 10
+-#define MAX_BUFFER_SIZE 992
++#define MAX_BUFFER_SIZE 988
+
+ /**
+ * enum tee_ring_cmd_id - TEE interface commands for ring buffer configuration
+@@ -81,6 +81,20 @@ enum tee_cmd_state {
+ TEE_CMD_STATE_COMPLETED,
+ };
+
++/**
++ * enum cmd_resp_state - TEE command's response status maintained by driver
++ * @CMD_RESPONSE_INVALID: initial state when no command is written to ring
++ * @CMD_WAITING_FOR_RESPONSE: driver waiting for response from TEE
++ * @CMD_RESPONSE_TIMEDOUT: failed to get response from TEE
++ * @CMD_RESPONSE_COPIED: driver has copied response from TEE
++ */
++enum cmd_resp_state {
++ CMD_RESPONSE_INVALID,
++ CMD_WAITING_FOR_RESPONSE,
++ CMD_RESPONSE_TIMEDOUT,
++ CMD_RESPONSE_COPIED,
++};
++
+ /**
+ * struct tee_ring_cmd - Structure of the command buffer in TEE ring
+ * @cmd_id: refers to &enum tee_cmd_id. Command id for the ring buffer
+@@ -91,6 +105,7 @@ enum tee_cmd_state {
+ * @pdata: private data (currently unused)
+ * @res1: reserved region
+ * @buf: TEE command specific buffer
++ * @flag: refers to &enum cmd_resp_state
+ */
+ struct tee_ring_cmd {
+ u32 cmd_id;
+@@ -100,6 +115,7 @@ struct tee_ring_cmd {
+ u64 pdata;
+ u32 res1[2];
+ u8 buf[MAX_BUFFER_SIZE];
++ u32 flag;
+
+ /* Total size: 1024 bytes */
+ } __packed;
+--
+2.30.2
+
--- /dev/null
+From 53c17f803feced4cef92b0f3bc60f8ce3f5d8b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Apr 2021 00:55:48 +0530
+Subject: crypto: chelsio - Read rxchannel-id from firmware
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 16a9874fe468855e8ddd72883ca903f706d0a9d0 ]
+
+The rxchannel id is updated by the driver using the
+port no value, but this does not ensure that the value
+is correct. So now rx channel value is obtained from
+etoc channel map value.
+
+Fixes: 567be3a5d227 ("crypto: chelsio - Use multiple txq/rxq per...")
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chcr_algo.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
+index f5a336634daa..405ff957b837 100644
+--- a/drivers/crypto/chelsio/chcr_algo.c
++++ b/drivers/crypto/chelsio/chcr_algo.c
+@@ -769,13 +769,14 @@ static inline void create_wreq(struct chcr_context *ctx,
+ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ unsigned int tx_channel_id, rx_channel_id;
+ unsigned int txqidx = 0, rxqidx = 0;
+- unsigned int qid, fid;
++ unsigned int qid, fid, portno;
+
+ get_qidxs(req, &txqidx, &rxqidx);
+ qid = u_ctx->lldi.rxq_ids[rxqidx];
+ fid = u_ctx->lldi.rxq_ids[0];
++ portno = rxqidx / ctx->rxq_perchan;
+ tx_channel_id = txqidx / ctx->txq_perchan;
+- rx_channel_id = rxqidx / ctx->rxq_perchan;
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[portno]);
+
+
+ chcr_req->wreq.op_to_cctx_size = FILL_WR_OP_CCTX_SIZE;
+@@ -806,6 +807,7 @@ static struct sk_buff *create_cipher_wr(struct cipher_wr_param *wrparam)
+ {
+ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(wrparam->req);
+ struct chcr_context *ctx = c_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ struct ablk_ctx *ablkctx = ABLK_CTX(ctx);
+ struct sk_buff *skb = NULL;
+ struct chcr_wr *chcr_req;
+@@ -822,6 +824,7 @@ static struct sk_buff *create_cipher_wr(struct cipher_wr_param *wrparam)
+ struct adapter *adap = padap(ctx->dev);
+ unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ nents = sg_nents_xlen(reqctx->dstsg, wrparam->bytes, CHCR_DST_SG_SIZE,
+ reqctx->dst_ofst);
+ dst_size = get_space_for_phys_dsgl(nents);
+@@ -1580,6 +1583,7 @@ static struct sk_buff *create_hash_wr(struct ahash_request *req,
+ int error = 0;
+ unsigned int rx_channel_id = req_ctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ transhdr_len = HASH_TRANSHDR_SIZE(param->kctx_len);
+ req_ctx->hctx_wr.imm = (transhdr_len + param->bfr_len +
+ param->sg_len) <= SGE_MAX_WR_LEN;
+@@ -2438,6 +2442,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct chcr_context *ctx = a_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx);
+ struct chcr_authenc_ctx *actx = AUTHENC_CTX(aeadctx);
+ struct chcr_aead_reqctx *reqctx = aead_request_ctx(req);
+@@ -2457,6 +2462,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
+ struct adapter *adap = padap(ctx->dev);
+ unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ if (req->cryptlen == 0)
+ return NULL;
+
+@@ -2710,9 +2716,11 @@ void chcr_add_aead_dst_ent(struct aead_request *req,
+ struct dsgl_walk dsgl_walk;
+ unsigned int authsize = crypto_aead_authsize(tfm);
+ struct chcr_context *ctx = a_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ u32 temp;
+ unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ dsgl_walk_init(&dsgl_walk, phys_cpl);
+ dsgl_walk_add_page(&dsgl_walk, IV + reqctx->b0_len, reqctx->iv_dma);
+ temp = req->assoclen + req->cryptlen +
+@@ -2752,9 +2760,11 @@ void chcr_add_cipher_dst_ent(struct skcipher_request *req,
+ struct chcr_skcipher_req_ctx *reqctx = skcipher_request_ctx(req);
+ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(wrparam->req);
+ struct chcr_context *ctx = c_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ struct dsgl_walk dsgl_walk;
+ unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ dsgl_walk_init(&dsgl_walk, phys_cpl);
+ dsgl_walk_add_sg(&dsgl_walk, reqctx->dstsg, wrparam->bytes,
+ reqctx->dst_ofst);
+@@ -2958,6 +2968,7 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct chcr_context *ctx = a_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx);
+ struct chcr_aead_reqctx *reqctx = aead_request_ctx(req);
+ unsigned int cipher_mode = CHCR_SCMD_CIPHER_MODE_AES_CCM;
+@@ -2967,6 +2978,8 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl,
+ unsigned int tag_offset = 0, auth_offset = 0;
+ unsigned int assoclen;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
++
+ if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4309)
+ assoclen = req->assoclen - 8;
+ else
+@@ -3127,6 +3140,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct chcr_context *ctx = a_ctx(tfm);
++ struct uld_ctx *u_ctx = ULD_CTX(ctx);
+ struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx);
+ struct chcr_aead_reqctx *reqctx = aead_request_ctx(req);
+ struct sk_buff *skb = NULL;
+@@ -3143,6 +3157,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
+ struct adapter *adap = padap(ctx->dev);
+ unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan;
+
++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]);
+ if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106)
+ assoclen = req->assoclen - 8;
+
+--
+2.30.2
+
--- /dev/null
+From f368a4b06b2bb41357c1099d472585f7d9db36c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 07:45:27 +0000
+Subject: crypto: keembay-ocs-aes - Fix error return code in
+ kmb_ocs_aes_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 2eee428d8212265af09d349b74746be03513382e ]
+
+Fix to return negative error code -ENOMEM from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/keembay/keembay-ocs-aes-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/keembay/keembay-ocs-aes-core.c b/drivers/crypto/keembay/keembay-ocs-aes-core.c
+index b6b25d994af3..2ef312866338 100644
+--- a/drivers/crypto/keembay/keembay-ocs-aes-core.c
++++ b/drivers/crypto/keembay/keembay-ocs-aes-core.c
+@@ -1649,8 +1649,10 @@ static int kmb_ocs_aes_probe(struct platform_device *pdev)
+
+ /* Initialize crypto engine */
+ aes_dev->engine = crypto_engine_alloc_init(dev, true);
+- if (!aes_dev->engine)
++ if (!aes_dev->engine) {
++ rc = -ENOMEM;
+ goto list_del;
++ }
+
+ rc = crypto_engine_start(aes_dev->engine);
+ if (rc) {
+--
+2.30.2
+
--- /dev/null
+From bc0f2ec93ccea354b84bf772a999c0fbf8e579b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 07:43:50 +0000
+Subject: crypto: keembay-ocs-hcu - Fix error return code in
+ kmb_ocs_hcu_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 662c1c5618aaf71f99ada3105b99668a503605ae ]
+
+Fix to return negative error code -ENOMEM from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/keembay/keembay-ocs-hcu-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/keembay/keembay-ocs-hcu-core.c
+index c4b97b4160e9..322c51a6936f 100644
+--- a/drivers/crypto/keembay/keembay-ocs-hcu-core.c
++++ b/drivers/crypto/keembay/keembay-ocs-hcu-core.c
+@@ -1220,8 +1220,10 @@ static int kmb_ocs_hcu_probe(struct platform_device *pdev)
+
+ /* Initialize crypto engine */
+ hcu_dev->engine = crypto_engine_alloc_init(dev, 1);
+- if (!hcu_dev->engine)
++ if (!hcu_dev->engine) {
++ rc = -ENOMEM;
+ goto list_del;
++ }
+
+ rc = crypto_engine_start(hcu_dev->engine);
+ if (rc) {
+--
+2.30.2
+
--- /dev/null
+From 78be538043f474b832f63c7d756e80474dcdeb74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 18:05:15 +0100
+Subject: crypto: poly1305 - fix poly1305_core_setkey() declaration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8d195e7a8ada68928f2aedb2c18302a4518fe68e ]
+
+gcc-11 points out a mismatch between the declaration and the definition
+of poly1305_core_setkey():
+
+lib/crypto/poly1305-donna32.c:13:67: error: argument 2 of type ‘const u8[16]’ {aka ‘const unsigned char[16]’} with mismatched bound [-Werror=array-parameter=]
+ 13 | void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16])
+ | ~~~~~~~~~^~~~~~~~~~~
+In file included from lib/crypto/poly1305-donna32.c:11:
+include/crypto/internal/poly1305.h:21:68: note: previously declared as ‘const u8 *’ {aka ‘const unsigned char *’}
+ 21 | void poly1305_core_setkey(struct poly1305_core_key *key, const u8 *raw_key);
+
+This is harmless in principle, as the calling conventions are the same,
+but the more specific prototype allows better type checking in the
+caller.
+
+Change the declaration to match the actual function definition.
+The poly1305_simd_init() is a bit suspicious here, as it previously
+had a 32-byte argument type, but looks like it needs to take the
+16-byte POLY1305_BLOCK_SIZE array instead.
+
+Fixes: 1c08a104360f ("crypto: poly1305 - add new 32 and 64-bit generic versions")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/poly1305-glue.c | 2 +-
+ arch/arm64/crypto/poly1305-glue.c | 2 +-
+ arch/mips/crypto/poly1305-glue.c | 2 +-
+ arch/x86/crypto/poly1305_glue.c | 6 +++---
+ include/crypto/internal/poly1305.h | 3 ++-
+ include/crypto/poly1305.h | 6 ++++--
+ lib/crypto/poly1305-donna32.c | 3 ++-
+ lib/crypto/poly1305-donna64.c | 3 ++-
+ lib/crypto/poly1305.c | 3 ++-
+ 9 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm/crypto/poly1305-glue.c b/arch/arm/crypto/poly1305-glue.c
+index 3023c1acfa19..c31bd8f7c092 100644
+--- a/arch/arm/crypto/poly1305-glue.c
++++ b/arch/arm/crypto/poly1305-glue.c
+@@ -29,7 +29,7 @@ void __weak poly1305_blocks_neon(void *state, const u8 *src, u32 len, u32 hibit)
+
+ static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon);
+
+-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key)
++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
+ {
+ poly1305_init_arm(&dctx->h, key);
+ dctx->s[0] = get_unaligned_le32(key + 16);
+diff --git a/arch/arm64/crypto/poly1305-glue.c b/arch/arm64/crypto/poly1305-glue.c
+index 683de671741a..9c3d86e397bf 100644
+--- a/arch/arm64/crypto/poly1305-glue.c
++++ b/arch/arm64/crypto/poly1305-glue.c
+@@ -25,7 +25,7 @@ asmlinkage void poly1305_emit(void *state, u8 *digest, const u32 *nonce);
+
+ static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon);
+
+-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key)
++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
+ {
+ poly1305_init_arm64(&dctx->h, key);
+ dctx->s[0] = get_unaligned_le32(key + 16);
+diff --git a/arch/mips/crypto/poly1305-glue.c b/arch/mips/crypto/poly1305-glue.c
+index fc881b46d911..bc6110fb98e0 100644
+--- a/arch/mips/crypto/poly1305-glue.c
++++ b/arch/mips/crypto/poly1305-glue.c
+@@ -17,7 +17,7 @@ asmlinkage void poly1305_init_mips(void *state, const u8 *key);
+ asmlinkage void poly1305_blocks_mips(void *state, const u8 *src, u32 len, u32 hibit);
+ asmlinkage void poly1305_emit_mips(void *state, u8 *digest, const u32 *nonce);
+
+-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key)
++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
+ {
+ poly1305_init_mips(&dctx->h, key);
+ dctx->s[0] = get_unaligned_le32(key + 16);
+diff --git a/arch/x86/crypto/poly1305_glue.c b/arch/x86/crypto/poly1305_glue.c
+index 646da46e8d10..1dfb8af48a3c 100644
+--- a/arch/x86/crypto/poly1305_glue.c
++++ b/arch/x86/crypto/poly1305_glue.c
+@@ -16,7 +16,7 @@
+ #include <asm/simd.h>
+
+ asmlinkage void poly1305_init_x86_64(void *ctx,
+- const u8 key[POLY1305_KEY_SIZE]);
++ const u8 key[POLY1305_BLOCK_SIZE]);
+ asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp,
+ const size_t len, const u32 padbit);
+ asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
+@@ -81,7 +81,7 @@ static void convert_to_base2_64(void *ctx)
+ state->is_base2_26 = 0;
+ }
+
+-static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_KEY_SIZE])
++static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE])
+ {
+ poly1305_init_x86_64(ctx, key);
+ }
+@@ -129,7 +129,7 @@ static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
+ poly1305_emit_avx(ctx, mac, nonce);
+ }
+
+-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key)
++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
+ {
+ poly1305_simd_init(&dctx->h, key);
+ dctx->s[0] = get_unaligned_le32(&key[16]);
+diff --git a/include/crypto/internal/poly1305.h b/include/crypto/internal/poly1305.h
+index 064e52ca5248..196aa769f296 100644
+--- a/include/crypto/internal/poly1305.h
++++ b/include/crypto/internal/poly1305.h
+@@ -18,7 +18,8 @@
+ * only the ε-almost-∆-universal hash function (not the full MAC) is computed.
+ */
+
+-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 *raw_key);
++void poly1305_core_setkey(struct poly1305_core_key *key,
++ const u8 raw_key[POLY1305_BLOCK_SIZE]);
+ static inline void poly1305_core_init(struct poly1305_state *state)
+ {
+ *state = (struct poly1305_state){};
+diff --git a/include/crypto/poly1305.h b/include/crypto/poly1305.h
+index f1f67fc749cf..090692ec3bc7 100644
+--- a/include/crypto/poly1305.h
++++ b/include/crypto/poly1305.h
+@@ -58,8 +58,10 @@ struct poly1305_desc_ctx {
+ };
+ };
+
+-void poly1305_init_arch(struct poly1305_desc_ctx *desc, const u8 *key);
+-void poly1305_init_generic(struct poly1305_desc_ctx *desc, const u8 *key);
++void poly1305_init_arch(struct poly1305_desc_ctx *desc,
++ const u8 key[POLY1305_KEY_SIZE]);
++void poly1305_init_generic(struct poly1305_desc_ctx *desc,
++ const u8 key[POLY1305_KEY_SIZE]);
+
+ static inline void poly1305_init(struct poly1305_desc_ctx *desc, const u8 *key)
+ {
+diff --git a/lib/crypto/poly1305-donna32.c b/lib/crypto/poly1305-donna32.c
+index 3cc77d94390b..7fb71845cc84 100644
+--- a/lib/crypto/poly1305-donna32.c
++++ b/lib/crypto/poly1305-donna32.c
+@@ -10,7 +10,8 @@
+ #include <asm/unaligned.h>
+ #include <crypto/internal/poly1305.h>
+
+-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16])
++void poly1305_core_setkey(struct poly1305_core_key *key,
++ const u8 raw_key[POLY1305_BLOCK_SIZE])
+ {
+ /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
+ key->key.r[0] = (get_unaligned_le32(&raw_key[0])) & 0x3ffffff;
+diff --git a/lib/crypto/poly1305-donna64.c b/lib/crypto/poly1305-donna64.c
+index 6ae181bb4345..d34cf4053668 100644
+--- a/lib/crypto/poly1305-donna64.c
++++ b/lib/crypto/poly1305-donna64.c
+@@ -12,7 +12,8 @@
+
+ typedef __uint128_t u128;
+
+-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16])
++void poly1305_core_setkey(struct poly1305_core_key *key,
++ const u8 raw_key[POLY1305_BLOCK_SIZE])
+ {
+ u64 t0, t1;
+
+diff --git a/lib/crypto/poly1305.c b/lib/crypto/poly1305.c
+index 9d2d14df0fee..26d87fc3823e 100644
+--- a/lib/crypto/poly1305.c
++++ b/lib/crypto/poly1305.c
+@@ -12,7 +12,8 @@
+ #include <linux/module.h>
+ #include <asm/unaligned.h>
+
+-void poly1305_init_generic(struct poly1305_desc_ctx *desc, const u8 *key)
++void poly1305_init_generic(struct poly1305_desc_ctx *desc,
++ const u8 key[POLY1305_KEY_SIZE])
+ {
+ poly1305_core_setkey(&desc->core_r, key);
+ desc->s[0] = get_unaligned_le32(key + 16);
+--
+2.30.2
+
--- /dev/null
+From 3a33fbbf7210f6604efbe1f5993e06c73686dc53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 23:40:00 -0400
+Subject: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ]
+
+ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()
+before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the
+vf2pf_lock is initialized in adf_dev_init(), which can fail and when it
+fail, the vf2pf_lock is either not initialized or destroyed, a subsequent
+use of vf2pf_lock will cause issue.
+To fix this issue, only set this flag if adf_dev_init() returns 0.
+
+[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0
+[ 7.180345] Call Trace:
+[ 7.182576] mutex_lock+0xc9/0xd0
+[ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat]
+[ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]
+[ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat]
+[ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf]
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running")
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
+ drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
+ drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+index 1d1532e8fb6d..067ca5e17d38 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+index 04742a6d91ca..51ea88c0b17d 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+index c972554a755e..29999da716cc 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+--
+2.30.2
+
--- /dev/null
+From 59d993fab54c5c92f35f36e15166c347056ea81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 23:39:59 -0400
+Subject: crypto: qat - don't release uninitialized resources
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ]
+
+adf_vf_isr_resource_alloc() is not unwinding correctly when error
+happens and it want to release uninitialized resources.
+To fix this, only release initialized resources.
+
+[ 1.792845] Trying to free already-free IRQ 11
+[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
+[ 1.801340] Call Trace:
+[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
+[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
+[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver")
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index 38d316a42ba6..888388acb6bd 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -261,17 +261,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+ goto err_out;
+
+ if (adf_setup_pf2vf_bh(accel_dev))
+- goto err_out;
++ goto err_disable_msi;
+
+ if (adf_setup_bh(accel_dev))
+- goto err_out;
++ goto err_cleanup_pf2vf_bh;
+
+ if (adf_request_msi_irq(accel_dev))
+- goto err_out;
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_cleanup_pf2vf_bh:
++ adf_cleanup_pf2vf_bh(accel_dev);
++
++err_disable_msi:
++ adf_disable_msi(accel_dev);
++
+ err_out:
+- adf_vf_isr_resource_free(accel_dev);
+ return -EFAULT;
+ }
+ EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
+--
+2.30.2
+
--- /dev/null
+From 9f173f46dc0341c463f32661e9af9d992801d39c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 10:13:48 -0700
+Subject: crypto: qat - Fix a double free in adf_create_ring
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ]
+
+In adf_create_ring, if the callee adf_init_ring() failed, the callee will
+free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then
+adf_create_ring will goto err and the ring->base_addr will be freed again
+in adf_cleanup_ring().
+
+My patch sets ring->base_addr to NULL after the first freed to avoid the
+double free.
+
+Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_transport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
+index 888c1e047295..8ba28409fb74 100644
+--- a/drivers/crypto/qat/qat_common/adf_transport.c
++++ b/drivers/crypto/qat/qat_common/adf_transport.c
+@@ -172,6 +172,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring)
+ dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n");
+ dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes,
+ ring->base_addr, ring->dma_addr);
++ ring->base_addr = NULL;
+ return -EFAULT;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f8644cd2778b6866f2bf98b50450cc9b48a0fb05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 08:34:18 +0000
+Subject: crypto: qat - fix error path in adf_isr_resource_alloc()
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ]
+
+The function adf_isr_resource_alloc() is not unwinding correctly in case
+of error.
+This patch fixes the error paths and propagate the errors to the caller.
+
+Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_isr.c | 29 ++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
+index c45853463530..e3ad5587be49 100644
+--- a/drivers/crypto/qat/qat_common/adf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_isr.c
+@@ -291,19 +291,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+
+ ret = adf_isr_alloc_msix_entry_table(accel_dev);
+ if (ret)
+- return ret;
+- if (adf_enable_msix(accel_dev))
+ goto err_out;
+
+- if (adf_setup_bh(accel_dev))
+- goto err_out;
++ ret = adf_enable_msix(accel_dev);
++ if (ret)
++ goto err_free_msix_table;
+
+- if (adf_request_irqs(accel_dev))
+- goto err_out;
++ ret = adf_setup_bh(accel_dev);
++ if (ret)
++ goto err_disable_msix;
++
++ ret = adf_request_irqs(accel_dev);
++ if (ret)
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_disable_msix:
++ adf_disable_msix(&accel_dev->accel_pci_dev);
++
++err_free_msix_table:
++ adf_isr_free_msix_entry_table(accel_dev);
++
+ err_out:
+- adf_isr_resource_free(accel_dev);
+- return -EFAULT;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(adf_isr_resource_alloc);
+--
+2.30.2
+
--- /dev/null
+From a01b5de51548d19edf3b69dfd82619dd6db311b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 16:28:39 +0100
+Subject: crypto: sa2ul - Fix memory leak of rxd
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 854b7737199848a91f6adfa0a03cf6f0c46c86e8 ]
+
+There are two error return paths that are not freeing rxd and causing
+memory leaks. Fix these.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: 00c9211f60db ("crypto: sa2ul - Fix DMA mapping API usage")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sa2ul.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
+index d7b1628fb484..b0f0502a5bb0 100644
+--- a/drivers/crypto/sa2ul.c
++++ b/drivers/crypto/sa2ul.c
+@@ -1146,8 +1146,10 @@ static int sa_run(struct sa_req *req)
+ mapped_sg->sgt.sgl = src;
+ mapped_sg->sgt.orig_nents = src_nents;
+ ret = dma_map_sgtable(ddev, &mapped_sg->sgt, dir_src, 0);
+- if (ret)
++ if (ret) {
++ kfree(rxd);
+ return ret;
++ }
+
+ mapped_sg->dir = dir_src;
+ mapped_sg->mapped = true;
+@@ -1155,8 +1157,10 @@ static int sa_run(struct sa_req *req)
+ mapped_sg->sgt.sgl = req->src;
+ mapped_sg->sgt.orig_nents = sg_nents;
+ ret = dma_map_sgtable(ddev, &mapped_sg->sgt, dir_src, 0);
+- if (ret)
++ if (ret) {
++ kfree(rxd);
+ return ret;
++ }
+
+ mapped_sg->dir = dir_src;
+ mapped_sg->mapped = true;
+--
+2.30.2
+
--- /dev/null
+From bf7a2d854900dd35fb0bc184661d793cbe48df7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 16:34:46 +0000
+Subject: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to
+ map
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 98b5ef3e97b16eaeeedb936f8bda3594ff84a70e ]
+
+In the case where the dma_iv mapping fails, the return error path leaks
+the memory allocated to object d. Fix this by adding a new error return
+label and jumping to this to ensure d is free'd before the return.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c
+index 08a1473b2145..3191527928e4 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c
+@@ -103,7 +103,8 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ dma_iv = dma_map_single(ss->dev, ctx->seed, ctx->slen, DMA_TO_DEVICE);
+ if (dma_mapping_error(ss->dev, dma_iv)) {
+ dev_err(ss->dev, "Cannot DMA MAP IV\n");
+- return -EFAULT;
++ err = -EFAULT;
++ goto err_free;
+ }
+
+ dma_dst = dma_map_single(ss->dev, d, todo, DMA_FROM_DEVICE);
+@@ -167,6 +168,7 @@ err_iv:
+ memcpy(ctx->seed, d + dlen, ctx->slen);
+ }
+ memzero_explicit(d, todo);
++err_free:
+ kfree(d);
+
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 18beea34520f7b7a7d45d0b35ecc40ab717114fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 16:18:27 +0100
+Subject: crypto: sun8i-ss - Fix memory leak of pad
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 50274b01ac1689b1a3f6bc4b5b3dbf361a55dd3a ]
+
+It appears there are several failure return paths that don't seem
+to be free'ing pad. Fix these.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+index 0b9aa24a5edd..64446b86c927 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+@@ -348,8 +348,10 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
+ bf = (__le32 *)pad;
+
+ result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
+- if (!result)
++ if (!result) {
++ kfree(pad);
+ return -ENOMEM;
++ }
+
+ for (i = 0; i < MAX_SG; i++) {
+ rctx->t_dst[i].addr = 0;
+@@ -435,10 +437,9 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
+ dma_unmap_sg(ss->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
+ dma_unmap_single(ss->dev, addr_res, digestsize, DMA_FROM_DEVICE);
+
+- kfree(pad);
+-
+ memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
+ theend:
++ kfree(pad);
+ kfree(result);
+ crypto_finalize_hash_request(engine, breq, err);
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 1bb0ef40e8010024dec63006be6783d2d0e4c1ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 09:46:10 +0100
+Subject: crypto: sun8i-ss - fix result memory leak on error path
+
+From: Corentin Labbe <clabbe.montjoie@gmail.com>
+
+[ Upstream commit 1dbc6a1e25be8575d6c4114d1d2b841a796507f7 ]
+
+This patch fixes a memory leak on an error path.
+
+Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+index 11cbcbc83a7b..0b9aa24a5edd 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+@@ -438,8 +438,8 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
+ kfree(pad);
+
+ memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
+- kfree(result);
+ theend:
++ kfree(result);
+ crypto_finalize_hash_request(engine, breq, err);
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 84d9d02b72f9ece373909750eba81d98b667ed1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 12:08:57 +0100
+Subject: cxgb4: Fix unintentional sign extension issues
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dd2c79677375c37f8f9f8d663eb4708495d595ef ]
+
+The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to
+the left will be promoted to a 32 bit signed int and then
+sign-extended to a u64. In the event that the top bit of the u8
+is set then all then all the upper 32 bits of the u64 end up as
+also being set because of the sign-extension. Fix this by
+casting the u8 values to a u64 before the 24 bit left shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 83b46440408b..bde8494215c4 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_lip[15] |
+ f->fs.nat_lip[14] << 8 |
+ f->fs.nat_lip[13] << 16 |
+- f->fs.nat_lip[12] << 24, 1);
++ (u64)f->fs.nat_lip[12] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1,
+ WORD_MASK, f->fs.nat_lip[11] |
+ f->fs.nat_lip[10] << 8 |
+ f->fs.nat_lip[9] << 16 |
+- f->fs.nat_lip[8] << 24, 1);
++ (u64)f->fs.nat_lip[8] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2,
+ WORD_MASK, f->fs.nat_lip[7] |
+ f->fs.nat_lip[6] << 8 |
+ f->fs.nat_lip[5] << 16 |
+- f->fs.nat_lip[4] << 24, 1);
++ (u64)f->fs.nat_lip[4] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3,
+ WORD_MASK, f->fs.nat_lip[3] |
+ f->fs.nat_lip[2] << 8 |
+ f->fs.nat_lip[1] << 16 |
+- f->fs.nat_lip[0] << 24, 1);
++ (u64)f->fs.nat_lip[0] << 24, 1);
+ } else {
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W,
+ WORD_MASK, f->fs.nat_lip[3] |
+ f->fs.nat_lip[2] << 8 |
+ f->fs.nat_lip[1] << 16 |
+- f->fs.nat_lip[0] << 24, 1);
++ (u64)f->fs.nat_lip[0] << 25, 1);
+ }
+ }
+
+@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_fip[15] |
+ f->fs.nat_fip[14] << 8 |
+ f->fs.nat_fip[13] << 16 |
+- f->fs.nat_fip[12] << 24, 1);
++ (u64)f->fs.nat_fip[12] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1,
+ WORD_MASK, f->fs.nat_fip[11] |
+ f->fs.nat_fip[10] << 8 |
+ f->fs.nat_fip[9] << 16 |
+- f->fs.nat_fip[8] << 24, 1);
++ (u64)f->fs.nat_fip[8] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2,
+ WORD_MASK, f->fs.nat_fip[7] |
+ f->fs.nat_fip[6] << 8 |
+ f->fs.nat_fip[5] << 16 |
+- f->fs.nat_fip[4] << 24, 1);
++ (u64)f->fs.nat_fip[4] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3,
+ WORD_MASK, f->fs.nat_fip[3] |
+ f->fs.nat_fip[2] << 8 |
+ f->fs.nat_fip[1] << 16 |
+- f->fs.nat_fip[0] << 24, 1);
++ (u64)f->fs.nat_fip[0] << 24, 1);
+
+ } else {
+ set_tcb_field(adap, f, tid,
+@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_fip[3] |
+ f->fs.nat_fip[2] << 8 |
+ f->fs.nat_fip[1] << 16 |
+- f->fs.nat_fip[0] << 24, 1);
++ (u64)f->fs.nat_fip[0] << 24, 1);
+ }
+ }
+
+ set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK,
+ (dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) |
+- (sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0),
++ (sp ? (nat_fp[1] << 16 | (u64)nat_fp[0] << 24) : 0),
+ 1);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 2ca8d9bf9d7d3fafb6eba404e1c8d4ea786a815c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 11:30:26 +0100
+Subject: devtmpfs: fix placement of complete() call
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 38f087de8947700d3b06d3d1594490e0f611c5d1 ]
+
+Calling complete() from within the __init function is wrong -
+theoretically, the init process could proceed all the way to freeing
+the init mem before the devtmpfsd thread gets to execute the return
+instruction in devtmpfs_setup().
+
+In practice, it seems to be harmless as gcc inlines devtmpfs_setup()
+into devtmpfsd(). So the calls of the __init functions init_chdir()
+etc. actually happen from devtmpfs_setup(), but the __ref on that one
+silences modpost (it's all right, because those calls happen before
+the complete()). But it does make the __init annotation of the setup
+function moot, which we'll fix in a subsequent patch.
+
+Fixes: bcbacc4909f1 ("devtmpfs: refactor devtmpfsd()")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Link: https://lore.kernel.org/r/20210312103027.2701413-1-linux@rasmusvillemoes.dk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/devtmpfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
+index 653c8c6ac7a7..aedeb2dc1a18 100644
+--- a/drivers/base/devtmpfs.c
++++ b/drivers/base/devtmpfs.c
+@@ -419,7 +419,6 @@ static int __init devtmpfs_setup(void *p)
+ init_chroot(".");
+ out:
+ *(int *)p = err;
+- complete(&setup_done);
+ return err;
+ }
+
+@@ -432,6 +431,7 @@ static int __ref devtmpfsd(void *p)
+ {
+ int err = devtmpfs_setup(p);
+
++ complete(&setup_done);
+ if (err)
+ return err;
+ devtmpfs_work_loop();
+--
+2.30.2
+
--- /dev/null
+From fe5f0148d1ab496b516df8786a28a3054674201b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 18:05:25 +0300
+Subject: driver core: platform: Declare early_platform_cleanup() prototype
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 1768289b44bae847612751d418fc5c5e680b5e5c ]
+
+Compiler is not happy:
+
+ CC drivers/base/platform.o
+drivers/base/platform.c:1557:20: warning: no previous prototype for ‘early_platform_cleanup’ [-Wmissing-prototypes]
+ 1557 | void __weak __init early_platform_cleanup(void) { }
+ | ^~~~~~~~~~~~~~~~~~~~~~
+
+Declare early_platform_cleanup() prototype in the header to make everyone happy.
+
+Fixes: eecd37e105f0 ("drivers: Fix boot problem on SuperH")
+Cc: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210331150525.59223-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/platform_device.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
+index 3f23f6e430bf..cd81e060863c 100644
+--- a/include/linux/platform_device.h
++++ b/include/linux/platform_device.h
+@@ -359,4 +359,7 @@ static inline int is_sh_early_platform_device(struct platform_device *pdev)
+ }
+ #endif /* CONFIG_SUPERH */
+
++/* For now only SuperH uses it */
++void early_platform_cleanup(void);
++
+ #endif /* _PLATFORM_DEVICE_H_ */
+--
+2.30.2
+
--- /dev/null
+From 59301c27b96a1fb8eee8f29e3fe2422bd465d3e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 07:32:29 -0700
+Subject: drivers/block/null_blk/main: Fix a double free in null_init.
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 72ce11ddfa4e9e1879103581a60b7e34547eaa0a ]
+
+In null_init, null_add_dev(dev) is called.
+In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones
+via kvfree(dev->zones) in out_cleanup_zone branch and returns err.
+Then null_init accept the err code and then calls null_free_dev(dev).
+
+But in null_free_dev(dev), dev->zones is freed again by
+null_free_zoned_dev().
+
+My patch set dev->zones to NULL in null_free_zoned_dev() after
+kvfree(dev->zones) is called, to avoid the double free.
+
+Fixes: 2984c8684f962 ("nullb: factor disk parameters")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Link: https://lore.kernel.org/r/20210426143229.7374-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/zoned.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/null_blk/zoned.c b/drivers/block/null_blk/zoned.c
+index bfcab1c782b5..dae54dd1aeac 100644
+--- a/drivers/block/null_blk/zoned.c
++++ b/drivers/block/null_blk/zoned.c
+@@ -180,6 +180,7 @@ int null_register_zoned_dev(struct nullb *nullb)
+ void null_free_zoned_dev(struct nullb_device *dev)
+ {
+ kvfree(dev->zones);
++ dev->zones = NULL;
+ }
+
+ int null_report_zones(struct gendisk *disk, sector_t sector,
+--
+2.30.2
+
--- /dev/null
+From 97341f0fd61ae9b773e85b09e0b5bc3c4ae50849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Mar 2021 20:13:48 +0100
+Subject: Drivers: hv: vmbus: Drop error message when 'No request id available'
+
+From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+
+[ Upstream commit 0c85c54bf7faeb80c6b76901ed77d93acef0207d ]
+
+Running out of request IDs on a channel essentially produces the same
+effect as running out of space in the ring buffer, in that -EAGAIN is
+returned. The error message in hv_ringbuffer_write() should either be
+dropped (since we don't output a message when the ring buffer is full)
+or be made conditional/debug-only.
+
+Suggested-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+Fixes: e8b7db38449ac ("Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening")
+Link: https://lore.kernel.org/r/20210301191348.196485-1-parri.andrea@gmail.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/ring_buffer.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 35833d4d1a1d..ecd82ebfd5bc 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -313,7 +313,6 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
+ rqst_id = vmbus_next_request_id(&channel->requestor, requestid);
+ if (rqst_id == VMBUS_RQST_ERROR) {
+ spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+- pr_err("No request id available\n");
+ return -EAGAIN;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 4478391a2c7b2e31b560f8cc9dd30df448b55427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 21:48:09 -0700
+Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 ]
+
+When running in Azure, disks may be connected to a Linux VM with
+read/write caching enabled. If a VM panics and issues a VMbus
+UNLOAD request to Hyper-V, the response is delayed until all dirty
+data in the disk cache is flushed. In extreme cases, this flushing
+can take 10's of seconds, depending on the disk speed and the amount
+of dirty data. If kdump is configured for the VM, the current 10 second
+timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD
+complete message may arrive well after the kdump kernel is already
+running, causing problems. Note that no problem occurs if kdump is
+not enabled because Hyper-V waits for the cache flush before doing
+a reboot through the BIOS/UEFI code.
+
+Fix this problem by increasing the timeout in vmbus_wait_for_unload()
+to 100 seconds. Also output periodic messages so that if anyone is
+watching the serial console, they won't think the VM is completely
+hung.
+
+Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload")
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index f0ed730e2e4e..ecebf1235fd5 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -756,6 +756,12 @@ static void init_vp_index(struct vmbus_channel *channel)
+ free_cpumask_var(available_mask);
+ }
+
++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */
++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */
++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS)
++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */
++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS)
++
+ static void vmbus_wait_for_unload(void)
+ {
+ int cpu;
+@@ -773,12 +779,17 @@ static void vmbus_wait_for_unload(void)
+ * vmbus_connection.unload_event. If not, the last thing we can do is
+ * read message pages for all CPUs directly.
+ *
+- * Wait no more than 10 seconds so that the panic path can't get
+- * hung forever in case the response message isn't seen.
++ * Wait up to 100 seconds since an Azure host must writeback any dirty
++ * data in its disk cache before the VMbus UNLOAD request will
++ * complete. This flushing has been empirically observed to take up
++ * to 50 seconds in cases with a lot of dirty data, so allow additional
++ * leeway and for inaccuracies in mdelay(). But eventually time out so
++ * that the panic path can't get hung forever in case the response
++ * message isn't seen.
+ */
+- for (i = 0; i < 1000; i++) {
++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) {
+ if (completion_done(&vmbus_connection.unload_event))
+- break;
++ goto completed;
+
+ for_each_online_cpu(cpu) {
+ struct hv_per_cpu_context *hv_cpu
+@@ -801,9 +812,18 @@ static void vmbus_wait_for_unload(void)
+ vmbus_signal_eom(msg, message_type);
+ }
+
+- mdelay(10);
++ /*
++ * Give a notice periodically so someone watching the
++ * serial output won't think it is completely hung.
++ */
++ if (!(i % UNLOAD_MSG_LOOPS))
++ pr_notice("Waiting for VMBus UNLOAD to complete\n");
++
++ mdelay(UNLOAD_DELAY_UNIT_MS);
+ }
++ pr_err("Continuing even though VMBus UNLOAD did not complete\n");
+
++completed:
+ /*
+ * We're crashing and already got the UNLOAD_RESPONSE, cleanup all
+ * maybe-pending messages on all CPUs to be able to receive new
+--
+2.30.2
+
--- /dev/null
+From 6cce738f11dfcfca25aa922acc8a76a8d7a70962 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 13:50:04 +0300
+Subject: Drivers: hv: vmbus: Use after free in __vmbus_open()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3e9bf43f7f7a46f21ec071cb47be92d0874c48da ]
+
+The "open_info" variable is added to the &vmbus_connection.chn_msg_list,
+but the error handling frees "open_info" without removing it from the
+list. This will result in a use after free. First remove it from the
+list, and then free it.
+
+Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrea Parri <parri.andrea@gmail.com>
+Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 0bd202de7960..945e41f5e3a8 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -653,7 +653,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel,
+
+ if (newchannel->rescind) {
+ err = -ENODEV;
+- goto error_free_info;
++ goto error_clean_msglist;
+ }
+
+ err = vmbus_post_msg(open_msg,
+--
+2.30.2
+
--- /dev/null
+From 7534257f2433511c8f9695e15fb83e49b6af3215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 12:12:34 +0100
+Subject: drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
+
+From: Ravi Kumar Bokka <rbokka@codeaurora.org>
+
+[ Upstream commit 9ec4f4b0e9fd3ad4b9a38bddb75b516ea09f4628 ]
+
+QFPROM controller hardware requires 1.8V min for fuse blowing.
+So, this change sets the voltage to 1.8V, required to blow the fuse
+for qfprom-efuse controller.
+
+To disable fuse blowing, we set the voltage to 0V since this may
+be a shared rail and may be able to run at a lower rate when we're
+not blowing fuses.
+
+Fixes: 93b4e49f8c86 ("nvmem: qfprom: Add fuse blowing support")
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Suggested-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Ravi Kumar Bokka <rbokka@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210330111241.19401-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/qfprom.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
+index 6cace24dfbf7..100d69d8f2e1 100644
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -127,6 +127,16 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv,
+ {
+ int ret;
+
++ /*
++ * This may be a shared rail and may be able to run at a lower rate
++ * when we're not blowing fuses. At the moment, the regulator framework
++ * applies voltage constraints even on disabled rails, so remove our
++ * constraints and allow the rail to be adjusted by other users.
++ */
++ ret = regulator_set_voltage(priv->vcc, 0, INT_MAX);
++ if (ret)
++ dev_warn(priv->dev, "Failed to set 0 voltage (ignoring)\n");
++
+ ret = regulator_disable(priv->vcc);
+ if (ret)
+ dev_warn(priv->dev, "Failed to disable regulator (ignoring)\n");
+@@ -172,6 +182,17 @@ static int qfprom_enable_fuse_blowing(const struct qfprom_priv *priv,
+ goto err_clk_prepared;
+ }
+
++ /*
++ * Hardware requires 1.8V min for fuse blowing; this may be
++ * a rail shared do don't specify a max--regulator constraints
++ * will handle.
++ */
++ ret = regulator_set_voltage(priv->vcc, 1800000, INT_MAX);
++ if (ret) {
++ dev_err(priv->dev, "Failed to set 1.8 voltage\n");
++ goto err_clk_rate_set;
++ }
++
+ ret = regulator_enable(priv->vcc);
+ if (ret) {
+ dev_err(priv->dev, "Failed to enable regulator\n");
+--
+2.30.2
+
--- /dev/null
+From 6db3b9c11c100c16c1534fc5580ccf4162209779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 22:50:06 +0100
+Subject: drm/amd/display: check fb of primary plane
+
+From: Sefa Eyeoglu <contact@scrumplex.net>
+
+[ Upstream commit 7df4ceb60fa9a3c5160cfd5b696657291934a2c9 ]
+
+Sometimes the primary plane might not be initialized (yet), which
+causes dm_check_crtc_cursor to divide by zero.
+Apparently a weird state before a S3-suspend causes the aforementioned
+divide-by-zero error when resuming from S3. This was explained in
+bug 212293 on Bugzilla.
+
+To avoid this divide-by-zero error we check if the primary plane's fb
+isn't NULL. If it's NULL the src_w and src_h attributes will be 0,
+which would cause a divide-by-zero.
+
+This fixes Bugzilla report 212293
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=212293
+
+Fixes: 12f4849a1cfd69f3 ("drm/amd/display: check cursor scaling")
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 2e42cdea6927..71e07ebc8f88 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9295,7 +9295,8 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+
+ new_cursor_state = drm_atomic_get_new_plane_state(state, crtc->cursor);
+ new_primary_state = drm_atomic_get_new_plane_state(state, crtc->primary);
+- if (!new_cursor_state || !new_primary_state || !new_cursor_state->fb) {
++ if (!new_cursor_state || !new_primary_state ||
++ !new_cursor_state->fb || !new_primary_state->fb) {
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9efb9dda77fd9b84c154ae83dfb87143bbfba4f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 14:15:48 +0300
+Subject: drm/amd/display: Fix off by one in hdmi_14_process_transaction()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e6fafd5a22e7a2eb216f5510db7aab54cc545c1 ]
+
+The hdcp_i2c_offsets[] array did not have an entry for
+HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one
+read overflow. I added an entry and copied the 0x0 value for the offset
+from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c.
+
+I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX
+entries. This doesn't change the code, but it's just a belt and
+suspenders approach to try future proof the code.
+
+Fixes: 4c283fdac08a ("drm/amd/display: Add HDCP module")
+Reviewed-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
+index 5e384a8a83dc..51855a2624cf 100644
+--- a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
++++ b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
+@@ -39,7 +39,7 @@
+ #define HDCP14_KSV_SIZE 5
+ #define HDCP14_MAX_KSV_FIFO_SIZE 127*HDCP14_KSV_SIZE
+
+-static const bool hdcp_cmd_is_read[] = {
++static const bool hdcp_cmd_is_read[HDCP_MESSAGE_ID_MAX] = {
+ [HDCP_MESSAGE_ID_READ_BKSV] = true,
+ [HDCP_MESSAGE_ID_READ_RI_R0] = true,
+ [HDCP_MESSAGE_ID_READ_PJ] = true,
+@@ -75,7 +75,7 @@ static const bool hdcp_cmd_is_read[] = {
+ [HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE] = false
+ };
+
+-static const uint8_t hdcp_i2c_offsets[] = {
++static const uint8_t hdcp_i2c_offsets[HDCP_MESSAGE_ID_MAX] = {
+ [HDCP_MESSAGE_ID_READ_BKSV] = 0x0,
+ [HDCP_MESSAGE_ID_READ_RI_R0] = 0x8,
+ [HDCP_MESSAGE_ID_READ_PJ] = 0xA,
+@@ -106,7 +106,8 @@ static const uint8_t hdcp_i2c_offsets[] = {
+ [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_SEND_ACK] = 0x60,
+ [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_STREAM_MANAGE] = 0x60,
+ [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_STREAM_READY] = 0x80,
+- [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70
++ [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70,
++ [HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE] = 0x0,
+ };
+
+ struct protection_properties {
+@@ -184,7 +185,7 @@ static const struct protection_properties hdmi_14_protection = {
+ .process_transaction = hdmi_14_process_transaction
+ };
+
+-static const uint32_t hdcp_dpcd_addrs[] = {
++static const uint32_t hdcp_dpcd_addrs[HDCP_MESSAGE_ID_MAX] = {
+ [HDCP_MESSAGE_ID_READ_BKSV] = 0x68000,
+ [HDCP_MESSAGE_ID_READ_RI_R0] = 0x68005,
+ [HDCP_MESSAGE_ID_READ_PJ] = 0xFFFFFFFF,
+--
+2.30.2
+
--- /dev/null
+From 895941a693141d63ef3d71b47b704e1c63ad90af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 13:00:20 -0500
+Subject: drm/amd/display: Free local data after use
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 616cf23b6cf40ad6f03ffbddfa1b6c4eb68d8ae1 ]
+
+Fixes the following memory leak in dc_link_construct():
+
+unreferenced object 0xffffa03e81471400 (size 1024):
+comm "amd_module_load", pid 2486, jiffies 4294946026 (age 10.544s)
+hex dump (first 32 bytes):
+00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+backtrace:
+[<000000000bdf5c4a>] kmem_cache_alloc_trace+0x30a/0x4a0
+[<00000000e7c59f0e>] link_create+0xce/0xac0 [amdgpu]
+[<000000002fb6c072>] dc_create+0x370/0x720 [amdgpu]
+[<000000000094d1f3>] amdgpu_dm_init+0x18e/0x17a0 [amdgpu]
+[<00000000bec048fd>] dm_hw_init+0x12/0x20 [amdgpu]
+[<00000000a2bb7cf6>] amdgpu_device_init+0x1463/0x1e60 [amdgpu]
+[<0000000032d3bb13>] amdgpu_driver_load_kms+0x5b/0x330 [amdgpu]
+[<00000000a27834f9>] amdgpu_pci_probe+0x192/0x280 [amdgpu]
+[<00000000fec7d291>] local_pci_probe+0x47/0xa0
+[<0000000055dbbfa7>] pci_device_probe+0xe3/0x180
+[<00000000815da970>] really_probe+0x1c4/0x4e0
+[<00000000b4b6974b>] driver_probe_device+0x62/0x150
+[<000000000f9ecc61>] device_driver_attach+0x58/0x60
+[<000000000f65c843>] __driver_attach+0xd6/0x150
+[<000000002f5e3683>] bus_for_each_dev+0x6a/0xc0
+[<00000000a1cfc897>] driver_attach+0x1e/0x20
+
+Fixes: 3a00c04212d1cf ("drm/amd/display/dc/core/dc_link: Move some local data from the stack to the heap")
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index bd0101013ec8..440bf0a0e12a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1603,6 +1603,7 @@ static bool dc_link_construct(struct dc_link *link,
+ link->psr_settings.psr_version = DC_PSR_VERSION_UNSUPPORTED;
+
+ DC_LOG_DC("BIOS object table - %s finished successfully.\n", __func__);
++ kfree(info);
+ return true;
+ device_tag_fail:
+ link->link_enc->funcs->destroy(&link->link_enc);
+--
+2.30.2
+
--- /dev/null
+From ca20791c9176308beac73b2f06fc175620a4975a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Mar 2021 11:38:11 +0100
+Subject: drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit 3bb1105071fb974e3e3ca2f92ddfd69c81285ab6 ]
+
+Replace GFP_KERNEL with GFP_ATOMIC as dcn20_resource_construct()
+can't sleep.
+
+Partially fixes: https://bugzilla.kernel.org/show_bug.cgi?id=212311
+as dcn20_resource_construct() also calls into SMU functions which does
+mutex_lock().
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 6 ++---
+ .../gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c | 2 +-
+ .../drm/amd/display/dc/dcn20/dcn20_resource.c | 26 +++++++++----------
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+index 4e87e70237e3..874b132fe1d7 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+@@ -283,7 +283,7 @@ struct abm *dce_abm_create(
+ const struct dce_abm_shift *abm_shift,
+ const struct dce_abm_mask *abm_mask)
+ {
+- struct dce_abm *abm_dce = kzalloc(sizeof(*abm_dce), GFP_KERNEL);
++ struct dce_abm *abm_dce = kzalloc(sizeof(*abm_dce), GFP_ATOMIC);
+
+ if (abm_dce == NULL) {
+ BREAK_TO_DEBUGGER();
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
+index ddc789daf3b1..09d4cb5c97b6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c
+@@ -1049,7 +1049,7 @@ struct dmcu *dcn10_dmcu_create(
+ const struct dce_dmcu_shift *dmcu_shift,
+ const struct dce_dmcu_mask *dmcu_mask)
+ {
+- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL);
++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC);
+
+ if (dmcu_dce == NULL) {
+ BREAK_TO_DEBUGGER();
+@@ -1070,7 +1070,7 @@ struct dmcu *dcn20_dmcu_create(
+ const struct dce_dmcu_shift *dmcu_shift,
+ const struct dce_dmcu_mask *dmcu_mask)
+ {
+- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL);
++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC);
+
+ if (dmcu_dce == NULL) {
+ BREAK_TO_DEBUGGER();
+@@ -1091,7 +1091,7 @@ struct dmcu *dcn21_dmcu_create(
+ const struct dce_dmcu_shift *dmcu_shift,
+ const struct dce_dmcu_mask *dmcu_mask)
+ {
+- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL);
++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC);
+
+ if (dmcu_dce == NULL) {
+ BREAK_TO_DEBUGGER();
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
+index 62cc2651e00c..8774406120fc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c
+@@ -112,7 +112,7 @@ struct dccg *dccg2_create(
+ const struct dccg_shift *dccg_shift,
+ const struct dccg_mask *dccg_mask)
+ {
+- struct dcn_dccg *dccg_dcn = kzalloc(sizeof(*dccg_dcn), GFP_KERNEL);
++ struct dcn_dccg *dccg_dcn = kzalloc(sizeof(*dccg_dcn), GFP_ATOMIC);
+ struct dccg *base;
+
+ if (dccg_dcn == NULL) {
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index 2c2dbfcd8957..bfbc23b76cd5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -1104,7 +1104,7 @@ struct dpp *dcn20_dpp_create(
+ uint32_t inst)
+ {
+ struct dcn20_dpp *dpp =
+- kzalloc(sizeof(struct dcn20_dpp), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn20_dpp), GFP_ATOMIC);
+
+ if (!dpp)
+ return NULL;
+@@ -1122,7 +1122,7 @@ struct input_pixel_processor *dcn20_ipp_create(
+ struct dc_context *ctx, uint32_t inst)
+ {
+ struct dcn10_ipp *ipp =
+- kzalloc(sizeof(struct dcn10_ipp), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn10_ipp), GFP_ATOMIC);
+
+ if (!ipp) {
+ BREAK_TO_DEBUGGER();
+@@ -1139,7 +1139,7 @@ struct output_pixel_processor *dcn20_opp_create(
+ struct dc_context *ctx, uint32_t inst)
+ {
+ struct dcn20_opp *opp =
+- kzalloc(sizeof(struct dcn20_opp), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn20_opp), GFP_ATOMIC);
+
+ if (!opp) {
+ BREAK_TO_DEBUGGER();
+@@ -1156,7 +1156,7 @@ struct dce_aux *dcn20_aux_engine_create(
+ uint32_t inst)
+ {
+ struct aux_engine_dce110 *aux_engine =
+- kzalloc(sizeof(struct aux_engine_dce110), GFP_KERNEL);
++ kzalloc(sizeof(struct aux_engine_dce110), GFP_ATOMIC);
+
+ if (!aux_engine)
+ return NULL;
+@@ -1194,7 +1194,7 @@ struct dce_i2c_hw *dcn20_i2c_hw_create(
+ uint32_t inst)
+ {
+ struct dce_i2c_hw *dce_i2c_hw =
+- kzalloc(sizeof(struct dce_i2c_hw), GFP_KERNEL);
++ kzalloc(sizeof(struct dce_i2c_hw), GFP_ATOMIC);
+
+ if (!dce_i2c_hw)
+ return NULL;
+@@ -1207,7 +1207,7 @@ struct dce_i2c_hw *dcn20_i2c_hw_create(
+ struct mpc *dcn20_mpc_create(struct dc_context *ctx)
+ {
+ struct dcn20_mpc *mpc20 = kzalloc(sizeof(struct dcn20_mpc),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+
+ if (!mpc20)
+ return NULL;
+@@ -1225,7 +1225,7 @@ struct hubbub *dcn20_hubbub_create(struct dc_context *ctx)
+ {
+ int i;
+ struct dcn20_hubbub *hubbub = kzalloc(sizeof(struct dcn20_hubbub),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+
+ if (!hubbub)
+ return NULL;
+@@ -1253,7 +1253,7 @@ struct timing_generator *dcn20_timing_generator_create(
+ uint32_t instance)
+ {
+ struct optc *tgn10 =
+- kzalloc(sizeof(struct optc), GFP_KERNEL);
++ kzalloc(sizeof(struct optc), GFP_ATOMIC);
+
+ if (!tgn10)
+ return NULL;
+@@ -1332,7 +1332,7 @@ static struct clock_source *dcn20_clock_source_create(
+ bool dp_clk_src)
+ {
+ struct dce110_clk_src *clk_src =
+- kzalloc(sizeof(struct dce110_clk_src), GFP_KERNEL);
++ kzalloc(sizeof(struct dce110_clk_src), GFP_ATOMIC);
+
+ if (!clk_src)
+ return NULL;
+@@ -1438,7 +1438,7 @@ struct display_stream_compressor *dcn20_dsc_create(
+ struct dc_context *ctx, uint32_t inst)
+ {
+ struct dcn20_dsc *dsc =
+- kzalloc(sizeof(struct dcn20_dsc), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn20_dsc), GFP_ATOMIC);
+
+ if (!dsc) {
+ BREAK_TO_DEBUGGER();
+@@ -1572,7 +1572,7 @@ struct hubp *dcn20_hubp_create(
+ uint32_t inst)
+ {
+ struct dcn20_hubp *hubp2 =
+- kzalloc(sizeof(struct dcn20_hubp), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn20_hubp), GFP_ATOMIC);
+
+ if (!hubp2)
+ return NULL;
+@@ -3390,7 +3390,7 @@ bool dcn20_mmhubbub_create(struct dc_context *ctx, struct resource_pool *pool)
+
+ static struct pp_smu_funcs *dcn20_pp_smu_create(struct dc_context *ctx)
+ {
+- struct pp_smu_funcs *pp_smu = kzalloc(sizeof(*pp_smu), GFP_KERNEL);
++ struct pp_smu_funcs *pp_smu = kzalloc(sizeof(*pp_smu), GFP_ATOMIC);
+
+ if (!pp_smu)
+ return pp_smu;
+@@ -4034,7 +4034,7 @@ struct resource_pool *dcn20_create_resource_pool(
+ struct dc *dc)
+ {
+ struct dcn20_resource_pool *pool =
+- kzalloc(sizeof(struct dcn20_resource_pool), GFP_KERNEL);
++ kzalloc(sizeof(struct dcn20_resource_pool), GFP_ATOMIC);
+
+ if (!pool)
+ return NULL;
+--
+2.30.2
+
--- /dev/null
+From b455e9b4aacc6014573d87ee5b1475091776e96d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 08:59:22 +0300
+Subject: drm/amd/pm: fix error code in smu_set_power_limit()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit bbdfe5aaef3c1d5c5e62fa235ef13f064e4c1c17 ]
+
+We should return -EINVAL instead of success if the "limit" is too high.
+
+Fixes: e098bc9612c2 ("drm/amd/pm: optimize the power related source code layout")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+index 42c4dbe3e362..ec0037a21331 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2086,6 +2086,7 @@ int smu_set_power_limit(struct smu_context *smu, uint32_t limit)
+ dev_err(smu->adev->dev,
+ "New power limit (%d) is over the max allowed %d\n",
+ limit, smu->max_power_limit);
++ ret = -EINVAL;
+ goto out;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d126509fb1d2a630e97d9b520a5f0368e3e18fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 08:58:55 +0300
+Subject: drm/amdgpu: fix an error code in init_pmu_entry_by_type_and_add()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 90cb3d8aca1baea9471d28f28d5de1528dd5e424 ]
+
+If the kmemdup() fails then this should return a negative error code
+but it currently returns success
+
+Fixes: b4a7db71ea06 ("drm/amdgpu: add per device user friendly xgmi events for vega20")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c
+index 19c0a3655228..82e9ecf84352 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c
+@@ -519,8 +519,10 @@ static int init_pmu_entry_by_type_and_add(struct amdgpu_pmu_entry *pmu_entry,
+ pmu_entry->pmu.attr_groups = kmemdup(attr_groups, sizeof(attr_groups),
+ GFP_KERNEL);
+
+- if (!pmu_entry->pmu.attr_groups)
++ if (!pmu_entry->pmu.attr_groups) {
++ ret = -ENOMEM;
+ goto err_attr_group;
++ }
+
+ snprintf(pmu_name, PMU_NAME_SIZE, "%s_%d", pmu_entry->pmu_file_prefix,
+ adev_to_drm(pmu_entry->adev)->primary->index);
+--
+2.30.2
+
--- /dev/null
+From dc70089e1df98032ec6fa5a05d5941ff7e01a2f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 22:15:42 -0500
+Subject: drm/amdkfd: fix build error with AMD_IOMMU_V2=m
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 1e87068570a2cc4db5f95a881686add71729e769 ]
+
+Using 'imply AMD_IOMMU_V2' does not guarantee that the driver can link
+against the exported functions. If the GPU driver is built-in but the
+IOMMU driver is a loadable module, the kfd_iommu.c file is indeed
+built but does not work:
+
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_bind_process_to_device':
+kfd_iommu.c:(.text+0x516): undefined reference to `amd_iommu_bind_pasid'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_unbind_process':
+kfd_iommu.c:(.text+0x691): undefined reference to `amd_iommu_unbind_pasid'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_suspend':
+kfd_iommu.c:(.text+0x966): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0x97f): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0x9a4): undefined reference to `amd_iommu_free_device'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_resume':
+kfd_iommu.c:(.text+0xa9a): undefined reference to `amd_iommu_init_device'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xadc): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xaff): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xc72): undefined reference to `amd_iommu_bind_pasid'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe08): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe26): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe42): undefined reference to `amd_iommu_free_device'
+
+Use IS_REACHABLE to only build IOMMU-V2 support if the amd_iommu symbols
+are reachable by the amdkfd driver. Output a warning if they are not,
+because that may not be what the user was expecting.
+
+Fixes: 64d1c3a43a6f ("drm/amdkfd: Centralize IOMMUv2 code and make it conditional")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 6 ++++++
+ drivers/gpu/drm/amd/amdkfd/kfd_iommu.h | 9 +++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+index 66bbca61e3ef..9318936aa805 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+@@ -20,6 +20,10 @@
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
++
+ #include <linux/printk.h>
+ #include <linux/device.h>
+ #include <linux/slab.h>
+@@ -355,3 +359,5 @@ int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+
+ return 0;
+ }
++
++#endif
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+index dd23d9fdf6a8..afd420b01a0c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+@@ -23,7 +23,9 @@
+ #ifndef __KFD_IOMMU_H__
+ #define __KFD_IOMMU_H__
+
+-#if defined(CONFIG_AMD_IOMMU_V2_MODULE) || defined(CONFIG_AMD_IOMMU_V2)
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
+
+ #define KFD_SUPPORT_IOMMU_V2
+
+@@ -46,6 +48,9 @@ static inline int kfd_iommu_check_device(struct kfd_dev *kfd)
+ }
+ static inline int kfd_iommu_device_init(struct kfd_dev *kfd)
+ {
++#if IS_MODULE(CONFIG_AMD_IOMMU_V2)
++ WARN_ONCE(1, "iommu_v2 module is not usable by built-in KFD");
++#endif
+ return 0;
+ }
+
+@@ -73,6 +78,6 @@ static inline int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+ return 0;
+ }
+
+-#endif /* defined(CONFIG_AMD_IOMMU_V2) */
++#endif /* IS_REACHABLE(CONFIG_AMD_IOMMU_V2) */
+
+ #endif /* __KFD_IOMMU_H__ */
+--
+2.30.2
+
--- /dev/null
+From eb481c39641682d4b69d71f11bcc9c76a33755e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 21:42:01 -0500
+Subject: drm/amdkfd: Fix recursive lock warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 7816e4a98ce3bc7c562807240b4f14171e177420 ]
+
+memalloc_nofs_save/restore are no longer sufficient to prevent recursive
+lock warnings when holding locks that can be taken in MMU notifiers. Use
+memalloc_noreclaim_save/restore instead.
+
+Fixes: f920e413ff9c ("mm: track mmu notifiers in fs_reclaim_acquire/release")
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index adbfd1d227a5..a566bbe26bdd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -92,13 +92,13 @@ struct amdgpu_prt_cb {
+ static inline void amdgpu_vm_eviction_lock(struct amdgpu_vm *vm)
+ {
+ mutex_lock(&vm->eviction_lock);
+- vm->saved_flags = memalloc_nofs_save();
++ vm->saved_flags = memalloc_noreclaim_save();
+ }
+
+ static inline int amdgpu_vm_eviction_trylock(struct amdgpu_vm *vm)
+ {
+ if (mutex_trylock(&vm->eviction_lock)) {
+- vm->saved_flags = memalloc_nofs_save();
++ vm->saved_flags = memalloc_noreclaim_save();
+ return 1;
+ }
+ return 0;
+@@ -106,7 +106,7 @@ static inline int amdgpu_vm_eviction_trylock(struct amdgpu_vm *vm)
+
+ static inline void amdgpu_vm_eviction_unlock(struct amdgpu_vm *vm)
+ {
+- memalloc_nofs_restore(vm->saved_flags);
++ memalloc_noreclaim_restore(vm->saved_flags);
+ mutex_unlock(&vm->eviction_lock);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 79980e3b38f653e3da144bbb035565fbdae5776c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 09:01:38 +0300
+Subject: drm/i915/gvt: Fix error code in intel_gvt_init_device()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ]
+
+The intel_gvt_init_vgpu_type_groups() function is only called from
+intel_gvt_init_device(). If it fails then the intel_gvt_init_device()
+prints the error code and propagates it back again. That's a bug
+because false is zero/success. The fix is to modify it to return zero
+or negative error codes and make everything consistent.
+
+Fixes: c5d71cb31723 ("drm/i915/gvt: Move vGPU type related code into gvt file")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/YHaFQtk/DIVYK1u5@mwanda
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
+index d1d8ee4a5f16..57578bf28d77 100644
+--- a/drivers/gpu/drm/i915/gvt/gvt.c
++++ b/drivers/gpu/drm/i915/gvt/gvt.c
+@@ -126,7 +126,7 @@ static bool intel_get_gvt_attrs(struct attribute_group ***intel_vgpu_type_groups
+ return true;
+ }
+
+-static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
++static int intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ {
+ int i, j;
+ struct intel_vgpu_type *type;
+@@ -144,7 +144,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ gvt_vgpu_type_groups[i] = group;
+ }
+
+- return true;
++ return 0;
+
+ unwind:
+ for (j = 0; j < i; j++) {
+@@ -152,7 +152,7 @@ unwind:
+ kfree(group);
+ }
+
+- return false;
++ return -ENOMEM;
+ }
+
+ static void intel_gvt_cleanup_vgpu_type_groups(struct intel_gvt *gvt)
+@@ -360,7 +360,7 @@ int intel_gvt_init_device(struct drm_i915_private *i915)
+ goto out_clean_thread;
+
+ ret = intel_gvt_init_vgpu_type_groups(gvt);
+- if (ret == false) {
++ if (ret) {
+ gvt_err("failed to init vgpu type groups: %d\n", ret);
+ goto out_clean_types;
+ }
+--
+2.30.2
+
--- /dev/null
+From 011a80798b8b2ed6c6a12911be5c4194802ea254 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 01:41:38 +0100
+Subject: drm/mcde/panel: Inverse misunderstood flag
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit d0c5ac04e7feedbc069f26f4dcbf35b521ae7fc5 ]
+
+A recent patch renaming MIPI_DSI_MODE_EOT_PACKET to
+MIPI_DSI_MODE_NO_EOT_PACKET brought to light the
+misunderstanding in the current MCDE driver and all
+its associated panel drivers that MIPI_DSI_MODE_EOT_PACKET
+would mean "use EOT packet" when in fact it means the
+reverse.
+
+Fix it up by implementing the flag right in the MCDE
+DSI driver and remove the flag from panels that actually
+want the EOT packet.
+
+Suggested-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
+Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE")
+Fixes: 899f24ed8d3a ("drm/panel: Add driver for Novatek NT35510-based panels")
+Fixes: ac1d6d74884e ("drm/panel: Add driver for Samsung S6D16D0 panel")
+Fixes: 435e06c06cb2 ("drm/panel: s6e63m0: Add DSI transport")
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Link: https://patchwork.freedesktop.org/patch/msgid/20210304004138.1785057-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mcde/mcde_dsi.c | 2 +-
+ drivers/gpu/drm/panel/panel-novatek-nt35510.c | 3 +--
+ drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 4 +---
+ drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c | 1 -
+ drivers/gpu/drm/panel/panel-sony-acx424akp.c | 3 +--
+ 5 files changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c
+index 2314c8122992..b3fd3501c412 100644
+--- a/drivers/gpu/drm/mcde/mcde_dsi.c
++++ b/drivers/gpu/drm/mcde/mcde_dsi.c
+@@ -760,7 +760,7 @@ static void mcde_dsi_start(struct mcde_dsi *d)
+ DSI_MCTL_MAIN_DATA_CTL_BTA_EN |
+ DSI_MCTL_MAIN_DATA_CTL_READ_EN |
+ DSI_MCTL_MAIN_DATA_CTL_REG_TE_EN;
+- if (d->mdsi->mode_flags & MIPI_DSI_MODE_EOT_PACKET)
++ if (!(d->mdsi->mode_flags & MIPI_DSI_MODE_EOT_PACKET))
+ val |= DSI_MCTL_MAIN_DATA_CTL_HOST_EOT_GEN;
+ writel(val, d->regs + DSI_MCTL_MAIN_DATA_CTL);
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35510.c b/drivers/gpu/drm/panel/panel-novatek-nt35510.c
+index b9a0e56f33e2..ef70140c5b09 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35510.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35510.c
+@@ -898,8 +898,7 @@ static int nt35510_probe(struct mipi_dsi_device *dsi)
+ */
+ dsi->hs_rate = 349440000;
+ dsi->lp_rate = 9600000;
+- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS |
+- MIPI_DSI_MODE_EOT_PACKET;
++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS;
+
+ /*
+ * Every new incarnation of this display must have a unique
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
+index 4aac0d1573dd..70560cac53a9 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
+@@ -184,9 +184,7 @@ static int s6d16d0_probe(struct mipi_dsi_device *dsi)
+ * As we only send commands we do not need to be continuously
+ * clocked.
+ */
+- dsi->mode_flags =
+- MIPI_DSI_CLOCK_NON_CONTINUOUS |
+- MIPI_DSI_MODE_EOT_PACKET;
++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS;
+
+ s6->supply = devm_regulator_get(dev, "vdd1");
+ if (IS_ERR(s6->supply))
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c
+index eec74c10ddda..9c3563c61e8c 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c
+@@ -97,7 +97,6 @@ static int s6e63m0_dsi_probe(struct mipi_dsi_device *dsi)
+ dsi->hs_rate = 349440000;
+ dsi->lp_rate = 9600000;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO |
+- MIPI_DSI_MODE_EOT_PACKET |
+ MIPI_DSI_MODE_VIDEO_BURST;
+
+ ret = s6e63m0_probe(dev, s6e63m0_dsi_dcs_read, s6e63m0_dsi_dcs_write,
+diff --git a/drivers/gpu/drm/panel/panel-sony-acx424akp.c b/drivers/gpu/drm/panel/panel-sony-acx424akp.c
+index 065efae213f5..95659a4d15e9 100644
+--- a/drivers/gpu/drm/panel/panel-sony-acx424akp.c
++++ b/drivers/gpu/drm/panel/panel-sony-acx424akp.c
+@@ -449,8 +449,7 @@ static int acx424akp_probe(struct mipi_dsi_device *dsi)
+ MIPI_DSI_MODE_VIDEO_BURST;
+ else
+ dsi->mode_flags =
+- MIPI_DSI_CLOCK_NON_CONTINUOUS |
+- MIPI_DSI_MODE_EOT_PACKET;
++ MIPI_DSI_CLOCK_NON_CONTINUOUS;
+
+ acx->supply = devm_regulator_get(dev, "vddi");
+ if (IS_ERR(acx->supply))
+--
+2.30.2
+
--- /dev/null
+From 874519610b0e082b8096f524a39dd99bd7048bf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 13:09:02 +0200
+Subject: drm/mediatek: Don't support hdmi connector creation
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 2e477391522354e763aa62ee3e281c1ad9e8eb1b ]
+
+commit f01195148967 ("drm/mediatek: mtk_dpi: Create connector for bridges")
+broke the display support for elm device since mtk_dpi calls
+drm_bridge_attach with the flag DRM_BRIDGE_ATTACH_NO_CONNECTOR
+while mtk_hdmi does not yet support this flag.
+
+Fix this by accepting DRM_BRIDGE_ATTACH_NO_CONNECTOR in bridge attachment.
+Implement the drm_bridge_funcs .detect() and .get_edid() operations, and
+call drm_bridge_hpd_notify() to report HPD. This provides the
+necessary API to support disabling connector creation.
+
+In addition, the field 'conn' is removed from the mtk_hdmi struct since
+mtk_hdmi don't create a connector. It is replaced with a pointer
+'curr_conn' that points to the current connector which can be access
+through the global state.
+
+This patch is inspired by a similar patch for bridge/synopsys/dw-hdmi.c:
+commit ec971aaa6775
+("drm: bridge: dw-hdmi: Make connector creation optional")
+But with the difference that in mtk-hdmi only the option of not creating
+a connector is supported.
+
+Fixes: f01195148967 ("drm/mediatek: mtk_dpi: Create connector for bridges")
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 151 +++++++++++-----------------
+ 1 file changed, 56 insertions(+), 95 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index f2c810b767ef..7fb358167f8d 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -153,7 +153,7 @@ struct mtk_hdmi_conf {
+ struct mtk_hdmi {
+ struct drm_bridge bridge;
+ struct drm_bridge *next_bridge;
+- struct drm_connector conn;
++ struct drm_connector *curr_conn;/* current connector (only valid when 'enabled') */
+ struct device *dev;
+ const struct mtk_hdmi_conf *conf;
+ struct phy *phy;
+@@ -186,11 +186,6 @@ static inline struct mtk_hdmi *hdmi_ctx_from_bridge(struct drm_bridge *b)
+ return container_of(b, struct mtk_hdmi, bridge);
+ }
+
+-static inline struct mtk_hdmi *hdmi_ctx_from_conn(struct drm_connector *c)
+-{
+- return container_of(c, struct mtk_hdmi, conn);
+-}
+-
+ static u32 mtk_hdmi_read(struct mtk_hdmi *hdmi, u32 offset)
+ {
+ return readl(hdmi->regs + offset);
+@@ -974,7 +969,7 @@ static int mtk_hdmi_setup_avi_infoframe(struct mtk_hdmi *hdmi,
+ ssize_t err;
+
+ err = drm_hdmi_avi_infoframe_from_display_mode(&frame,
+- &hdmi->conn, mode);
++ hdmi->curr_conn, mode);
+ if (err < 0) {
+ dev_err(hdmi->dev,
+ "Failed to get AVI infoframe from mode: %zd\n", err);
+@@ -1054,7 +1049,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
+ ssize_t err;
+
+ err = drm_hdmi_vendor_infoframe_from_display_mode(&frame,
+- &hdmi->conn, mode);
++ hdmi->curr_conn, mode);
+ if (err) {
+ dev_err(hdmi->dev,
+ "Failed to get vendor infoframe from mode: %zd\n", err);
+@@ -1201,48 +1196,16 @@ mtk_hdmi_update_plugged_status(struct mtk_hdmi *hdmi)
+ connector_status_connected : connector_status_disconnected;
+ }
+
+-static enum drm_connector_status hdmi_conn_detect(struct drm_connector *conn,
+- bool force)
++static enum drm_connector_status mtk_hdmi_detect(struct mtk_hdmi *hdmi)
+ {
+- struct mtk_hdmi *hdmi = hdmi_ctx_from_conn(conn);
+ return mtk_hdmi_update_plugged_status(hdmi);
+ }
+
+-static void hdmi_conn_destroy(struct drm_connector *conn)
+-{
+- struct mtk_hdmi *hdmi = hdmi_ctx_from_conn(conn);
+-
+- mtk_cec_set_hpd_event(hdmi->cec_dev, NULL, NULL);
+-
+- drm_connector_cleanup(conn);
+-}
+-
+-static int mtk_hdmi_conn_get_modes(struct drm_connector *conn)
+-{
+- struct mtk_hdmi *hdmi = hdmi_ctx_from_conn(conn);
+- struct edid *edid;
+- int ret;
+-
+- if (!hdmi->ddc_adpt)
+- return -ENODEV;
+-
+- edid = drm_get_edid(conn, hdmi->ddc_adpt);
+- if (!edid)
+- return -ENODEV;
+-
+- hdmi->dvi_mode = !drm_detect_monitor_audio(edid);
+-
+- drm_connector_update_edid_property(conn, edid);
+-
+- ret = drm_add_edid_modes(conn, edid);
+- kfree(edid);
+- return ret;
+-}
+-
+-static int mtk_hdmi_conn_mode_valid(struct drm_connector *conn,
+- struct drm_display_mode *mode)
++static int mtk_hdmi_bridge_mode_valid(struct drm_bridge *bridge,
++ const struct drm_display_info *info,
++ const struct drm_display_mode *mode)
+ {
+- struct mtk_hdmi *hdmi = hdmi_ctx_from_conn(conn);
++ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+ struct drm_bridge *next_bridge;
+
+ dev_dbg(hdmi->dev, "xres=%d, yres=%d, refresh=%d, intl=%d clock=%d\n",
+@@ -1267,74 +1230,57 @@ static int mtk_hdmi_conn_mode_valid(struct drm_connector *conn,
+ return drm_mode_validate_size(mode, 0x1fff, 0x1fff);
+ }
+
+-static struct drm_encoder *mtk_hdmi_conn_best_enc(struct drm_connector *conn)
+-{
+- struct mtk_hdmi *hdmi = hdmi_ctx_from_conn(conn);
+-
+- return hdmi->bridge.encoder;
+-}
+-
+-static const struct drm_connector_funcs mtk_hdmi_connector_funcs = {
+- .detect = hdmi_conn_detect,
+- .fill_modes = drm_helper_probe_single_connector_modes,
+- .destroy = hdmi_conn_destroy,
+- .reset = drm_atomic_helper_connector_reset,
+- .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+- .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+-};
+-
+-static const struct drm_connector_helper_funcs
+- mtk_hdmi_connector_helper_funcs = {
+- .get_modes = mtk_hdmi_conn_get_modes,
+- .mode_valid = mtk_hdmi_conn_mode_valid,
+- .best_encoder = mtk_hdmi_conn_best_enc,
+-};
+-
+ static void mtk_hdmi_hpd_event(bool hpd, struct device *dev)
+ {
+ struct mtk_hdmi *hdmi = dev_get_drvdata(dev);
+
+- if (hdmi && hdmi->bridge.encoder && hdmi->bridge.encoder->dev)
++ if (hdmi && hdmi->bridge.encoder && hdmi->bridge.encoder->dev) {
++ static enum drm_connector_status status;
++
++ status = mtk_hdmi_detect(hdmi);
+ drm_helper_hpd_irq_event(hdmi->bridge.encoder->dev);
++ drm_bridge_hpd_notify(&hdmi->bridge, status);
++ }
+ }
+
+ /*
+ * Bridge callbacks
+ */
+
++static enum drm_connector_status mtk_hdmi_bridge_detect(struct drm_bridge *bridge)
++{
++ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
++
++ return mtk_hdmi_detect(hdmi);
++}
++
++static struct edid *mtk_hdmi_bridge_get_edid(struct drm_bridge *bridge,
++ struct drm_connector *connector)
++{
++ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
++ struct edid *edid;
++
++ if (!hdmi->ddc_adpt)
++ return NULL;
++ edid = drm_get_edid(connector, hdmi->ddc_adpt);
++ if (!edid)
++ return NULL;
++ hdmi->dvi_mode = !drm_detect_monitor_audio(edid);
++ return edid;
++}
++
+ static int mtk_hdmi_bridge_attach(struct drm_bridge *bridge,
+ enum drm_bridge_attach_flags flags)
+ {
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+ int ret;
+
+- if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR) {
+- DRM_ERROR("Fix bridge driver to make connector optional!");
++ if (!(flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)) {
++ DRM_ERROR("%s: The flag DRM_BRIDGE_ATTACH_NO_CONNECTOR must be supplied\n",
++ __func__);
+ return -EINVAL;
+ }
+
+- ret = drm_connector_init_with_ddc(bridge->encoder->dev, &hdmi->conn,
+- &mtk_hdmi_connector_funcs,
+- DRM_MODE_CONNECTOR_HDMIA,
+- hdmi->ddc_adpt);
+- if (ret) {
+- dev_err(hdmi->dev, "Failed to initialize connector: %d\n", ret);
+- return ret;
+- }
+- drm_connector_helper_add(&hdmi->conn, &mtk_hdmi_connector_helper_funcs);
+-
+- hdmi->conn.polled = DRM_CONNECTOR_POLL_HPD;
+- hdmi->conn.interlace_allowed = true;
+- hdmi->conn.doublescan_allowed = false;
+-
+- ret = drm_connector_attach_encoder(&hdmi->conn,
+- bridge->encoder);
+- if (ret) {
+- dev_err(hdmi->dev,
+- "Failed to attach connector to encoder: %d\n", ret);
+- return ret;
+- }
+-
+ if (hdmi->next_bridge) {
+ ret = drm_bridge_attach(bridge->encoder, hdmi->next_bridge,
+ bridge, flags);
+@@ -1369,6 +1315,8 @@ static void mtk_hdmi_bridge_atomic_disable(struct drm_bridge *bridge,
+ clk_disable_unprepare(hdmi->clk[MTK_HDMI_CLK_HDMI_PIXEL]);
+ clk_disable_unprepare(hdmi->clk[MTK_HDMI_CLK_HDMI_PLL]);
+
++ hdmi->curr_conn = NULL;
++
+ hdmi->enabled = false;
+ }
+
+@@ -1432,8 +1380,13 @@ static void mtk_hdmi_send_infoframe(struct mtk_hdmi *hdmi,
+ static void mtk_hdmi_bridge_atomic_enable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_state)
+ {
++ struct drm_atomic_state *state = old_state->base.state;
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+
++ /* Retrieve the connector through the atomic state. */
++ hdmi->curr_conn = drm_atomic_get_new_connector_for_encoder(state,
++ bridge->encoder);
++
+ mtk_hdmi_output_set_display_mode(hdmi, &hdmi->mode);
+ clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PLL]);
+ clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PIXEL]);
+@@ -1444,6 +1397,7 @@ static void mtk_hdmi_bridge_atomic_enable(struct drm_bridge *bridge,
+ }
+
+ static const struct drm_bridge_funcs mtk_hdmi_bridge_funcs = {
++ .mode_valid = mtk_hdmi_bridge_mode_valid,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_reset = drm_atomic_helper_bridge_reset,
+@@ -1454,6 +1408,8 @@ static const struct drm_bridge_funcs mtk_hdmi_bridge_funcs = {
+ .mode_set = mtk_hdmi_bridge_mode_set,
+ .atomic_pre_enable = mtk_hdmi_bridge_atomic_pre_enable,
+ .atomic_enable = mtk_hdmi_bridge_atomic_enable,
++ .detect = mtk_hdmi_bridge_detect,
++ .get_edid = mtk_hdmi_bridge_get_edid,
+ };
+
+ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+@@ -1669,8 +1625,10 @@ static int mtk_hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf,
+ {
+ struct mtk_hdmi *hdmi = dev_get_drvdata(dev);
+
+- memcpy(buf, hdmi->conn.eld, min(sizeof(hdmi->conn.eld), len));
+-
++ if (hdmi->enabled)
++ memcpy(buf, hdmi->curr_conn->eld, min(sizeof(hdmi->curr_conn->eld), len));
++ else
++ memset(buf, 0, len);
+ return 0;
+ }
+
+@@ -1762,6 +1720,9 @@ static int mtk_drm_hdmi_probe(struct platform_device *pdev)
+
+ hdmi->bridge.funcs = &mtk_hdmi_bridge_funcs;
+ hdmi->bridge.of_node = pdev->dev.of_node;
++ hdmi->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID
++ | DRM_BRIDGE_OP_HPD;
++ hdmi->bridge.type = DRM_MODE_CONNECTOR_HDMIA;
+ drm_bridge_add(&hdmi->bridge);
+
+ ret = mtk_hdmi_clk_enable_audio(hdmi);
+--
+2.30.2
+
--- /dev/null
+From b62fb0538a3c4edcd908c23df357ce60dbc078ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 13:09:01 +0200
+Subject: drm/mediatek: Switch the hdmi bridge ops to the atomic versions
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 053d231f369ca05cd563ca9738b5a4c73908e697 ]
+
+The bridge operation '.enable' and the audio cb '.get_eld'
+access hdmi->conn. In the future we will want to support
+the flag DRM_BRIDGE_ATTACH_NO_CONNECTOR and then we will
+not have direct access to the connector.
+The atomic version '.atomic_enable' allows accessing the
+current connector from the state.
+This patch switches the bridge to the atomic version to
+prepare access to the connector in later patches.
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 8ee55f9e2954..f2c810b767ef 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1357,7 +1357,8 @@ static bool mtk_hdmi_bridge_mode_fixup(struct drm_bridge *bridge,
+ return true;
+ }
+
+-static void mtk_hdmi_bridge_disable(struct drm_bridge *bridge)
++static void mtk_hdmi_bridge_atomic_disable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_bridge_state)
+ {
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+
+@@ -1371,7 +1372,8 @@ static void mtk_hdmi_bridge_disable(struct drm_bridge *bridge)
+ hdmi->enabled = false;
+ }
+
+-static void mtk_hdmi_bridge_post_disable(struct drm_bridge *bridge)
++static void mtk_hdmi_bridge_atomic_post_disable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_state)
+ {
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+
+@@ -1406,7 +1408,8 @@ static void mtk_hdmi_bridge_mode_set(struct drm_bridge *bridge,
+ drm_mode_copy(&hdmi->mode, adjusted_mode);
+ }
+
+-static void mtk_hdmi_bridge_pre_enable(struct drm_bridge *bridge)
++static void mtk_hdmi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_state)
+ {
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+
+@@ -1426,7 +1429,8 @@ static void mtk_hdmi_send_infoframe(struct mtk_hdmi *hdmi,
+ mtk_hdmi_setup_vendor_specific_infoframe(hdmi, mode);
+ }
+
+-static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
++static void mtk_hdmi_bridge_atomic_enable(struct drm_bridge *bridge,
++ struct drm_bridge_state *old_state)
+ {
+ struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
+
+@@ -1440,13 +1444,16 @@ static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
+ }
+
+ static const struct drm_bridge_funcs mtk_hdmi_bridge_funcs = {
++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
++ .atomic_reset = drm_atomic_helper_bridge_reset,
+ .attach = mtk_hdmi_bridge_attach,
+ .mode_fixup = mtk_hdmi_bridge_mode_fixup,
+- .disable = mtk_hdmi_bridge_disable,
+- .post_disable = mtk_hdmi_bridge_post_disable,
++ .atomic_disable = mtk_hdmi_bridge_atomic_disable,
++ .atomic_post_disable = mtk_hdmi_bridge_atomic_post_disable,
+ .mode_set = mtk_hdmi_bridge_mode_set,
+- .pre_enable = mtk_hdmi_bridge_pre_enable,
+- .enable = mtk_hdmi_bridge_enable,
++ .atomic_pre_enable = mtk_hdmi_bridge_atomic_pre_enable,
++ .atomic_enable = mtk_hdmi_bridge_atomic_enable,
+ };
+
+ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+--
+2.30.2
+
--- /dev/null
+From 9acfc515632a02d2e8182236aa3b6db659f401bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 13:54:35 +0300
+Subject: drm/msm/dpu: enable DPU_SSPP_QOS_8LVL for SM8250
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 095eed898485312f86b7cb593da4f9cd5c43fdb0 ]
+
+SM8250 platform has a 8-Levels VIG QoS setting. This setting was missed
+due to bad interaction with b8dab65b5ac3 ("drm/msm/dpu: Move
+DPU_SSPP_QOS_8LVL bit to SDM845 and SC7180 masks"), which was applied in
+parallel.
+
+Fixes: d21fc5dfc3df ("drm/msm/dpu1: add support for qseed3lite used on sm8250")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210318105435.2011222-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 189f3533525c..e4444452759c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -22,7 +22,7 @@
+ (VIG_MASK | BIT(DPU_SSPP_QOS_8LVL) | BIT(DPU_SSPP_SCALER_QSEED4))
+
+ #define VIG_SM8250_MASK \
+- (VIG_MASK | BIT(DPU_SSPP_SCALER_QSEED3LITE))
++ (VIG_MASK | BIT(DPU_SSPP_QOS_8LVL) | BIT(DPU_SSPP_SCALER_QSEED3LITE))
+
+ #define DMA_SDM845_MASK \
+ (BIT(DPU_SSPP_SRC) | BIT(DPU_SSPP_QOS) | BIT(DPU_SSPP_QOS_8LVL) |\
+--
+2.30.2
+
--- /dev/null
+From 976bb79ff63e5f23b6ee571a04153c142ca3aa4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 18:27:20 -0700
+Subject: drm/msm: Fix debugfs deadlock
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 6ed0897cd800c38b92a33d335d9086c7b092eb15 ]
+
+In normal cases the gem obj lock is acquired first before mm_lock. The
+exception is iterating the various object lists. In the shrinker path,
+deadlock is avoided by using msm_gem_trylock() and skipping over objects
+that cannot be locked. But for debugfs the straightforward thing is to
+split things out into a separate list of all objects protected by it's
+own lock.
+
+Fixes: d984457b31c4 ("drm/msm: Add priv->mm_lock to protect active/inactive lists")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20210401012722.527712-4-robdclark@gmail.com
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_debugfs.c | 14 +++-----------
+ drivers/gpu/drm/msm/msm_drv.c | 3 +++
+ drivers/gpu/drm/msm/msm_drv.h | 9 ++++++++-
+ drivers/gpu/drm/msm/msm_gem.c | 14 +++++++++++++-
+ drivers/gpu/drm/msm/msm_gem.h | 12 ++++++++++--
+ 5 files changed, 37 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
+index 85ad0babc326..d611cc8e54a4 100644
+--- a/drivers/gpu/drm/msm/msm_debugfs.c
++++ b/drivers/gpu/drm/msm/msm_debugfs.c
+@@ -111,23 +111,15 @@ static const struct file_operations msm_gpu_fops = {
+ static int msm_gem_show(struct drm_device *dev, struct seq_file *m)
+ {
+ struct msm_drm_private *priv = dev->dev_private;
+- struct msm_gpu *gpu = priv->gpu;
+ int ret;
+
+- ret = mutex_lock_interruptible(&priv->mm_lock);
++ ret = mutex_lock_interruptible(&priv->obj_lock);
+ if (ret)
+ return ret;
+
+- if (gpu) {
+- seq_printf(m, "Active Objects (%s):\n", gpu->name);
+- msm_gem_describe_objects(&gpu->active_list, m);
+- }
+-
+- seq_printf(m, "Inactive Objects:\n");
+- msm_gem_describe_objects(&priv->inactive_dontneed, m);
+- msm_gem_describe_objects(&priv->inactive_willneed, m);
++ msm_gem_describe_objects(&priv->objects, m);
+
+- mutex_unlock(&priv->mm_lock);
++ mutex_unlock(&priv->obj_lock);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 196907689c82..18ea1c66de71 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -446,6 +446,9 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+
+ priv->wq = alloc_ordered_workqueue("msm", 0);
+
++ INIT_LIST_HEAD(&priv->objects);
++ mutex_init(&priv->obj_lock);
++
+ INIT_LIST_HEAD(&priv->inactive_willneed);
+ INIT_LIST_HEAD(&priv->inactive_dontneed);
+ mutex_init(&priv->mm_lock);
+diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
+index 591c47a654e8..6b58e49754cb 100644
+--- a/drivers/gpu/drm/msm/msm_drv.h
++++ b/drivers/gpu/drm/msm/msm_drv.h
+@@ -174,7 +174,14 @@ struct msm_drm_private {
+ struct msm_rd_state *hangrd; /* debugfs to dump hanging submits */
+ struct msm_perf_state *perf;
+
+- /*
++ /**
++ * List of all GEM objects (mainly for debugfs, protected by obj_lock
++ * (acquire before per GEM object lock)
++ */
++ struct list_head objects;
++ struct mutex obj_lock;
++
++ /**
+ * Lists of inactive GEM objects. Every bo is either in one of the
+ * inactive lists (depending on whether or not it is shrinkable) or
+ * gpu->active_list (for the gpu it is active on[1])
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index f091c1e164fa..aeba3eb8ce46 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -951,7 +951,7 @@ void msm_gem_describe_objects(struct list_head *list, struct seq_file *m)
+ size_t size = 0;
+
+ seq_puts(m, " flags id ref offset kaddr size madv name\n");
+- list_for_each_entry(msm_obj, list, mm_list) {
++ list_for_each_entry(msm_obj, list, node) {
+ struct drm_gem_object *obj = &msm_obj->base;
+ seq_puts(m, " ");
+ msm_gem_describe(obj, m);
+@@ -970,6 +970,10 @@ void msm_gem_free_object(struct drm_gem_object *obj)
+ struct drm_device *dev = obj->dev;
+ struct msm_drm_private *priv = dev->dev_private;
+
++ mutex_lock(&priv->obj_lock);
++ list_del(&msm_obj->node);
++ mutex_unlock(&priv->obj_lock);
++
+ mutex_lock(&priv->mm_lock);
+ list_del(&msm_obj->mm_list);
+ mutex_unlock(&priv->mm_lock);
+@@ -1157,6 +1161,10 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
+ list_add_tail(&msm_obj->mm_list, &priv->inactive_willneed);
+ mutex_unlock(&priv->mm_lock);
+
++ mutex_lock(&priv->obj_lock);
++ list_add_tail(&msm_obj->node, &priv->objects);
++ mutex_unlock(&priv->obj_lock);
++
+ return obj;
+
+ fail:
+@@ -1227,6 +1235,10 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+ list_add_tail(&msm_obj->mm_list, &priv->inactive_willneed);
+ mutex_unlock(&priv->mm_lock);
+
++ mutex_lock(&priv->obj_lock);
++ list_add_tail(&msm_obj->node, &priv->objects);
++ mutex_unlock(&priv->obj_lock);
++
+ return obj;
+
+ fail:
+diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
+index b3a0a880cbab..99d4c0e9465e 100644
+--- a/drivers/gpu/drm/msm/msm_gem.h
++++ b/drivers/gpu/drm/msm/msm_gem.h
+@@ -55,8 +55,16 @@ struct msm_gem_object {
+ */
+ uint8_t vmap_count;
+
+- /* And object is either:
+- * inactive - on priv->inactive_list
++ /**
++ * Node in list of all objects (mainly for debugfs, protected by
++ * priv->obj_lock
++ */
++ struct list_head node;
++
++ /**
++ * An object is either:
++ * inactive - on priv->inactive_dontneed or priv->inactive_willneed
++ * (depending on purgability status)
+ * active - on one one of the gpu's active_list.. well, at
+ * least for now we don't have (I don't think) hw sync between
+ * 2d and 3d one devices which have both, meaning we need to
+--
+2.30.2
+
--- /dev/null
+From 8de678e72392b129684e553467dddb12a45359e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:34:53 +0800
+Subject: drm/omap: dsi: Add missing IRQF_ONESHOT
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 0cafc8d88e6df446751669ec15adc9b807af4501 ]
+
+fixed the following coccicheck:
+./drivers/gpu/drm/omapdrm/dss/dsi.c:4329:7-27: ERROR: Threaded IRQ with
+no primary handler requested without IRQF_ONESHOT
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Fixes: 4c1b935fea54 ("drm/omap: dsi: move TE GPIO handling into core")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1616492093-68237-1-git-send-email-yang.lee@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/dss/dsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
+index b31d750c425a..5f1722b040f4 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
++++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
+@@ -4327,7 +4327,8 @@ static int omap_dsi_register_te_irq(struct dsi_data *dsi,
+ irq_set_status_flags(te_irq, IRQ_NOAUTOEN);
+
+ err = request_threaded_irq(te_irq, NULL, omap_dsi_te_irq_handler,
+- IRQF_TRIGGER_RISING, "TE", dsi);
++ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ "TE", dsi);
+ if (err) {
+ dev_err(dsi->dev, "request irq failed with %d\n", err);
+ gpiod_put(dsi->te_gpio);
+--
+2.30.2
+
--- /dev/null
+From 59fee39a9b5a053bb686022575a7ec865a3520ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 14:44:16 -0800
+Subject: drm/panel-simple: Undo enable if HPD never asserts
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 5e7222a3674ea7422370779884dd53aabe9e4a9d ]
+
+If the HPD signal never asserts in panel_simple_prepare() and we
+return an error, we should unset the enable GPIO and disable the
+regulator to make it consistent for the caller.
+
+At the moment I have some hardware where HPD sometimes doesn't assert.
+Obviously that needs to be debugged, but this patch makes it so that
+if I add a retry that I can make things work.
+
+Fixes: 48834e6084f1 ("drm/panel-simple: Support hpd-gpios for delaying prepare()")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210115144345.v2.1.I33fcbd64ab409cfe4f9491bf449f51925a4d3281@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 4e2dad314c79..e8b1a0e873ea 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -406,7 +406,7 @@ static int panel_simple_prepare(struct drm_panel *panel)
+ if (IS_ERR(p->hpd_gpio)) {
+ err = panel_simple_get_hpd_gpio(panel->dev, p, false);
+ if (err)
+- return err;
++ goto error;
+ }
+
+ err = readx_poll_timeout(gpiod_get_value_cansleep, p->hpd_gpio,
+@@ -418,13 +418,20 @@ static int panel_simple_prepare(struct drm_panel *panel)
+ if (err) {
+ dev_err(panel->dev,
+ "error waiting for hpd GPIO: %d\n", err);
+- return err;
++ goto error;
+ }
+ }
+
+ p->prepared_time = ktime_get();
+
+ return 0;
++
++error:
++ gpiod_set_value_cansleep(p->enable_gpio, 0);
++ regulator_disable(p->supply);
++ p->unprepared_time = ktime_get();
++
++ return err;
+ }
+
+ static int panel_simple_enable(struct drm_panel *panel)
+--
+2.30.2
+
--- /dev/null
+From 1812b8ddc12156b1a930c995f6adc506f21ee452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Mar 2021 12:25:44 +0100
+Subject: drm/probe-helper: Check epoch counter in output_poll_execute()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+[ Upstream commit dc659a4e852b591771fc2e5abb60f4455b0cf316 ]
+
+drm_helper_hpd_irq_event() checks the epoch counter to determine
+connector status change. This was introduced in
+commit 5186421cbfe2 ("drm: Introduce epoch counter to drm_connector").
+Do the same for output_poll_execute() so it can detect other changes
+beside connection status value changes.
+
+v2:
+- Add Fixes tag (Daniel)
+
+Fixes: 5186421cbfe2 ("drm: Introduce epoch counter to drm_connector")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210313112545.37527-3-noralf@tronnes.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_probe_helper.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index ad59a51eab6d..e7e1ee2aa352 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -624,6 +624,7 @@ static void output_poll_execute(struct work_struct *work)
+ struct drm_connector_list_iter conn_iter;
+ enum drm_connector_status old_status;
+ bool repoll = false, changed;
++ u64 old_epoch_counter;
+
+ if (!dev->mode_config.poll_enabled)
+ return;
+@@ -660,8 +661,9 @@ static void output_poll_execute(struct work_struct *work)
+
+ repoll = true;
+
++ old_epoch_counter = connector->epoch_counter;
+ connector->status = drm_helper_probe_detect(connector, NULL, false);
+- if (old_status != connector->status) {
++ if (old_epoch_counter != connector->epoch_counter) {
+ const char *old, *new;
+
+ /*
+@@ -690,6 +692,9 @@ static void output_poll_execute(struct work_struct *work)
+ connector->base.id,
+ connector->name,
+ old, new);
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] epoch counter %llu -> %llu\n",
++ connector->base.id, connector->name,
++ old_epoch_counter, connector->epoch_counter);
+
+ changed = true;
+ }
+--
+2.30.2
+
--- /dev/null
+From cdf1a68523c99e08f1cf9e6eb13ff69cc9caf661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 20:10:04 -0700
+Subject: drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
+
+From: Yingjie Wang <wangyingjie55@126.com>
+
+[ Upstream commit 25315ebfaefcffd126a266116b37bb8a3d1c4620 ]
+
+In radeon_dp_mst_detect(), We should check whether or not @connector
+has been unregistered from userspace. If the connector is unregistered,
+we should return disconnected status.
+
+Fixes: 9843ead08f18 ("drm/radeon: add DisplayPort MST support (v2)")
+Signed-off-by: Yingjie Wang <wangyingjie55@126.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_dp_mst.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c
+index 2c32186c4acd..4e4c937c36c6 100644
+--- a/drivers/gpu/drm/radeon/radeon_dp_mst.c
++++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c
+@@ -242,6 +242,9 @@ radeon_dp_mst_detect(struct drm_connector *connector,
+ to_radeon_connector(connector);
+ struct radeon_connector *master = radeon_connector->mst_port;
+
++ if (drm_connector_is_unregistered(connector))
++ return connector_status_disconnected;
++
+ return drm_dp_mst_detect_port(connector, ctx, &master->mst_mgr,
+ radeon_connector->port);
+ }
+--
+2.30.2
+
--- /dev/null
+From 3f7942efd4f74cd6e85ddf783e5ce108220a3638 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 12:07:56 +0100
+Subject: drm/stm: Fix bus_flags handling
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 99e360442f223dd40fc23ae07c7a263836fd27e6 ]
+
+The drm_display_mode_to_videomode() does not populate DISPLAY_FLAGS_DE_LOW
+or DISPLAY_FLAGS_PIXDATA_NEGEDGE flags in struct videomode. Therefore, no
+matter what polarity the next bridge or display might require, these flags
+are never set, and thus the LTDC GCR_DEPOL and GCR_PCPOL bits are never set
+and the LTDC behaves as if both DISPLAY_FLAGS_PIXDATA_POSEDGE and
+DISPLAY_FLAGS_DE_HIGH were always set.
+
+The fix for this problem is taken almost verbatim from MXSFB driver. In
+case there is a bridge attached to the LTDC, the bridge might have extra
+polarity requirements, so extract bus_flags from the bridge and use them
+for LTDC configuration. Otherwise, extract bus_flags from the connector,
+which is the display.
+
+Fixes: b759012c5fa7 ("drm/stm: Add STM32 LTDC driver")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Yannick Fertre <yannick.fertre@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Antonio Borneo <antonio.borneo@st.com>
+Cc: Benjamin Gaignard <benjamin.gaignard@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Philippe Cornu <philippe.cornu@st.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Vincent Abriou <vincent.abriou@st.com>
+Cc: Yannick Fertre <yannick.fertre@st.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: dri-devel@lists.freedesktop.org
+Tested-by: Yannick Fertre <yannick.fertre@foss.st.com>
+Signed-off-by: Philippe Cornu <philippe.cornu@foss.st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210127110756.125570-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index 7812094f93d6..6f3b523e16e8 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -525,13 +525,42 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc)
+ {
+ struct ltdc_device *ldev = crtc_to_ltdc(crtc);
+ struct drm_device *ddev = crtc->dev;
++ struct drm_connector_list_iter iter;
++ struct drm_connector *connector = NULL;
++ struct drm_encoder *encoder = NULL;
++ struct drm_bridge *bridge = NULL;
+ struct drm_display_mode *mode = &crtc->state->adjusted_mode;
+ struct videomode vm;
+ u32 hsync, vsync, accum_hbp, accum_vbp, accum_act_w, accum_act_h;
+ u32 total_width, total_height;
++ u32 bus_flags = 0;
+ u32 val;
+ int ret;
+
++ /* get encoder from crtc */
++ drm_for_each_encoder(encoder, ddev)
++ if (encoder->crtc == crtc)
++ break;
++
++ if (encoder) {
++ /* get bridge from encoder */
++ list_for_each_entry(bridge, &encoder->bridge_chain, chain_node)
++ if (bridge->encoder == encoder)
++ break;
++
++ /* Get the connector from encoder */
++ drm_connector_list_iter_begin(ddev, &iter);
++ drm_for_each_connector_iter(connector, &iter)
++ if (connector->encoder == encoder)
++ break;
++ drm_connector_list_iter_end(&iter);
++ }
++
++ if (bridge && bridge->timings)
++ bus_flags = bridge->timings->input_bus_flags;
++ else if (connector)
++ bus_flags = connector->display_info.bus_flags;
++
+ if (!pm_runtime_active(ddev->dev)) {
+ ret = pm_runtime_get_sync(ddev->dev);
+ if (ret) {
+@@ -567,10 +596,10 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc)
+ if (vm.flags & DISPLAY_FLAGS_VSYNC_HIGH)
+ val |= GCR_VSPOL;
+
+- if (vm.flags & DISPLAY_FLAGS_DE_LOW)
++ if (bus_flags & DRM_BUS_FLAG_DE_LOW)
+ val |= GCR_DEPOL;
+
+- if (vm.flags & DISPLAY_FLAGS_PIXDATA_NEGEDGE)
++ if (bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+ val |= GCR_PCPOL;
+
+ reg_update_bits(ldev->regs, LTDC_GCR,
+--
+2.30.2
+
--- /dev/null
+From 47dc8798019f97edba7578646790b431aa3cae11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 16:24:15 +0800
+Subject: drm/tilcdc: send vblank event when disabling crtc
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit f1a75f4dd8edf272b6b7cdccf6ba6254ec9d15fa ]
+
+When run xrandr to change resolution on Beaglebone Black board, it will
+print the error information:
+
+root@beaglebone:~# xrandr -display :0 --output HDMI-1 --mode 720x400
+[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CRTC:32:tilcdc crtc] commit wait timed out
+[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CONNECTOR:34:HDMI-A-1] commit wait timed out
+[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [PLANE:31:plane-0] commit wait timed out
+tilcdc 4830e000.lcdc: already pending page flip!
+
+This is because there is operation sequence as below:
+
+drm_atomic_connector_commit_dpms(mode is DRM_MODE_DPMS_OFF):
+ ...
+ drm_atomic_helper_setup_commit <- init_completion(commit_A->flip_done)
+ drm_atomic_helper_commit_tail
+ tilcdc_crtc_atomic_disable
+ tilcdc_plane_atomic_update <- drm_crtc_send_vblank_event in tilcdc_crtc_irq
+ is skipped since tilcdc_crtc->enabled is 0
+ tilcdc_crtc_atomic_flush <- drm_crtc_send_vblank_event is skipped since
+ crtc->state->event is set to be NULL in
+ tilcdc_plane_atomic_update
+drm_mode_setcrtc:
+ ...
+ drm_atomic_helper_setup_commit <- init_completion(commit_B->flip_done)
+ drm_atomic_helper_wait_for_dependencies
+ drm_crtc_commit_wait <- wait for commit_A->flip_done completing
+
+Just as shown above, the steps which could complete commit_A->flip_done
+are all skipped and commit_A->flip_done will never be completed. This will
+result a time-out ERROR when drm_crtc_commit_wait check the commit_A->flip_done.
+So add drm_crtc_send_vblank_event in tilcdc_crtc_atomic_disable to
+complete commit_A->flip_done.
+
+Fixes: cb345decb4d2 ("drm/tilcdc: Use standard drm_atomic_helper_commit")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Jyri Sarha <jyri.sarha@iki.fi>
+Tested-by: Jyri Sarha <jyri.sarha@iki.fi>
+Signed-off-by: Jyri Sarha <jyri.sarha@iki.fi>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209082415.382602-1-quanyang.wang@windriver.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+index 30213708fc99..d99afd19ca08 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+@@ -515,6 +515,15 @@ static void tilcdc_crtc_off(struct drm_crtc *crtc, bool shutdown)
+
+ drm_crtc_vblank_off(crtc);
+
++ spin_lock_irq(&crtc->dev->event_lock);
++
++ if (crtc->state->event) {
++ drm_crtc_send_vblank_event(crtc, crtc->state->event);
++ crtc->state->event = NULL;
++ }
++
++ spin_unlock_irq(&crtc->dev->event_lock);
++
+ tilcdc_crtc_disable_irqs(dev);
+
+ pm_runtime_put_sync(dev->dev);
+--
+2.30.2
+
--- /dev/null
+From 9410ed6e8b6e3a02b9650344a2db6e71b315d8cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 12:31:52 +0300
+Subject: drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5842ab76bbfadb37eaea91e53c1efe34ae504e4a ]
+
+The dp->train_set[] for this driver is only two characters, not four so
+this memsets too much. Fortunately, this ends up corrupting a struct
+hole and not anything important.
+
+Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/YGLwCBMotnrKZu6P@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
+index 99158ee67d02..59d1fb017da0 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
+@@ -866,7 +866,7 @@ static int zynqmp_dp_train(struct zynqmp_dp *dp)
+ return ret;
+
+ zynqmp_dp_write(dp, ZYNQMP_DP_SCRAMBLING_DISABLE, 1);
+- memset(dp->train_set, 0, 4);
++ memset(dp->train_set, 0, sizeof(dp->train_set));
+ ret = zynqmp_dp_link_train_cr(dp);
+ if (ret)
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From fae6d3643e12e9e2b0a70de4ad3bb82481aead6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 19:15:02 +0800
+Subject: dt-bindings: serial: stm32: Use 'type: object' instead of false for
+ 'additionalProperties'
+
+From: dillon min <dillon.minfei@gmail.com>
+
+[ Upstream commit 9f299d3264c67a892af87337dbaa0bdd20830c0c ]
+
+To use additional properties 'bluetooth' on serial, need replace false with
+'type: object' for 'additionalProperties' to make it as a node, else will
+run into dtbs_check warnings.
+
+'arch/arm/boot/dts/stm32h750i-art-pi.dt.yaml: serial@40004800:
+'bluetooth' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: af1c2d81695b ("dt-bindings: serial: Convert STM32 UART to json-schema")
+Reported-by: kernel test robot <lkp@intel.com>
+Tested-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: dillon min <dillon.minfei@gmail.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/1616757302-7889-8-git-send-email-dillon.minfei@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/serial/st,stm32-uart.yaml | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml b/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml
+index 8631678283f9..865be05083c3 100644
+--- a/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml
++++ b/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml
+@@ -80,7 +80,8 @@ required:
+ - interrupts
+ - clocks
+
+-additionalProperties: false
++additionalProperties:
++ type: object
+
+ examples:
+ - |
+--
+2.30.2
+
--- /dev/null
+From 13c58e3d77aeaf8a4701c9c7a63112a48668daa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 05:42:00 -0400
+Subject: firmware: qcom-scm: Fix QCOM_SCM configuration
+
+From: He Ying <heying24@huawei.com>
+
+[ Upstream commit 2954a6f12f250890ec2433cec03ba92784d613e8 ]
+
+When CONFIG_QCOM_SCM is y and CONFIG_HAVE_ARM_SMCCC
+is not set, compiling errors are encountered as follows:
+
+drivers/firmware/qcom_scm-smc.o: In function `__scm_smc_do_quirk':
+qcom_scm-smc.c:(.text+0x36): undefined reference to `__arm_smccc_smc'
+drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call':
+qcom_scm-legacy.c:(.text+0xe2): undefined reference to `__arm_smccc_smc'
+drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call_atomic':
+qcom_scm-legacy.c:(.text+0x1f0): undefined reference to `__arm_smccc_smc'
+
+Note that __arm_smccc_smc is defined when HAVE_ARM_SMCCC is y.
+So add dependency on HAVE_ARM_SMCCC in QCOM_SCM configuration.
+
+Fixes: 916f743da354 ("firmware: qcom: scm: Move the scm driver to drivers/firmware")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: He Ying <heying24@huawei.com>
+Link: https://lore.kernel.org/r/20210406094200.60952-1-heying24@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index 3f14dffb9669..5dd19dbd67a3 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -237,6 +237,7 @@ config INTEL_STRATIX10_RSU
+ config QCOM_SCM
+ bool
+ depends on ARM || ARM64
++ depends on HAVE_ARM_SMCCC
+ select RESET_CONTROLLER
+
+ config QCOM_SCM_DOWNLOAD_MODE_DEFAULT
+--
+2.30.2
+
--- /dev/null
+From a0a712b9e22c3c823294721b59b68c7822ebe02f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 13:45:34 -0800
+Subject: firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 9d11af8b06a811c5c4878625f51ce109e2af4e80 ]
+
+Make __qcom_scm_is_call_available() return bool instead of int. The
+function has "is" in the name, so it should return a bool to indicate
+the truth of the call being available. Unfortunately, it can return a
+number < 0 which also looks "true", but not all callers expect that and
+thus they think a call is available when really the check to see if the
+call is available failed to figure it out.
+
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Elliot Berman <eberman@codeaurora.org>
+Cc: Brian Masney <masneyb@onstation.org>
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Cc: Jeffrey Hugo <jhugo@codeaurora.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Fixes: 0f206514749b ("scsi: firmware: qcom_scm: Add support for programming inline crypto keys")
+Fixes: 0434a4061471 ("firmware: qcom: scm: add support to restore secure config to qcm_scm-32")
+Fixes: b0a1614fb1f5 ("firmware: qcom: scm: add OCMEM lock/unlock interface")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210223214539.1336155-2-swboyd@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index f57779fc7ee9..2be5573dce53 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -113,9 +113,6 @@ static void qcom_scm_clk_disable(void)
+ clk_disable_unprepare(__scm->bus_clk);
+ }
+
+-static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id,
+- u32 cmd_id);
+-
+ enum qcom_scm_convention qcom_scm_convention;
+ static bool has_queried __read_mostly;
+ static DEFINE_SPINLOCK(query_lock);
+@@ -219,8 +216,8 @@ static int qcom_scm_call_atomic(struct device *dev,
+ }
+ }
+
+-static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id,
+- u32 cmd_id)
++static bool __qcom_scm_is_call_available(struct device *dev, u32 svc_id,
++ u32 cmd_id)
+ {
+ int ret;
+ struct qcom_scm_desc desc = {
+@@ -247,7 +244,7 @@ static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id,
+
+ ret = qcom_scm_call(dev, &desc, &res);
+
+- return ret ? : res.result[0];
++ return ret ? false : !!res.result[0];
+ }
+
+ /**
+@@ -585,9 +582,8 @@ bool qcom_scm_pas_supported(u32 peripheral)
+ };
+ struct qcom_scm_res res;
+
+- ret = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_PIL,
+- QCOM_SCM_PIL_PAS_IS_SUPPORTED);
+- if (ret <= 0)
++ if (!__qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_PIL,
++ QCOM_SCM_PIL_PAS_IS_SUPPORTED))
+ return false;
+
+ ret = qcom_scm_call(__scm->dev, &desc, &res);
+@@ -1060,17 +1056,18 @@ EXPORT_SYMBOL(qcom_scm_ice_set_key);
+ */
+ bool qcom_scm_hdcp_available(void)
+ {
++ bool avail;
+ int ret = qcom_scm_clk_enable();
+
+ if (ret)
+ return ret;
+
+- ret = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_HDCP,
++ avail = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_HDCP,
+ QCOM_SCM_HDCP_INVOKE);
+
+ qcom_scm_clk_disable();
+
+- return ret > 0;
++ return avail;
+ }
+ EXPORT_SYMBOL(qcom_scm_hdcp_available);
+
+--
+2.30.2
+
--- /dev/null
+From 2c1c6c84efc3bc3a647595426d049dba10eba56b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 13:45:35 -0800
+Subject: firmware: qcom_scm: Reduce locking section for __get_convention()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit f6ea568f0ddcdfad52807110ed8983e610f0e03b ]
+
+We shouldn't need to hold this spinlock here around the entire SCM call
+into the firmware and back. Instead, we should be able to query the
+firmware, potentially in parallel with other CPUs making the same
+convention detection firmware call, and then grab the lock to update the
+calling convention detected. The convention doesn't change at runtime so
+calling into firmware more than once is possibly wasteful but simpler.
+Besides, this is the slow path, not the fast path where we've already
+detected the convention used.
+
+More importantly, this allows us to add more logic here to workaround
+the case where the firmware call to check for availability isn't
+implemented in the firmware at all. In that case we can check the
+firmware node compatible string and force a calling convention.
+
+Note that we remove the 'has_queried' logic that is repeated twice. That
+could lead to the calling convention being printed multiple times to the
+kernel logs if the bool is true but __query_convention() is running on
+multiple CPUs. We also shorten the time where the lock is held, but we
+keep the lock held around the printk because it doesn't seem hugely
+important to drop it for that.
+
+Cc: Elliot Berman <eberman@codeaurora.org>
+Cc: Brian Masney <masneyb@onstation.org>
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Cc: Jeffrey Hugo <jhugo@codeaurora.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Fixes: 9a434cee773a ("firmware: qcom_scm: Dynamically support SMCCC and legacy conventions")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210223214539.1336155-3-swboyd@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm-smc.c | 12 ++++---
+ drivers/firmware/qcom_scm.c | 55 ++++++++++++++++-----------------
+ drivers/firmware/qcom_scm.h | 7 +++--
+ 3 files changed, 39 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm-smc.c b/drivers/firmware/qcom_scm-smc.c
+index 497c13ba98d6..d111833364ba 100644
+--- a/drivers/firmware/qcom_scm-smc.c
++++ b/drivers/firmware/qcom_scm-smc.c
+@@ -77,8 +77,10 @@ static void __scm_smc_do(const struct arm_smccc_args *smc,
+ } while (res->a0 == QCOM_SCM_V2_EBUSY);
+ }
+
+-int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
+- struct qcom_scm_res *res, bool atomic)
++
++int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
++ enum qcom_scm_convention qcom_convention,
++ struct qcom_scm_res *res, bool atomic)
+ {
+ int arglen = desc->arginfo & 0xf;
+ int i;
+@@ -87,9 +89,8 @@ int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
+ size_t alloc_len;
+ gfp_t flag = atomic ? GFP_ATOMIC : GFP_KERNEL;
+ u32 smccc_call_type = atomic ? ARM_SMCCC_FAST_CALL : ARM_SMCCC_STD_CALL;
+- u32 qcom_smccc_convention =
+- (qcom_scm_convention == SMC_CONVENTION_ARM_32) ?
+- ARM_SMCCC_SMC_32 : ARM_SMCCC_SMC_64;
++ u32 qcom_smccc_convention = (qcom_convention == SMC_CONVENTION_ARM_32) ?
++ ARM_SMCCC_SMC_32 : ARM_SMCCC_SMC_64;
+ struct arm_smccc_res smc_res;
+ struct arm_smccc_args smc = {0};
+
+@@ -148,4 +149,5 @@ int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
+ }
+
+ return (long)smc_res.a0 ? qcom_scm_remap_error(smc_res.a0) : 0;
++
+ }
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 2be5573dce53..21e07a464bd9 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -113,11 +113,10 @@ static void qcom_scm_clk_disable(void)
+ clk_disable_unprepare(__scm->bus_clk);
+ }
+
+-enum qcom_scm_convention qcom_scm_convention;
+-static bool has_queried __read_mostly;
+-static DEFINE_SPINLOCK(query_lock);
++enum qcom_scm_convention qcom_scm_convention = SMC_CONVENTION_UNKNOWN;
++static DEFINE_SPINLOCK(scm_query_lock);
+
+-static void __query_convention(void)
++static enum qcom_scm_convention __get_convention(void)
+ {
+ unsigned long flags;
+ struct qcom_scm_desc desc = {
+@@ -130,36 +129,36 @@ static void __query_convention(void)
+ .owner = ARM_SMCCC_OWNER_SIP,
+ };
+ struct qcom_scm_res res;
++ enum qcom_scm_convention probed_convention;
+ int ret;
+
+- spin_lock_irqsave(&query_lock, flags);
+- if (has_queried)
+- goto out;
++ if (likely(qcom_scm_convention != SMC_CONVENTION_UNKNOWN))
++ return qcom_scm_convention;
+
+- qcom_scm_convention = SMC_CONVENTION_ARM_64;
+- // Device isn't required as there is only one argument - no device
+- // needed to dma_map_single to secure world
+- ret = scm_smc_call(NULL, &desc, &res, true);
++ /*
++ * Device isn't required as there is only one argument - no device
++ * needed to dma_map_single to secure world
++ */
++ probed_convention = SMC_CONVENTION_ARM_64;
++ ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true);
+ if (!ret && res.result[0] == 1)
+- goto out;
++ goto found;
+
+- qcom_scm_convention = SMC_CONVENTION_ARM_32;
+- ret = scm_smc_call(NULL, &desc, &res, true);
++ probed_convention = SMC_CONVENTION_ARM_32;
++ ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true);
+ if (!ret && res.result[0] == 1)
+- goto out;
+-
+- qcom_scm_convention = SMC_CONVENTION_LEGACY;
+-out:
+- has_queried = true;
+- spin_unlock_irqrestore(&query_lock, flags);
+- pr_info("qcom_scm: convention: %s\n",
+- qcom_scm_convention_names[qcom_scm_convention]);
+-}
++ goto found;
++
++ probed_convention = SMC_CONVENTION_LEGACY;
++found:
++ spin_lock_irqsave(&scm_query_lock, flags);
++ if (probed_convention != qcom_scm_convention) {
++ qcom_scm_convention = probed_convention;
++ pr_info("qcom_scm: convention: %s\n",
++ qcom_scm_convention_names[qcom_scm_convention]);
++ }
++ spin_unlock_irqrestore(&scm_query_lock, flags);
+
+-static inline enum qcom_scm_convention __get_convention(void)
+-{
+- if (unlikely(!has_queried))
+- __query_convention();
+ return qcom_scm_convention;
+ }
+
+@@ -1239,7 +1238,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ __scm = scm;
+ __scm->dev = &pdev->dev;
+
+- __query_convention();
++ __get_convention();
+
+ /*
+ * If requested enable "download mode", from this point on warmboot
+diff --git a/drivers/firmware/qcom_scm.h b/drivers/firmware/qcom_scm.h
+index 95cd1ac30ab0..632fe3142462 100644
+--- a/drivers/firmware/qcom_scm.h
++++ b/drivers/firmware/qcom_scm.h
+@@ -61,8 +61,11 @@ struct qcom_scm_res {
+ };
+
+ #define SCM_SMC_FNID(s, c) ((((s) & 0xFF) << 8) | ((c) & 0xFF))
+-extern int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
+- struct qcom_scm_res *res, bool atomic);
++extern int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
++ enum qcom_scm_convention qcom_convention,
++ struct qcom_scm_res *res, bool atomic);
++#define scm_smc_call(dev, desc, res, atomic) \
++ __scm_smc_call((dev), (desc), qcom_scm_convention, (res), (atomic))
+
+ #define SCM_LEGACY_FNID(s, c) (((s) << 10) | ((c) & 0x3ff))
+ extern int scm_legacy_call_atomic(struct device *dev,
+--
+2.30.2
+
--- /dev/null
+From 08a44b9a8971c3235c7679231e7a9822e6379e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 13:45:36 -0800
+Subject: firmware: qcom_scm: Workaround lack of "is available" call on SC7180
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 257f2935cbbf14b16912c635fcd8ff43345c953b ]
+
+Some SC7180 firmwares don't implement the QCOM_SCM_INFO_IS_CALL_AVAIL
+API, so we can't probe the calling convention. We detect the legacy
+calling convention on these firmwares, because the availability call
+always fails and legacy is the fallback. This leads to problems where
+the rmtfs driver fails to probe, because it tries to assign memory with
+a bad calling convention, which then leads to modem failing to load and
+all networking, even wifi, to fail. Ouch!
+
+Let's force the calling convention to be what it always is on this SoC,
+i.e. arm64. Of course, the calling convention is not the same thing as
+implementing the QCOM_SCM_INFO_IS_CALL_AVAIL API. The absence of the "is
+this call available" API from the firmware means that any call to
+__qcom_scm_is_call_available() fails. This is OK for now though because
+none of the calls that are checked for existence are implemented on
+firmware running on sc7180. If such a call needs to be checked for
+existence in the future, we presume that firmware will implement this
+API and then things will "just work".
+
+Cc: Elliot Berman <eberman@codeaurora.org>
+Cc: Brian Masney <masneyb@onstation.org>
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Cc: Jeffrey Hugo <jhugo@codeaurora.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Fixes: 9a434cee773a ("firmware: qcom_scm: Dynamically support SMCCC and legacy conventions")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210223214539.1336155-4-swboyd@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 21e07a464bd9..9ac84b5d6ce0 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -131,6 +131,7 @@ static enum qcom_scm_convention __get_convention(void)
+ struct qcom_scm_res res;
+ enum qcom_scm_convention probed_convention;
+ int ret;
++ bool forced = false;
+
+ if (likely(qcom_scm_convention != SMC_CONVENTION_UNKNOWN))
+ return qcom_scm_convention;
+@@ -144,6 +145,18 @@ static enum qcom_scm_convention __get_convention(void)
+ if (!ret && res.result[0] == 1)
+ goto found;
+
++ /*
++ * Some SC7180 firmwares didn't implement the
++ * QCOM_SCM_INFO_IS_CALL_AVAIL call, so we fallback to forcing ARM_64
++ * calling conventions on these firmwares. Luckily we don't make any
++ * early calls into the firmware on these SoCs so the device pointer
++ * will be valid here to check if the compatible matches.
++ */
++ if (of_device_is_compatible(__scm ? __scm->dev->of_node : NULL, "qcom,scm-sc7180")) {
++ forced = true;
++ goto found;
++ }
++
+ probed_convention = SMC_CONVENTION_ARM_32;
+ ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true);
+ if (!ret && res.result[0] == 1)
+@@ -154,8 +167,9 @@ found:
+ spin_lock_irqsave(&scm_query_lock, flags);
+ if (probed_convention != qcom_scm_convention) {
+ qcom_scm_convention = probed_convention;
+- pr_info("qcom_scm: convention: %s\n",
+- qcom_scm_convention_names[qcom_scm_convention]);
++ pr_info("qcom_scm: convention: %s%s\n",
++ qcom_scm_convention_names[qcom_scm_convention],
++ forced ? " (forced)" : "");
+ }
+ spin_unlock_irqrestore(&scm_query_lock, flags);
+
+--
+2.30.2
+
--- /dev/null
+From 1ac82d23ebdd8f573ac52c38c4c40bbbaeff168a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Feb 2021 22:31:23 -0800
+Subject: firmware: xilinx: Fix dereferencing freed memory
+
+From: Tejas Patel <tejas.patel@xilinx.com>
+
+[ Upstream commit f1f21bece82c76a56a96988ec7d51ccc033d8949 ]
+
+Fix smatch warning:
+drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove()
+error: dereferencing freed memory 'feature_data'
+
+Use hash_for_each_safe for safe removal of hash entry.
+
+Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Tejas Patel <tejas.patel@xilinx.com>
+Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
+Link: https://lore.kernel.org/r/1612765883-22018-1-git-send-email-rajan.vaja@xilinx.com
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/xilinx/zynqmp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c
+index 7eb9958662dd..83082e2f2e44 100644
+--- a/drivers/firmware/xilinx/zynqmp.c
++++ b/drivers/firmware/xilinx/zynqmp.c
+@@ -2,7 +2,7 @@
+ /*
+ * Xilinx Zynq MPSoC Firmware layer
+ *
+- * Copyright (C) 2014-2020 Xilinx, Inc.
++ * Copyright (C) 2014-2021 Xilinx, Inc.
+ *
+ * Michal Simek <michal.simek@xilinx.com>
+ * Davorin Mista <davorin.mista@aggios.com>
+@@ -1280,12 +1280,13 @@ static int zynqmp_firmware_probe(struct platform_device *pdev)
+ static int zynqmp_firmware_remove(struct platform_device *pdev)
+ {
+ struct pm_api_feature_data *feature_data;
++ struct hlist_node *tmp;
+ int i;
+
+ mfd_remove_devices(&pdev->dev);
+ zynqmp_pm_api_debugfs_exit();
+
+- hash_for_each(pm_api_features_map, i, feature_data, hentry) {
++ hash_for_each_safe(pm_api_features_map, i, tmp, feature_data, hentry) {
+ hash_del(&feature_data->hentry);
+ kfree(feature_data);
+ }
+--
+2.30.2
+
--- /dev/null
+From dd9596120b8fbbb1a6b7447e02fffb92b45c479c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 00:58:49 +0900
+Subject: firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in
+ IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
+
+From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+
+[ Upstream commit 79bfe480a0a0b259ab9fddcd2fe52c03542b1196 ]
+
+zynqmp_pm_get_eemi_ops() was removed in commit 4db8180ffe7c: "Firmware: xilinx:
+Remove eemi ops for fpga related APIs", but not in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE).
+Any driver who want to communicate with PMC using EEMI APIs use the functions provided
+for each function
+This removed zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE), and also
+modify the documentation for this driver.
+
+Fixes: 4db8180ffe7c ("firmware: xilinx: Remove eemi ops for fpga related APIs")
+Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Link: https://lore.kernel.org/r/20210215155849.2425846-1-iwamatsu@nigauri.org
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/driver-api/xilinx/eemi.rst | 31 ++----------------------
+ include/linux/firmware/xlnx-zynqmp.h | 5 ----
+ 2 files changed, 2 insertions(+), 34 deletions(-)
+
+diff --git a/Documentation/driver-api/xilinx/eemi.rst b/Documentation/driver-api/xilinx/eemi.rst
+index 9dcbc6f18d75..c1bc47b9000d 100644
+--- a/Documentation/driver-api/xilinx/eemi.rst
++++ b/Documentation/driver-api/xilinx/eemi.rst
+@@ -16,35 +16,8 @@ components running across different processing clusters on a chip or
+ device to communicate with a power management controller (PMC) on a
+ device to issue or respond to power management requests.
+
+-EEMI ops is a structure containing all eemi APIs supported by Zynq MPSoC.
+-The zynqmp-firmware driver maintain all EEMI APIs in zynqmp_eemi_ops
+-structure. Any driver who want to communicate with PMC using EEMI APIs
+-can call zynqmp_pm_get_eemi_ops().
+-
+-Example of EEMI ops::
+-
+- /* zynqmp-firmware driver maintain all EEMI APIs */
+- struct zynqmp_eemi_ops {
+- int (*get_api_version)(u32 *version);
+- int (*query_data)(struct zynqmp_pm_query_data qdata, u32 *out);
+- };
+-
+- static const struct zynqmp_eemi_ops eemi_ops = {
+- .get_api_version = zynqmp_pm_get_api_version,
+- .query_data = zynqmp_pm_query_data,
+- };
+-
+-Example of EEMI ops usage::
+-
+- static const struct zynqmp_eemi_ops *eemi_ops;
+- u32 ret_payload[PAYLOAD_ARG_CNT];
+- int ret;
+-
+- eemi_ops = zynqmp_pm_get_eemi_ops();
+- if (IS_ERR(eemi_ops))
+- return PTR_ERR(eemi_ops);
+-
+- ret = eemi_ops->query_data(qdata, ret_payload);
++Any driver who wants to communicate with PMC using EEMI APIs use the
++functions provided for each function.
+
+ IOCTL
+ ------
+diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h
+index 71177b17eee5..66e2423d9feb 100644
+--- a/include/linux/firmware/xlnx-zynqmp.h
++++ b/include/linux/firmware/xlnx-zynqmp.h
+@@ -354,11 +354,6 @@ int zynqmp_pm_read_pggs(u32 index, u32 *value);
+ int zynqmp_pm_system_shutdown(const u32 type, const u32 subtype);
+ int zynqmp_pm_set_boot_health_status(u32 value);
+ #else
+-static inline struct zynqmp_eemi_ops *zynqmp_pm_get_eemi_ops(void)
+-{
+- return ERR_PTR(-ENODEV);
+-}
+-
+ static inline int zynqmp_pm_get_api_version(u32 *version)
+ {
+ return -ENODEV;
+--
+2.30.2
+
--- /dev/null
+From 0cf22da51e324817b777990f158c2249555775ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:15 +0100
+Subject: fotg210-udc: Complete OUT requests on short packets
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ]
+
+A short packet indicates the end of a transfer and marks the request as
+complete.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 9925d7ac9138..75bf446f4a66 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -849,12 +849,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
+ {
+ struct fotg210_request *req = list_entry(ep->queue.next,
+ struct fotg210_request, queue);
++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
+
+ fotg210_start_dma(ep, req);
+
+- /* finish out transfer */
++ /* Complete the request when it's full or a short packet arrived.
++ * Like other drivers, short_not_ok isn't handled.
++ */
++
+ if (req->req.length == req->req.actual ||
+- req->req.actual < ep->ep.maxpacket)
++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
+ fotg210_done(ep, req, 0);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 8306b0102a4e1c292e6a3dc8e7dcdaa92a785c71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:14 +0100
+Subject: fotg210-udc: Don't DMA more than the buffer can take
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ]
+
+Before this, it wrote as much as available into the buffer, even if it
+didn't fit.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index bbcc92376307..9925d7ac9138 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -338,8 +338,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
+ } else {
+ buffer = req->req.buf + req->req.actual;
+ length = ioread32(ep->fotg210->reg +
+- FOTG210_FIBCR(ep->epnum - 1));
+- length &= FIBCR_BCFX;
++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
++ if (length > req->req.length - req->req.actual)
++ length = req->req.length - req->req.actual;
+ }
+ } else {
+ buffer = req->req.buf + req->req.actual;
+--
+2.30.2
+
--- /dev/null
+From 72a9f558c63e32c1144fc98c72b51a697122e0cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:09 +0100
+Subject: fotg210-udc: Fix DMA on EP0 for length > max packet size
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ]
+
+For a 75 Byte request, it would send the first 64 separately, then detect
+that the remaining 11 Byte fit into a single DMA, but due to this bug set
+the length to the original 75 Bytes. This leads to a DMA failure (which is
+ignored...) and the request completes without the remaining bytes having
+been sent.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index d6ca50f01985..39260007ebf8 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -346,7 +346,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
+ if (req->req.length - req->req.actual > ep->ep.maxpacket)
+ length = ep->ep.maxpacket;
+ else
+- length = req->req.length;
++ length = req->req.length - req->req.actual;
+ }
+
+ d = dma_map_single(dev, buffer, length,
+--
+2.30.2
+
--- /dev/null
+From e8917fbe815f06d5e68e0503aafcf326037e5da0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:10 +0100
+Subject: fotg210-udc: Fix EP0 IN requests bigger than two packets
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ]
+
+For a 134 Byte packet, it sends the first two 64 Byte packets just fine,
+but then notice that less than a packet is remaining and call fotg210_done
+without actually sending the rest.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 39260007ebf8..345827cf1b64 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -820,7 +820,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210)
+ if (req->req.length)
+ fotg210_start_dma(ep, req);
+
+- if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
++ if (req->req.actual == req->req.length)
+ fotg210_done(ep, req, 0);
+ } else {
+ fotg210_set_cxdone(fotg210);
+--
+2.30.2
+
--- /dev/null
+From fd6be2e1aa33245eed64e9ded49e64a92f2fa55e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:12 +0100
+Subject: fotg210-udc: Mask GRP2 interrupts we don't handle
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ]
+
+Currently it leaves unhandled interrupts unmasked, but those are never
+acked. In the case of a "device idle" interrupt, this leads to an
+effectively frozen system until plugging it in.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index a3ad93bfd256..bbcc92376307 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -1026,6 +1026,12 @@ static void fotg210_init(struct fotg210_udc *fotg210)
+ value &= ~DMCR_GLINT_EN;
+ iowrite32(value, fotg210->reg + FOTG210_DMCR);
+
++ /* enable only grp2 irqs we handle */
++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
++ fotg210->reg + FOTG210_DMISGR2);
++
+ /* disable all fifo interrupt */
+ iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
+
+--
+2.30.2
+
--- /dev/null
+From 5449301ffe0b146f5cda4ac8ba5cee2bfb2457ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:11 +0100
+Subject: fotg210-udc: Remove a dubious condition leading to fotg210_done
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ]
+
+When the EP0 IN request was not completed but less than a packet sent,
+it would complete the request successfully. That doesn't make sense
+and can't really happen as fotg210_start_dma always sends
+min(length, maxpkt) bytes.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 345827cf1b64..a3ad93bfd256 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -379,8 +379,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep,
+ }
+ if (ep->dir_in) { /* if IN */
+ fotg210_start_dma(ep, req);
+- if ((req->req.length == req->req.actual) ||
+- (req->req.actual < ep->ep.maxpacket))
++ if (req->req.length == req->req.actual)
+ fotg210_done(ep, req, 0);
+ } else { /* OUT */
+ u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);
+--
+2.30.2
+
--- /dev/null
+From 1ad11e5315c7fd62fd847e5666be118aeb038709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 13:13:13 +0100
+Subject: fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
+
+From: Luca Ceresoli <luca@lucaceresoli.net>
+
+[ Upstream commit 484a58607a808c3721917f5ca5fba7eff809e4df ]
+
+The current code produces an error message on devm_gpiod_get() errors even
+when the error is -EPROBE_DEFER, which should be silent.
+
+This has been observed producing a significant amount of messages like:
+
+ xlnx-slave-spi spi1.1: Failed to get PROGRAM_B gpio: -517
+
+Fix and simplify code by using the dev_err_probe() helper function.
+
+Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
+Fixes: dd2784c01d93 ("fpga manager: xilinx-spi: check INIT_B pin during write_init")
+Fixes: 061c97d13f1a ("fpga manager: Add Xilinx slave serial SPI driver")
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/xilinx-spi.c | 24 +++++++++---------------
+ 1 file changed, 9 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/fpga/xilinx-spi.c b/drivers/fpga/xilinx-spi.c
+index 27defa98092d..fee4d0abf6bf 100644
+--- a/drivers/fpga/xilinx-spi.c
++++ b/drivers/fpga/xilinx-spi.c
+@@ -233,25 +233,19 @@ static int xilinx_spi_probe(struct spi_device *spi)
+
+ /* PROGRAM_B is active low */
+ conf->prog_b = devm_gpiod_get(&spi->dev, "prog_b", GPIOD_OUT_LOW);
+- if (IS_ERR(conf->prog_b)) {
+- dev_err(&spi->dev, "Failed to get PROGRAM_B gpio: %ld\n",
+- PTR_ERR(conf->prog_b));
+- return PTR_ERR(conf->prog_b);
+- }
++ if (IS_ERR(conf->prog_b))
++ return dev_err_probe(&spi->dev, PTR_ERR(conf->prog_b),
++ "Failed to get PROGRAM_B gpio\n");
+
+ conf->init_b = devm_gpiod_get_optional(&spi->dev, "init-b", GPIOD_IN);
+- if (IS_ERR(conf->init_b)) {
+- dev_err(&spi->dev, "Failed to get INIT_B gpio: %ld\n",
+- PTR_ERR(conf->init_b));
+- return PTR_ERR(conf->init_b);
+- }
++ if (IS_ERR(conf->init_b))
++ return dev_err_probe(&spi->dev, PTR_ERR(conf->init_b),
++ "Failed to get INIT_B gpio\n");
+
+ conf->done = devm_gpiod_get(&spi->dev, "done", GPIOD_IN);
+- if (IS_ERR(conf->done)) {
+- dev_err(&spi->dev, "Failed to get DONE gpio: %ld\n",
+- PTR_ERR(conf->done));
+- return PTR_ERR(conf->done);
+- }
++ if (IS_ERR(conf->done))
++ return dev_err_probe(&spi->dev, PTR_ERR(conf->done),
++ "Failed to get DONE gpio\n");
+
+ mgr = devm_fpga_mgr_create(&spi->dev,
+ "Xilinx Slave Serial FPGA Manager",
+--
+2.30.2
+
--- /dev/null
+From dc701e8dbe0bb0de8ccfed699ac6585b7fde3faf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 16:37:04 +0800
+Subject: fs: dlm: fix missing unlock on error in accept_from_sock()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 2fd8db2dd05d895961c7c7b9fa02d72f385560e4 ]
+
+Add the missing unlock before return from accept_from_sock()
+in the error handling case.
+
+Fixes: 6cde210a9758 ("fs: dlm: add helper for init connection")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lowcomms.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
+index 372c34ff8594..f7d2c52791f8 100644
+--- a/fs/dlm/lowcomms.c
++++ b/fs/dlm/lowcomms.c
+@@ -908,6 +908,7 @@ static int accept_from_sock(struct listen_connection *con)
+ result = dlm_con_init(othercon, nodeid);
+ if (result < 0) {
+ kfree(othercon);
++ mutex_unlock(&newcon->sock_mutex);
+ goto accept_err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 6fc8de59d845cc360e789072c8330c9177fad1fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 15:05:14 +0000
+Subject: fuse: fix matching of FUSE_DEV_IOC_CLONE command
+
+From: Alessio Balsini <balsini@android.com>
+
+[ Upstream commit 6076f5f341e612152879bfda99f0b76c1953bf0b ]
+
+With commit f8425c939663 ("fuse: 32-bit user space ioctl compat for fuse
+device") the matching constraints for the FUSE_DEV_IOC_CLONE ioctl command
+are relaxed, limited to the testing of command type and number. As Arnd
+noticed, this is wrong as it wouldn't ensure the correctness of the data
+size or direction for the received FUSE device ioctl.
+
+Fix by bringing back the comparison of the ioctl received by the FUSE
+device to the originally generated FUSE_DEV_IOC_CLONE.
+
+Fixes: f8425c939663 ("fuse: 32-bit user space ioctl compat for fuse device")
+Reported-by: Arnd Bergmann <arnd@kernel.org>
+Signed-off-by: Alessio Balsini <balsini@android.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dev.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index c0fee830a34e..a5ceccc5ef00 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -2233,11 +2233,8 @@ static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
+ int oldfd;
+ struct fuse_dev *fud = NULL;
+
+- if (_IOC_TYPE(cmd) != FUSE_DEV_IOC_MAGIC)
+- return -ENOTTY;
+-
+- switch (_IOC_NR(cmd)) {
+- case _IOC_NR(FUSE_DEV_IOC_CLONE):
++ switch (cmd) {
++ case FUSE_DEV_IOC_CLONE:
+ res = -EFAULT;
+ if (!get_user(oldfd, (__u32 __user *)arg)) {
+ struct file *old = fget(oldfd);
+--
+2.30.2
+
--- /dev/null
+From b516e2c35a5b075368e8764c60a0bc7e1759192a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 09:19:02 +0100
+Subject: gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 9c7d24693d864f90b27aad5d15fbfe226c02898b ]
+
+The current code doesn't check if GPIOLIB_IRQCHIP is enabled, which results in
+a compilation error when trying to build gpio-regmap if CONFIG_GPIOLIB_IRQCHIP
+isn't enabled.
+
+Fixes: 6a45b0e2589f ("gpiolib: Introduce gpiochip_irqchip_add_domain()")
+Suggested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Link: https://lore.kernel.org/r/20210324081923.20379-2-noltari@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/driver.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
+index 286de0520574..ecf0032a0995 100644
+--- a/include/linux/gpio/driver.h
++++ b/include/linux/gpio/driver.h
+@@ -624,8 +624,17 @@ void gpiochip_irq_domain_deactivate(struct irq_domain *domain,
+ bool gpiochip_irqchip_irq_valid(const struct gpio_chip *gc,
+ unsigned int offset);
+
++#ifdef CONFIG_GPIOLIB_IRQCHIP
+ int gpiochip_irqchip_add_domain(struct gpio_chip *gc,
+ struct irq_domain *domain);
++#else
++static inline int gpiochip_irqchip_add_domain(struct gpio_chip *gc,
++ struct irq_domain *domain)
++{
++ WARN_ON(1);
++ return -EINVAL;
++}
++#endif
+
+ int gpiochip_generic_request(struct gpio_chip *gc, unsigned int offset);
+ void gpiochip_generic_free(struct gpio_chip *gc, unsigned int offset);
+--
+2.30.2
+
--- /dev/null
+From 5c72d2d30a9ba450dc061310bb7d9527161333d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 12:53:06 +0000
+Subject: gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 ]
+
+Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment")
+did the right thing, but missed the fact that napi_gro_frags() logics
+calls for skb_gro_reset_offset() *before* pulling Ethernet header
+to the skb linear space.
+That said, the introduced check for frag0 address being aligned to 4
+always fails for it as Ethernet header is obviously 14 bytes long,
+and in case with NET_IP_ALIGN its start is not aligned to 4.
+
+Fix this by adding @nhoff argument to skb_gro_reset_offset() which
+tells if an IP header is placed right at the start of frag0 or not.
+This restores Fast GRO for napi_gro_frags() that became very slow
+after the mentioned commit, and preserves the introduced check to
+avoid silent unaligned accesses.
+
+From v1 [0]:
+ - inline tiny skb_gro_reset_offset() to let the code be optimized
+ more efficively (esp. for the !NET_IP_ALIGN case) (Eric);
+ - pull in Reviewed-by from Eric.
+
+[0] https://lore.kernel.org/netdev/20210418114200.5839-1-alobakin@pm.me
+
+Fixes: 38ec4944b593 ("gro: ensure frag0 meets IP header alignment")
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1f79b9aa9a3f..15fe36332fb8 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5914,7 +5914,7 @@ static struct list_head *gro_list_prepare(struct napi_struct *napi,
+ return head;
+ }
+
+-static void skb_gro_reset_offset(struct sk_buff *skb)
++static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff)
+ {
+ const struct skb_shared_info *pinfo = skb_shinfo(skb);
+ const skb_frag_t *frag0 = &pinfo->frags[0];
+@@ -5925,7 +5925,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
+
+ if (!skb_headlen(skb) && pinfo->nr_frags &&
+ !PageHighMem(skb_frag_page(frag0)) &&
+- (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
++ (!NET_IP_ALIGN || !((skb_frag_off(frag0) + nhoff) & 3))) {
+ NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
+ NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
+ skb_frag_size(frag0),
+@@ -6143,7 +6143,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+ skb_mark_napi_id(skb, napi);
+ trace_napi_gro_receive_entry(skb);
+
+- skb_gro_reset_offset(skb);
++ skb_gro_reset_offset(skb, 0);
+
+ ret = napi_skb_finish(napi, skb, dev_gro_receive(napi, skb));
+ trace_napi_gro_receive_exit(ret);
+@@ -6232,7 +6232,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+ napi->skb = NULL;
+
+ skb_reset_mac_header(skb);
+- skb_gro_reset_offset(skb);
++ skb_gro_reset_offset(skb, hlen);
+
+ if (unlikely(skb_gro_header_hard(skb, hlen))) {
+ eth = skb_gro_header_slow(skb, hlen, 0);
+--
+2.30.2
+
--- /dev/null
+From d3aa0271eed0ece82f7f7581df789240dcec3fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 10:04:26 +0200
+Subject: HID: lenovo: Check hid_get_drvdata() returns non NULL in
+ lenovo_event()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 34348a8661e3cd67dcf6938f08c8bb77522301f7 ]
+
+The HID lenovo probe function only attaches drvdata to one of the
+USB interfaces, but lenovo_event() will get called for all USB interfaces
+to which hid-lenovo is bound.
+
+This allows a malicious device to fake being a device handled by
+hid-lenovo, which generates events for which lenovo_event() has
+special handling (and thus dereferences hid_get_drvdata()) on another
+interface triggering a NULL pointer exception.
+
+Add a check for hid_get_drvdata() returning NULL, avoiding this
+possible NULL pointer exception.
+
+Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index ee175ab54281..b2596ed37880 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -508,6 +508,9 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,
+ static int lenovo_event(struct hid_device *hdev, struct hid_field *field,
+ struct hid_usage *usage, __s32 value)
+ {
++ if (!hid_get_drvdata(hdev))
++ return 0;
++
+ switch (hdev->product) {
+ case USB_DEVICE_ID_LENOVO_CUSBKBD:
+ case USB_DEVICE_ID_LENOVO_CBTKBD:
+--
+2.30.2
+
--- /dev/null
+From 70dcb882ff69b13ab0458dbb4225f66ae2809f4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 10:04:25 +0200
+Subject: HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 658d04e6eb6be1601ae95d7bee92bbf4096cdc1e ]
+
+Fix the following issues with lenovo_led_set_tp10ubkbd() error handling:
+
+1. On success hid_hw_raw_request() returns the number of bytes sent.
+ So we should check for (ret != 3) rather then for (ret != 0).
+
+2. Actually propagate errors to the caller.
+
+3. Since the LEDs are part of an USB keyboard-dock the mute LEDs can go
+ away at any time. Don't log an error when ret == -ENODEV and set the
+ LED_HW_PLUGGABLE flag to avoid errors getting logged when the USB gets
+ disconnected.
+
+Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 4dc5e5f932ed..ee175ab54281 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -62,8 +62,8 @@ struct lenovo_drvdata {
+ #define TP10UBKBD_LED_OFF 1
+ #define TP10UBKBD_LED_ON 2
+
+-static void lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code,
+- enum led_brightness value)
++static int lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code,
++ enum led_brightness value)
+ {
+ struct lenovo_drvdata *data = hid_get_drvdata(hdev);
+ int ret;
+@@ -75,10 +75,18 @@ static void lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code,
+ data->led_report[2] = value ? TP10UBKBD_LED_ON : TP10UBKBD_LED_OFF;
+ ret = hid_hw_raw_request(hdev, data->led_report[0], data->led_report, 3,
+ HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
+- if (ret)
+- hid_err(hdev, "Set LED output report error: %d\n", ret);
++ if (ret != 3) {
++ if (ret != -ENODEV)
++ hid_err(hdev, "Set LED output report error: %d\n", ret);
++
++ ret = ret < 0 ? ret : -EIO;
++ } else {
++ ret = 0;
++ }
+
+ mutex_unlock(&data->led_report_mutex);
++
++ return ret;
+ }
+
+ static void lenovo_tp10ubkbd_sync_fn_lock(struct work_struct *work)
+@@ -349,7 +357,7 @@ static ssize_t attr_fn_lock_store(struct device *dev,
+ {
+ struct hid_device *hdev = to_hid_device(dev);
+ struct lenovo_drvdata *data = hid_get_drvdata(hdev);
+- int value;
++ int value, ret;
+
+ if (kstrtoint(buf, 10, &value))
+ return -EINVAL;
+@@ -364,7 +372,9 @@ static ssize_t attr_fn_lock_store(struct device *dev,
+ lenovo_features_set_cptkbd(hdev);
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+- lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value);
++ ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value);
++ if (ret)
++ return ret;
+ break;
+ }
+
+@@ -785,6 +795,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ struct lenovo_drvdata *data_pointer = hid_get_drvdata(hdev);
+ u8 tp10ubkbd_led[] = { TP10UBKBD_MUTE_LED, TP10UBKBD_MICMUTE_LED };
+ int led_nr = 0;
++ int ret = 0;
+
+ if (led_cdev == &data_pointer->led_micmute)
+ led_nr = 1;
+@@ -799,11 +810,11 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ lenovo_led_set_tpkbd(hdev);
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+- lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
++ ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static int lenovo_register_leds(struct hid_device *hdev)
+@@ -825,6 +836,7 @@ static int lenovo_register_leds(struct hid_device *hdev)
+ data->led_mute.name = name_mute;
+ data->led_mute.brightness_get = lenovo_led_brightness_get;
+ data->led_mute.brightness_set_blocking = lenovo_led_brightness_set;
++ data->led_mute.flags = LED_HW_PLUGGABLE;
+ data->led_mute.dev = &hdev->dev;
+ ret = led_classdev_register(&hdev->dev, &data->led_mute);
+ if (ret < 0)
+@@ -833,6 +845,7 @@ static int lenovo_register_leds(struct hid_device *hdev)
+ data->led_micmute.name = name_micm;
+ data->led_micmute.brightness_get = lenovo_led_brightness_get;
+ data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set;
++ data->led_micmute.flags = LED_HW_PLUGGABLE;
+ data->led_micmute.dev = &hdev->dev;
+ ret = led_classdev_register(&hdev->dev, &data->led_micmute);
+ if (ret < 0) {
+--
+2.30.2
+
--- /dev/null
+From 2c8a7d3c6ed5dd6ea01ec030a3b32d3164372a78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 10:04:29 +0200
+Subject: HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 617103246cfd19af837e4cb614ba9f877c4f7779 ]
+
+Mapping the mic-mute button to KEY_MICMUTE is technically correct but
+KEY_MICMUTE translates to a scancode of 256 (248 + 8) under X,
+which does not fit in 8 bits, so it does not work.
+
+Because of this userspace is expecting KEY_F20 instead,
+theoretically KEY_MICMUTE should work under Wayland but even
+there it does not work, because the desktop-environment is
+listening only for KEY_F20 and not for KEY_MICMUTE.
+
+Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index b2596ed37880..0ff03fed9770 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -33,6 +33,9 @@
+
+ #include "hid-ids.h"
+
++/* Userspace expects F20 for mic-mute KEY_MICMUTE does not work */
++#define LENOVO_KEY_MICMUTE KEY_F20
++
+ struct lenovo_drvdata {
+ u8 led_report[3]; /* Must be first for proper alignment */
+ int led_state;
+@@ -134,7 +137,7 @@ static int lenovo_input_mapping_tpkbd(struct hid_device *hdev,
+ if (usage->hid == (HID_UP_BUTTON | 0x0010)) {
+ /* This sub-device contains trackpoint, mark it */
+ hid_set_drvdata(hdev, (void *)1);
+- map_key_clear(KEY_MICMUTE);
++ map_key_clear(LENOVO_KEY_MICMUTE);
+ return 1;
+ }
+ return 0;
+@@ -149,7 +152,7 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev,
+ (usage->hid & HID_USAGE_PAGE) == HID_UP_LNVENDOR) {
+ switch (usage->hid & HID_USAGE) {
+ case 0x00f1: /* Fn-F4: Mic mute */
+- map_key_clear(KEY_MICMUTE);
++ map_key_clear(LENOVO_KEY_MICMUTE);
+ return 1;
+ case 0x00f2: /* Fn-F5: Brightness down */
+ map_key_clear(KEY_BRIGHTNESSDOWN);
+@@ -239,7 +242,7 @@ static int lenovo_input_mapping_tp10_ultrabook_kbd(struct hid_device *hdev,
+ map_key_clear(KEY_FN_ESC);
+ return 1;
+ case 9: /* Fn-F4: Mic mute */
+- map_key_clear(KEY_MICMUTE);
++ map_key_clear(LENOVO_KEY_MICMUTE);
+ return 1;
+ case 10: /* Fn-F7: Control panel */
+ map_key_clear(KEY_CONFIG);
+--
+2.30.2
+
--- /dev/null
+From 565ec49ce9f75588c71526797e99bbf6cbade54a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 10:04:24 +0200
+Subject: HID: lenovo: Use brightness_set_blocking callback for setting LEDs
+ brightness
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit bbf62645255f120bc2e7488c237e3f04da42ec70 ]
+
+The lenovo_led_brightness_set function may sleep, so we should have the
+the led_class_dev's brightness_set_blocking callback point to it, rather
+then the regular brightness_set callback.
+
+When toggled through sysfs this is not a problem, but the brightness_set
+callback may be called from atomic context when using LED-triggers.
+
+Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index c6c8e20f3e8d..4dc5e5f932ed 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -777,7 +777,7 @@ static enum led_brightness lenovo_led_brightness_get(
+ : LED_OFF;
+ }
+
+-static void lenovo_led_brightness_set(struct led_classdev *led_cdev,
++static int lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ enum led_brightness value)
+ {
+ struct device *dev = led_cdev->dev->parent;
+@@ -802,6 +802,8 @@ static void lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
+ break;
+ }
++
++ return 0;
+ }
+
+ static int lenovo_register_leds(struct hid_device *hdev)
+@@ -822,7 +824,7 @@ static int lenovo_register_leds(struct hid_device *hdev)
+
+ data->led_mute.name = name_mute;
+ data->led_mute.brightness_get = lenovo_led_brightness_get;
+- data->led_mute.brightness_set = lenovo_led_brightness_set;
++ data->led_mute.brightness_set_blocking = lenovo_led_brightness_set;
+ data->led_mute.dev = &hdev->dev;
+ ret = led_classdev_register(&hdev->dev, &data->led_mute);
+ if (ret < 0)
+@@ -830,7 +832,7 @@ static int lenovo_register_leds(struct hid_device *hdev)
+
+ data->led_micmute.name = name_micm;
+ data->led_micmute.brightness_get = lenovo_led_brightness_get;
+- data->led_micmute.brightness_set = lenovo_led_brightness_set;
++ data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set;
+ data->led_micmute.dev = &hdev->dev;
+ ret = led_classdev_register(&hdev->dev, &data->led_micmute);
+ if (ret < 0) {
+--
+2.30.2
+
--- /dev/null
+From ba52a0846066a687d55349f89bd1d3828f827c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Feb 2021 16:47:40 +0200
+Subject: HID: plantronics: Workaround for double volume key presses
+
+From: Maxim Mikityanskiy <maxtram95@gmail.com>
+
+[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ]
+
+Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice
+for each volume key press. This patch adds a quirk to hid-plantronics
+for this product ID, which will ignore the second volume key press if
+it happens within 5 ms from the last one that was handled.
+
+The patch was tested on the mentioned model only, it shouldn't affect
+other models, however, this quirk might be needed for them too.
+Auto-repeat (when a key is held pressed) is not affected, because the
+rate is about 3 times per second, which is far less frequent than once
+in 5 ms.
+
+Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls")
+Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++--
+ include/linux/hid.h | 2 ++
+ 3 files changed, 61 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 67fd8a2f5aba..ba338973e968 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -946,6 +946,7 @@
+ #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003
+
+ #define USB_VENDOR_ID_PLANTRONICS 0x047f
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056
+
+ #define USB_VENDOR_ID_PANASONIC 0x04da
+ #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
+diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
+index 85b685efc12f..e81b7cec2d12 100644
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/hid.h>
+ #include <linux/module.h>
++#include <linux/jiffies.h>
+
+ #define PLT_HID_1_0_PAGE 0xffa00000
+ #define PLT_HID_2_0_PAGE 0xffa20000
+@@ -36,6 +37,16 @@
+ #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \
+ (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)
+
++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
++
++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
++
++struct plt_drv_data {
++ unsigned long device_type;
++ unsigned long last_volume_key_ts;
++ u32 quirks;
++};
++
+ static int plantronics_input_mapping(struct hid_device *hdev,
+ struct hid_input *hi,
+ struct hid_field *field,
+@@ -43,7 +54,8 @@ static int plantronics_input_mapping(struct hid_device *hdev,
+ unsigned long **bit, int *max)
+ {
+ unsigned short mapped_key;
+- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++ unsigned long plt_type = drv_data->device_type;
+
+ /* special case for PTT products */
+ if (field->application == HID_GD_JOYSTICK)
+@@ -105,6 +117,30 @@ mapped:
+ return 1;
+ }
+
++static int plantronics_event(struct hid_device *hdev, struct hid_field *field,
++ struct hid_usage *usage, __s32 value)
++{
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++
++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) {
++ unsigned long prev_ts, cur_ts;
++
++ /* Usages are filtered in plantronics_usages. */
++
++ if (!value) /* Handle key presses only. */
++ return 0;
++
++ prev_ts = drv_data->last_volume_key_ts;
++ cur_ts = jiffies;
++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT)
++ return 1; /* Ignore the repeated key. */
++
++ drv_data->last_volume_key_ts = cur_ts;
++ }
++
++ return 0;
++}
++
+ static unsigned long plantronics_device_type(struct hid_device *hdev)
+ {
+ unsigned i, col_page;
+@@ -133,15 +169,24 @@ exit:
+ static int plantronics_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
++ struct plt_drv_data *drv_data;
+ int ret;
+
++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
++ if (!drv_data)
++ return -ENOMEM;
++
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+ goto err;
+ }
+
+- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev));
++ drv_data->device_type = plantronics_device_type(hdev);
++ drv_data->quirks = id->driver_data;
++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT);
++
++ hid_set_drvdata(hdev, drv_data);
+
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT |
+ HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE);
+@@ -153,15 +198,26 @@ err:
+ }
+
+ static const struct hid_device_id plantronics_devices[] = {
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, plantronics_devices);
+
++static const struct hid_usage_id plantronics_usages[] = {
++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID },
++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID },
++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR }
++};
++
+ static struct hid_driver plantronics_driver = {
+ .name = "plantronics",
+ .id_table = plantronics_devices,
++ .usage_table = plantronics_usages,
+ .input_mapping = plantronics_input_mapping,
++ .event = plantronics_event,
+ .probe = plantronics_probe,
+ };
+ module_hid_driver(plantronics_driver);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index ef702b3f56e3..3e33eb14118c 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -262,6 +262,8 @@ struct hid_item {
+ #define HID_CP_SELECTION 0x000c0080
+ #define HID_CP_MEDIASELECTION 0x000c0087
+ #define HID_CP_SELECTDISC 0x000c00ba
++#define HID_CP_VOLUMEUP 0x000c00e9
++#define HID_CP_VOLUMEDOWN 0x000c00ea
+ #define HID_CP_PLAYBACKSPEED 0x000c00f1
+ #define HID_CP_PROXIMITY 0x000c0109
+ #define HID_CP_SPEAKERSYSTEM 0x000c0160
+--
+2.30.2
+
--- /dev/null
+From d3b4e973fa7f76d02d47a8367c66885dd655bd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:08:17 +0300
+Subject: HSI: core: fix resource leaks in hsi_add_client_from_dt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ]
+
+If some of the allocations fail between the dev_set_name() and the
+device_register() then the name will not be freed. Fix this by
+moving dev_set_name() directly in front of the call to device_register().
+
+Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/hsi_core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
+index c3fb5beb846e..ec90713564e3 100644
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -210,8 +210,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ if (err)
+ goto err;
+
+- dev_set_name(&cl->device, "%s", name);
+-
+ err = hsi_of_property_parse_mode(client, "hsi-mode", &mode);
+ if (err) {
+ err = hsi_of_property_parse_mode(client, "hsi-rx-mode",
+@@ -293,6 +291,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ cl->device.release = hsi_client_release;
+ cl->device.of_node = client;
+
++ dev_set_name(&cl->device, "%s", name);
+ if (device_register(&cl->device) < 0) {
+ pr_err("hsi: failed to register client: %s\n", name);
+ put_device(&cl->device);
+--
+2.30.2
+
--- /dev/null
+From 5318999249412e0f760e79fe32f5f0943bf18b28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 13:29:04 +0300
+Subject: hwmon: (pmbus/pxe1610) don't bail out when not all pages are active
+
+From: Paul Fertser <fercerpav@gmail.com>
+
+[ Upstream commit f025314306ae17a3fdaf2874d7e878ce19cea363 ]
+
+Certain VRs might be configured to use only the first output channel and
+so the mode for the second will be 0. Handle this gracefully.
+
+Fixes: b9fa0a3acfd8 ("hwmon: (pmbus/core) Add support for vid mode detection per page bases")
+Signed-off-by: Paul Fertser <fercerpav@gmail.com>
+Link: https://lore.kernel.org/r/20210416102926.13614-1-fercerpav@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index da27ce34ee3f..eb4a06003b7f 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -41,6 +41,15 @@ static int pxe1610_identify(struct i2c_client *client,
+ info->vrm_version[i] = vr13;
+ break;
+ default:
++ /*
++ * If prior pages are available limit operation
++ * to them
++ */
++ if (i != 0) {
++ info->pages = i;
++ return 0;
++ }
++
+ return -ENODEV;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From f2fbaf921952c344a12ffc2867e397d17d14cc4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:14:35 +0300
+Subject: i2c: cadence: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index e8eae8725900..c1bbc4caeb5c 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -1200,7 +1200,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
+ if (IS_ERR(id->membase))
+ return PTR_ERR(id->membase);
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++ id->irq = ret;
+
+ id->adap.owner = THIS_MODULE;
+ id->adap.dev.of_node = pdev->dev.of_node;
+--
+2.30.2
+
--- /dev/null
+From d4fdade351d6cf9365d0dd84537fb610081808bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:17 +0800
+Subject: i2c: cadence: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 ]
+
+The PM reference count is not expected to be incremented on
+return in functions cdns_i2c_master_xfer and cdns_reg_slave.
+
+However, pm_runtime_get_sync will increment pm usage counter
+even failed. Forgetting to putting operation will result in a
+reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 7fa32329ca03 ("i2c: cadence: Move to sensible power management")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index e4b7f2a951ad..e8eae8725900 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -789,7 +789,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ bool change_role = false;
+ #endif
+
+- ret = pm_runtime_get_sync(id->dev);
++ ret = pm_runtime_resume_and_get(id->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -911,7 +911,7 @@ static int cdns_reg_slave(struct i2c_client *slave)
+ if (slave->flags & I2C_CLIENT_TEN)
+ return -EAFNOSUPPORT;
+
+- ret = pm_runtime_get_sync(id->dev);
++ ret = pm_runtime_resume_and_get(id->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From ecdf106fba4ea7af2a408419d3265894b7162721 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:16:41 +0300
+Subject: i2c: emev2: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: 5faf6e1f58b4 ("i2c: emev2: add driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-emev2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index a08554c1a570..bdff0e6345d9 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -395,7 +395,10 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- priv->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_clk;
++ priv->irq = ret;
+ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 49a93de9afd897316a3f1bfafd7ba363a76d39b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:39 +0800
+Subject: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ]
+
+The PM reference count is not expected to be incremented on
+return in functions img_i2c_xfer and img_i2c_init.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 93222bd9b966 ("i2c: img-scb: Add runtime PM")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-img-scb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
+index 98a89301ed2a..8e987945ed45 100644
+--- a/drivers/i2c/busses/i2c-img-scb.c
++++ b/drivers/i2c/busses/i2c-img-scb.c
+@@ -1057,7 +1057,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ atomic = true;
+ }
+
+- ret = pm_runtime_get_sync(adap->dev.parent);
++ ret = pm_runtime_resume_and_get(adap->dev.parent);
+ if (ret < 0)
+ return ret;
+
+@@ -1158,7 +1158,7 @@ static int img_i2c_init(struct img_i2c *i2c)
+ u32 rev;
+ int ret;
+
+- ret = pm_runtime_get_sync(i2c->adap.dev.parent);
++ ret = pm_runtime_resume_and_get(i2c->adap.dev.parent);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 68ee5c90508415abed2dac7479cf73f2b9818c7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:41 +0800
+Subject: i2c: imx: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 47ff617217ca6a13194fcb35c6c3a0c57c080693 ]
+
+In i2c_imx_xfer() and i2c_imx_remove(), the pm reference count
+is not expected to be incremented on return.
+
+However, pm_runtime_get_sync will increment pm reference count
+even failed. Forgetting to putting operation will result in a
+reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 3a5ee18d2a32 ("i2c: imx: implement master_xfer_atomic callback")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index b80fdc1f0092..dc9c4b4cc25a 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1253,7 +1253,7 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter,
+ struct imx_i2c_struct *i2c_imx = i2c_get_adapdata(adapter);
+ int result;
+
+- result = pm_runtime_get_sync(i2c_imx->adapter.dev.parent);
++ result = pm_runtime_resume_and_get(i2c_imx->adapter.dev.parent);
+ if (result < 0)
+ return result;
+
+@@ -1496,7 +1496,7 @@ static int i2c_imx_remove(struct platform_device *pdev)
+ struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
+ int irq, ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From eceb6f49f03674035cf39008b00f589c1c552c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:40 +0800
+Subject: i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 ]
+
+The PM reference count is not expected to be incremented on
+return in lpi2c_imx_master_enable.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
+index 9db6ccded5e9..8b9ba055c418 100644
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -259,7 +259,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx)
+ unsigned int temp;
+ int ret;
+
+- ret = pm_runtime_get_sync(lpi2c_imx->adapter.dev.parent);
++ ret = pm_runtime_resume_and_get(lpi2c_imx->adapter.dev.parent);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 0fcc4d6753fbf498df9edddef2474d63dd0aa18a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:18:31 +0300
+Subject: i2c: jz4780: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-jz4780.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
+index 55177eb21d7b..baa7319eee53 100644
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -825,7 +825,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
+
+ jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0);
+
+- i2c->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err;
++ i2c->irq = ret;
+ ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0,
+ dev_name(&pdev->dev), i2c);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 2f7adcfdfae86fab8b839c1a34354ff2ee8c3816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Apr 2021 14:46:51 +0800
+Subject: i2c: mediatek: Fix wrong dma sync flag
+
+From: Qii Wang <qii.wang@mediatek.com>
+
+[ Upstream commit 3186b880447ad3cc9b6487fa626a71d64b831524 ]
+
+The right flag is apdma_sync when apdma remove hand-shake signel.
+
+Fixes: 05f6f7271a38 ("i2c: mediatek: Fix apdma and i2c hand-shake timeout")
+Signed-off-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 2ffd2f354d0a..86f70c751319 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -479,7 +479,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
+ {
+ u16 control_reg;
+
+- if (i2c->dev_comp->dma_sync) {
++ if (i2c->dev_comp->apdma_sync) {
+ writel(I2C_DMA_WARM_RST, i2c->pdmabase + OFFSET_RST);
+ udelay(10);
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST);
+--
+2.30.2
+
--- /dev/null
+From bf3b0193b90eefebe553816ff837c78adb2dc1ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:20:49 +0300
+Subject: i2c: mlxbf: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 0d3bf53e897dce943b98d975bbde77156af6cd81 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mlxbf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c
+index 2fb0532d8a16..ab261d762dea 100644
+--- a/drivers/i2c/busses/i2c-mlxbf.c
++++ b/drivers/i2c/busses/i2c-mlxbf.c
+@@ -2376,6 +2376,8 @@ static int mlxbf_i2c_probe(struct platform_device *pdev)
+ mlxbf_i2c_init_slave(pdev, priv);
+
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+ ret = devm_request_irq(dev, irq, mlxbf_smbus_irq,
+ IRQF_ONESHOT | IRQF_SHARED | IRQF_PROBE_SHARED,
+ dev_name(dev), priv);
+--
+2.30.2
+
--- /dev/null
+From 4849bb581ff89f1d2cdc24614fcf83c72d5fdacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:43 +0800
+Subject: i2c: omap: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 780f629741257ed6c54bd3eb53b57f648eabf200 ]
+
+The PM reference count is not expected to be incremented on
+return in omap_i2c_probe() and omap_i2c_remove().
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here. I Replace it with pm_runtime_resume_and_get
+to keep usage counter balanced.
+
+What's more, error path 'err_free_mem' seems not like a proper
+name any more. So I change the name to err_disable_pm and move
+pm_runtime_disable below, for pm_runtime of 'pdev->dev' should
+be disabled when pm_runtime_resume_and_get fails.
+
+Fixes: 3b0fb97c8dc4 ("I2C: OMAP: Handle error check for pm runtime")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-omap.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 12ac4212aded..d4f6c6d60683 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1404,9 +1404,9 @@ omap_i2c_probe(struct platform_device *pdev)
+ pm_runtime_set_autosuspend_delay(omap->dev, OMAP_I2C_PM_TIMEOUT);
+ pm_runtime_use_autosuspend(omap->dev);
+
+- r = pm_runtime_get_sync(omap->dev);
++ r = pm_runtime_resume_and_get(omap->dev);
+ if (r < 0)
+- goto err_free_mem;
++ goto err_disable_pm;
+
+ /*
+ * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
+@@ -1513,8 +1513,8 @@ err_unuse_clocks:
+ omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0);
+ pm_runtime_dont_use_autosuspend(omap->dev);
+ pm_runtime_put_sync(omap->dev);
++err_disable_pm:
+ pm_runtime_disable(&pdev->dev);
+-err_free_mem:
+
+ return r;
+ }
+@@ -1525,7 +1525,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
+ int ret;
+
+ i2c_del_adapter(&omap->adapter);
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From c2170ecdd61f604e2f9227a7158ba104f33579a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:23:33 +0300
+Subject: i2c: rcar: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 147178cf03a6dcb337e703d4dacd008683022a58 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with the
+invalid IRQ #s.
+
+Fixes: 6ccbe607132b ("i2c: add Renesas R-Car I2C driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 12f6d452c0f7..8722ca23f889 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -1027,7 +1027,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ if (of_property_read_bool(dev->of_node, "smbus"))
+ priv->flags |= ID_P_HOST_NOTIFY;
+
+- priv->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto out_pm_disable;
++ priv->irq = ret;
+ ret = devm_request_irq(dev, priv->irq, irqhandler, irqflags, dev_name(dev), priv);
+ if (ret < 0) {
+ dev_err(dev, "cannot get irq %d\n", priv->irq);
+--
+2.30.2
+
--- /dev/null
+From a18a261696bfbcf13abf867dc5e9d9a282b85e2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:25:10 +0300
+Subject: i2c: sh7760: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sh7760.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
+index c2005c789d2b..c79c9f542c5a 100644
+--- a/drivers/i2c/busses/i2c-sh7760.c
++++ b/drivers/i2c/busses/i2c-sh7760.c
+@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
+ goto out2;
+ }
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++ id->irq = ret;
+
+ id->adap.nr = pdev->id;
+ id->adap.algo = &sh7760_i2c_algo;
+--
+2.30.2
+
--- /dev/null
+From ef16ba145e50025f92b41658dcb831f126a005f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Apr 2021 22:05:05 +0300
+Subject: i2c: sh7760: fix IRQ error path
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]
+
+While adding the invalid IRQ check after calling platform_get_irq(),
+I managed to overlook that the driver has a complex error path in its
+probe() method, thus a simple *return* couldn't be used. Use a proper
+*goto* instead!
+
+Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sh7760.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
+index c79c9f542c5a..319d1fa617c8 100644
+--- a/drivers/i2c/busses/i2c-sh7760.c
++++ b/drivers/i2c/busses/i2c-sh7760.c
+@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
+
+ ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto out3;
+ id->irq = ret;
+
+ id->adap.nr = pdev->id;
+--
+2.30.2
+
--- /dev/null
+From 01906aa1cb313ce00f20db5c2ac31088a6bf72a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:44 +0800
+Subject: i2c: sprd: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 3a4f326463117cee3adcb72999ca34a9aaafda93 ]
+
+The PM reference count is not expected to be incremented on
+return in sprd_i2c_master_xfer() and sprd_i2c_remove().
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sprd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
+index 2917fecf6c80..8ead7e021008 100644
+--- a/drivers/i2c/busses/i2c-sprd.c
++++ b/drivers/i2c/busses/i2c-sprd.c
+@@ -290,7 +290,7 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,
+ struct sprd_i2c *i2c_dev = i2c_adap->algo_data;
+ int im, ret;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -576,7 +576,7 @@ static int sprd_i2c_remove(struct platform_device *pdev)
+ struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev);
+ int ret;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From c5145daf7abc5689e3691caf537b420f721402d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:45 +0800
+Subject: i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 2c662660ce2bd3b09dae21a9a9ac9395e1e6c00b ]
+
+The PM reference count is not expected to be incremented on
+return in these stm32f7_i2c_xx serious functions.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: ea6dd25deeb5 ("i2c: stm32f7: add PM_SLEEP suspend/resume support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index c62c815b88eb..318abfa7926b 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1652,7 +1652,7 @@ static int stm32f7_i2c_xfer(struct i2c_adapter *i2c_adap,
+ i2c_dev->msg_id = 0;
+ f7_msg->smbus = false;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -1698,7 +1698,7 @@ static int stm32f7_i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
+ f7_msg->read_write = read_write;
+ f7_msg->smbus = true;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+@@ -1799,7 +1799,7 @@ static int stm32f7_i2c_reg_slave(struct i2c_client *slave)
+ if (ret)
+ return ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+@@ -1880,7 +1880,7 @@ static int stm32f7_i2c_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!i2c_dev->slave[id]);
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -2273,7 +2273,7 @@ static int stm32f7_i2c_regs_backup(struct stm32f7_i2c_dev *i2c_dev)
+ int ret;
+ struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -2295,7 +2295,7 @@ static int stm32f7_i2c_regs_restore(struct stm32f7_i2c_dev *i2c_dev)
+ int ret;
+ struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From a2f69335a6f31fb21a42ee150f9b77b6f3ee71b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:46 +0800
+Subject: i2c: xiic: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit a85c5c7a3aa8041777ff691400b4046e56149fd3 ]
+
+The PM reference count is not expected to be incremented on
+return in xiic_xfer and xiic_i2c_remove.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 10b17004a74c ("i2c: xiic: Fix the clocking across bind unbind")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 087b2951942e..2a8568b97c14 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -706,7 +706,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ dev_dbg(adap->dev.parent, "%s entry SR: 0x%x\n", __func__,
+ xiic_getreg8(i2c, XIIC_SR_REG_OFFSET));
+
+- err = pm_runtime_get_sync(i2c->dev);
++ err = pm_runtime_resume_and_get(i2c->dev);
+ if (err < 0)
+ return err;
+
+@@ -873,7 +873,7 @@ static int xiic_i2c_remove(struct platform_device *pdev)
+ /* remove adapter & data */
+ i2c_del_adapter(&i2c->adap);
+
+- ret = pm_runtime_get_sync(i2c->dev);
++ ret = pm_runtime_resume_and_get(i2c->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From d5c61c6028d7ee67045a142493386b2da532a49e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:53:27 -0700
+Subject: ia64: ensure proper NUMA distance and possible map initialization
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit b22a8f7b4bde4e4ab73b64908ffd5d90ecdcdbfd ]
+
+John Paul reported a warning about bogus NUMA distance values spurred by
+commit:
+
+ 620a6dc40754 ("sched/topology: Make sched_init_numa() use a set for the deduplicating sort")
+
+In this case, the afflicted machine comes up with a reported 256 possible
+nodes, all of which are 0 distance away from one another. This was
+previously silently ignored, but is now caught by the aforementioned
+commit.
+
+The culprit is ia64's node_possible_map which remains unchanged from its
+initialization value of NODE_MASK_ALL. In John's case, the machine
+doesn't have any SRAT nor SLIT table, but AIUI the possible map remains
+untouched regardless of what ACPI tables end up being parsed. Thus,
+!online && possible nodes remain with a bogus distance of 0 (distances \in
+[0, 9] are "reserved and have no meaning" as per the ACPI spec).
+
+Follow x86 / drivers/base/arch_numa's example and set the possible map to
+the parsed map, which in this case seems to be the online map.
+
+Link: http://lore.kernel.org/r/255d6b5d-194e-eb0e-ecdd-97477a534441@physik.fu-berlin.de
+Link: https://lkml.kernel.org/r/20210318130617.896309-1-valentin.schneider@arm.com
+Fixes: 620a6dc40754 ("sched/topology: Make sched_init_numa() use a set for the deduplicating sort")
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: Sergei Trofimovich <slyfox@gentoo.org>
+Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Anatoly Pugachev <matorola@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/acpi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
+index a5636524af76..e2af6b172200 100644
+--- a/arch/ia64/kernel/acpi.c
++++ b/arch/ia64/kernel/acpi.c
+@@ -446,7 +446,8 @@ void __init acpi_numa_fixup(void)
+ if (srat_num_cpus == 0) {
+ node_set_online(0);
+ node_cpuid[0].phys_id = hard_smp_processor_id();
+- return;
++ slit_distance(0, 0) = LOCAL_DISTANCE;
++ goto out;
+ }
+
+ /*
+@@ -489,7 +490,7 @@ void __init acpi_numa_fixup(void)
+ for (j = 0; j < MAX_NUMNODES; j++)
+ slit_distance(i, j) = i == j ?
+ LOCAL_DISTANCE : REMOTE_DISTANCE;
+- return;
++ goto out;
+ }
+
+ memset(numa_slit, -1, sizeof(numa_slit));
+@@ -514,6 +515,8 @@ void __init acpi_numa_fixup(void)
+ printk("\n");
+ }
+ #endif
++out:
++ node_possible_map = node_online_map;
+ }
+ #endif /* CONFIG_ACPI_NUMA */
+
+--
+2.30.2
+
--- /dev/null
+From 0d7bcf0606d7d9264facb2c86b0136a709eae483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:53:39 -0700
+Subject: ia64: fix EFI_DEBUG build
+
+From: Sergei Trofimovich <slyfox@gentoo.org>
+
+[ Upstream commit e3db00b79d74caaf84cd9e1d4927979abfd0d7c9 ]
+
+When enabled local debugging via `#define EFI_DEBUG 1` noticed build
+failure:
+
+ arch/ia64/kernel/efi.c:564:8: error: 'i' undeclared (first use in this function)
+
+While at it fixed benign string format mismatches visible only when
+EFI_DEBUG is enabled:
+
+ arch/ia64/kernel/efi.c:589:11:
+ warning: format '%lx' expects argument of type 'long unsigned int',
+ but argument 5 has type 'u64' {aka 'long long unsigned int'} [-Wformat=]
+
+Link: https://lkml.kernel.org/r/20210328212246.685601-1-slyfox@gentoo.org
+Fixes: 14fb42090943559 ("efi: Merge EFI system table revision and vendor checks")
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/efi.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
+index c5fe21de46a8..31149e41f9be 100644
+--- a/arch/ia64/kernel/efi.c
++++ b/arch/ia64/kernel/efi.c
+@@ -415,10 +415,10 @@ efi_get_pal_addr (void)
+ mask = ~((1 << IA64_GRANULE_SHIFT) - 1);
+
+ printk(KERN_INFO "CPU %d: mapping PAL code "
+- "[0x%lx-0x%lx) into [0x%lx-0x%lx)\n",
+- smp_processor_id(), md->phys_addr,
+- md->phys_addr + efi_md_size(md),
+- vaddr & mask, (vaddr & mask) + IA64_GRANULE_SIZE);
++ "[0x%llx-0x%llx) into [0x%llx-0x%llx)\n",
++ smp_processor_id(), md->phys_addr,
++ md->phys_addr + efi_md_size(md),
++ vaddr & mask, (vaddr & mask) + IA64_GRANULE_SIZE);
+ #endif
+ return __va(md->phys_addr);
+ }
+@@ -560,6 +560,7 @@ efi_init (void)
+ {
+ efi_memory_desc_t *md;
+ void *p;
++ unsigned int i;
+
+ for (i = 0, p = efi_map_start; p < efi_map_end;
+ ++i, p += efi_desc_size)
+@@ -586,7 +587,7 @@ efi_init (void)
+ }
+
+ printk("mem%02d: %s "
+- "range=[0x%016lx-0x%016lx) (%4lu%s)\n",
++ "range=[0x%016llx-0x%016llx) (%4lu%s)\n",
+ i, efi_md_typeattr_format(buf, sizeof(buf), md),
+ md->phys_addr,
+ md->phys_addr + efi_md_size(md), size, unit);
+--
+2.30.2
+
--- /dev/null
+From 29acc88c76efd4053f1d43b20aacfb7dbeadc6e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:40 +0000
+Subject: IB/hfi1: Fix error return code in parse_platform_config()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210408113140.103032-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/firmware.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c
+index 0e83d4b61e46..2cf102b5abd4 100644
+--- a/drivers/infiniband/hw/hfi1/firmware.c
++++ b/drivers/infiniband/hw/hfi1/firmware.c
+@@ -1916,6 +1916,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ dd_dev_err(dd, "%s: Failed CRC check at offset %ld\n",
+ __func__, (ptr -
+ (u32 *)dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail;
+ }
+ /* Jump the CRC DWORD */
+--
+2.30.2
+
--- /dev/null
+From 8baf69d7c051aac1107f95d86f3aa1e744ada182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 09:54:14 -0400
+Subject: IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
+
+From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+
+[ Upstream commit ca5f72568e034e1295a7ae350b1f786fcbfb2848 ]
+
+The code currently assumes that the mmu_notifier struct
+embedded in mmu_rb_handler only contains two fields.
+
+There are now extra fields:
+
+struct mmu_notifier {
+ struct hlist_node hlist;
+ const struct mmu_notifier_ops *ops;
+ struct mm_struct *mm;
+ struct rcu_head rcu;
+ unsigned int users;
+};
+
+Given that there in no init for the mmu_notifier, a kzalloc() should
+be used to insure that any newly added fields are given a predictable
+initial value of zero.
+
+Fixes: 06e0ffa69312 ("IB/hfi1: Re-factor MMU notification code")
+Link: https://lore.kernel.org/r/1617026056-50483-9-git-send-email-dennis.dalessandro@cornelisnetworks.com
+Reviewed-by: Adam Goldman <adam.goldman@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index f3fb28e3d5d7..d213f65d4cdd 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -89,7 +89,7 @@ int hfi1_mmu_rb_register(void *ops_arg,
+ struct mmu_rb_handler *h;
+ int ret;
+
+- h = kmalloc(sizeof(*h), GFP_KERNEL);
++ h = kzalloc(sizeof(*h), GFP_KERNEL);
+ if (!h)
+ return -ENOMEM;
+
+--
+2.30.2
+
--- /dev/null
+From 94fc085510fb5bdac199561e42d2e49097e27ee6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 09:13:25 -0700
+Subject: IB/isert: Fix a use after free in isert_connect_request
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit adb76a520d068a54ee5ca82e756cf8e5a47363a4 ]
+
+The device is got by isert_device_get() with refcount is 1, and is
+assigned to isert_conn by
+ isert_conn->device = device.
+
+When isert_create_qp() failed, device will be freed with
+isert_device_put().
+
+Later, the device is used in isert_free_login_buf(isert_conn) by the
+isert_conn->device->ib_device statement.
+
+Free the device in the correct order.
+
+Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines")
+Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 7305ed8976c2..18266f07c58d 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ isert_init_conn(isert_conn);
+ isert_conn->cm_id = cma_id;
+
+- ret = isert_alloc_login_buf(isert_conn, cma_id->device);
+- if (ret)
+- goto out;
+-
+ device = isert_device_get(cma_id);
+ if (IS_ERR(device)) {
+ ret = PTR_ERR(device);
+- goto out_rsp_dma_map;
++ goto out;
+ }
+ isert_conn->device = device;
+
++ ret = isert_alloc_login_buf(isert_conn, cma_id->device);
++ if (ret)
++ goto out_conn_dev;
++
+ isert_set_nego_params(isert_conn, &event->param.conn);
+
+ isert_conn->qp = isert_create_qp(isert_conn, cma_id);
+ if (IS_ERR(isert_conn->qp)) {
+ ret = PTR_ERR(isert_conn->qp);
+- goto out_conn_dev;
++ goto out_rsp_dma_map;
+ }
+
+ ret = isert_login_post_recv(isert_conn);
+@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+
+ out_destroy_qp:
+ isert_destroy_qp(isert_conn);
+-out_conn_dev:
+- isert_device_put(device);
+ out_rsp_dma_map:
+ isert_free_login_buf(isert_conn);
++out_conn_dev:
++ isert_device_put(device);
+ out:
+ kfree(isert_conn);
+ rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
+--
+2.30.2
+
--- /dev/null
+From f08f3ac29a0da2ffe6483e9e2e8cd06b79b973a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 20:27:46 +0200
+Subject: iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol
+
+From: Alexandru Ardelean <aardelean@deviqon.com>
+
+[ Upstream commit 194eafc9c1d49b53b59de9821fb63d423344cae3 ]
+
+Because a dependency on HAS_IOMEM and OF was added for the ADI AXI ADC
+driver, this makes the AD9467 driver have some build/dependency issues
+when OF is disabled (typically on ACPI archs like x86).
+
+This is because the selection of the AD9467 enforces the ADI_AXI_ADC symbol
+which is blocked by the OF (and potentially HAS_IOMEM) being disabled.
+
+To fix this, we make the AD9467 driver depend on the ADI_AXI_ADC symbol.
+The AD9467 driver cannot operate on it's own. It requires the ADI AXI ADC
+driver to stream data (or some similar IIO interface).
+
+So, the fix here is to make the AD9467 symbol depend on the ADI_AXI_ADC
+symbol. At some point this could become it's own subgroup of high-speed
+ADCs.
+
+Fixes: be24c65e9fa24 ("iio: adc: adi-axi-adc: add proper Kconfig dependencies")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Alexandru Ardelean <aardelean@deviqon.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20210324182746.9337-1-aardelean@deviqon.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+index e0667c4b3c08..dda0f1e37ec1 100644
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -249,7 +249,7 @@ config AD799X
+ config AD9467
+ tristate "Analog Devices AD9467 High Speed ADC driver"
+ depends on SPI
+- select ADI_AXI_ADC
++ depends on ADI_AXI_ADC
+ help
+ Say yes here to build support for Analog Devices:
+ * AD9467 16-Bit, 200 MSPS/250 MSPS Analog-to-Digital Converter
+--
+2.30.2
+
--- /dev/null
+From 560629161795e38967b9d88ba2db6c9cb527cff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 12:40:36 +0100
+Subject: iio: adis16480: fix pps mode sampling frequency math
+
+From: Nuno Sa <nuno.sa@analog.com>
+
+[ Upstream commit 0463e60f087069adf25a815cd88753946aca2565 ]
+
+When using PPS mode, the input clock needs to be scaled so that we have
+an IMU sample rate between (optimally) 4000 and 4250. After this, we can
+use the decimation filter to lower the sampling rate in order to get what
+the user wants. Optimally, the user sample rate is a multiple of both the
+IMU sample rate and the input clock. Hence, calculating the sync_scale
+dynamically gives us better chances of achieving a perfect/integer value
+for DEC_RATE. The math here is:
+ 1. lcm of the input clock and the desired output rate.
+ 2. get the highest multiple of the previous result lower than the adis
+ max rate.
+ 3. The last result becomes the IMU sample rate. Use that to calculate
+ SYNC_SCALE and DEC_RATE (to get the user output rate).
+
+Fixes: 326e2357553d3 ("iio: imu: adis16480: Add support for external clock")
+
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20210218114039.216091-2-nuno.sa@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/adis16480.c | 128 ++++++++++++++++++++++++++----------
+ 1 file changed, 94 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index dfe86c589325..c41b8ef1e250 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -10,6 +10,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/interrupt.h>
+ #include <linux/delay.h>
++#include <linux/math.h>
+ #include <linux/mutex.h>
+ #include <linux/device.h>
+ #include <linux/kernel.h>
+@@ -17,6 +18,7 @@
+ #include <linux/slab.h>
+ #include <linux/sysfs.h>
+ #include <linux/module.h>
++#include <linux/lcm.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/sysfs.h>
+@@ -170,6 +172,11 @@ static const char * const adis16480_int_pin_names[4] = {
+ [ADIS16480_PIN_DIO4] = "DIO4",
+ };
+
++static bool low_rate_allow;
++module_param(low_rate_allow, bool, 0444);
++MODULE_PARM_DESC(low_rate_allow,
++ "Allow IMU rates below the minimum advisable when external clk is used in PPS mode (default: N)");
++
+ #ifdef CONFIG_DEBUG_FS
+
+ static ssize_t adis16480_show_firmware_revision(struct file *file,
+@@ -312,7 +319,8 @@ static int adis16480_debugfs_init(struct iio_dev *indio_dev)
+ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
+ {
+ struct adis16480 *st = iio_priv(indio_dev);
+- unsigned int t, reg;
++ unsigned int t, sample_rate = st->clk_freq;
++ int ret;
+
+ if (val < 0 || val2 < 0)
+ return -EINVAL;
+@@ -321,28 +329,65 @@ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
+ if (t == 0)
+ return -EINVAL;
+
++ mutex_lock(&st->adis.state_lock);
+ /*
+- * When using PPS mode, the rate of data collection is equal to the
+- * product of the external clock frequency and the scale factor in the
+- * SYNC_SCALE register.
+- * When using sync mode, or internal clock, the output data rate is
+- * equal with the clock frequency divided by DEC_RATE + 1.
++ * When using PPS mode, the input clock needs to be scaled so that we have an IMU
++ * sample rate between (optimally) 4000 and 4250. After this, we can use the
++ * decimation filter to lower the sampling rate in order to get what the user wants.
++ * Optimally, the user sample rate is a multiple of both the IMU sample rate and
++ * the input clock. Hence, calculating the sync_scale dynamically gives us better
++ * chances of achieving a perfect/integer value for DEC_RATE. The math here is:
++ * 1. lcm of the input clock and the desired output rate.
++ * 2. get the highest multiple of the previous result lower than the adis max rate.
++ * 3. The last result becomes the IMU sample rate. Use that to calculate SYNC_SCALE
++ * and DEC_RATE (to get the user output rate)
+ */
+ if (st->clk_mode == ADIS16480_CLK_PPS) {
+- t = t / st->clk_freq;
+- reg = ADIS16495_REG_SYNC_SCALE;
+- } else {
+- t = st->clk_freq / t;
+- reg = ADIS16480_REG_DEC_RATE;
++ unsigned long scaled_rate = lcm(st->clk_freq, t);
++ int sync_scale;
++
++ /*
++ * If lcm is bigger than the IMU maximum sampling rate there's no perfect
++ * solution. In this case, we get the highest multiple of the input clock
++ * lower than the IMU max sample rate.
++ */
++ if (scaled_rate > st->chip_info->int_clk)
++ scaled_rate = st->chip_info->int_clk / st->clk_freq * st->clk_freq;
++ else
++ scaled_rate = st->chip_info->int_clk / scaled_rate * scaled_rate;
++
++ /*
++ * This is not an hard requirement but it's not advised to run the IMU
++ * with a sample rate lower than 4000Hz due to possible undersampling
++ * issues. However, there are users that might really want to take the risk.
++ * Hence, we provide a module parameter for them. If set, we allow sample
++ * rates lower than 4KHz. By default, we won't allow this and we just roundup
++ * the rate to the next multiple of the input clock bigger than 4KHz. This
++ * is done like this as in some cases (when DEC_RATE is 0) might give
++ * us the closest value to the one desired by the user...
++ */
++ if (scaled_rate < 4000000 && !low_rate_allow)
++ scaled_rate = roundup(4000000, st->clk_freq);
++
++ sync_scale = scaled_rate / st->clk_freq;
++ ret = __adis_write_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, sync_scale);
++ if (ret)
++ goto error;
++
++ sample_rate = scaled_rate;
+ }
+
++ t = DIV_ROUND_CLOSEST(sample_rate, t);
++ if (t)
++ t--;
++
+ if (t > st->chip_info->max_dec_rate)
+ t = st->chip_info->max_dec_rate;
+
+- if ((t != 0) && (st->clk_mode != ADIS16480_CLK_PPS))
+- t--;
+-
+- return adis_write_reg_16(&st->adis, reg, t);
++ ret = __adis_write_reg_16(&st->adis, ADIS16480_REG_DEC_RATE, t);
++error:
++ mutex_unlock(&st->adis.state_lock);
++ return ret;
+ }
+
+ static int adis16480_get_freq(struct iio_dev *indio_dev, int *val, int *val2)
+@@ -350,34 +395,35 @@ static int adis16480_get_freq(struct iio_dev *indio_dev, int *val, int *val2)
+ struct adis16480 *st = iio_priv(indio_dev);
+ uint16_t t;
+ int ret;
+- unsigned int freq;
+- unsigned int reg;
++ unsigned int freq, sample_rate = st->clk_freq;
+
+- if (st->clk_mode == ADIS16480_CLK_PPS)
+- reg = ADIS16495_REG_SYNC_SCALE;
+- else
+- reg = ADIS16480_REG_DEC_RATE;
++ mutex_lock(&st->adis.state_lock);
++
++ if (st->clk_mode == ADIS16480_CLK_PPS) {
++ u16 sync_scale;
++
++ ret = __adis_read_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, &sync_scale);
++ if (ret)
++ goto error;
+
+- ret = adis_read_reg_16(&st->adis, reg, &t);
++ sample_rate = st->clk_freq * sync_scale;
++ }
++
++ ret = __adis_read_reg_16(&st->adis, ADIS16480_REG_DEC_RATE, &t);
+ if (ret)
+- return ret;
++ goto error;
+
+- /*
+- * When using PPS mode, the rate of data collection is equal to the
+- * product of the external clock frequency and the scale factor in the
+- * SYNC_SCALE register.
+- * When using sync mode, or internal clock, the output data rate is
+- * equal with the clock frequency divided by DEC_RATE + 1.
+- */
+- if (st->clk_mode == ADIS16480_CLK_PPS)
+- freq = st->clk_freq * t;
+- else
+- freq = st->clk_freq / (t + 1);
++ mutex_unlock(&st->adis.state_lock);
++
++ freq = DIV_ROUND_CLOSEST(sample_rate, (t + 1));
+
+ *val = freq / 1000;
+ *val2 = (freq % 1000) * 1000;
+
+ return IIO_VAL_INT_PLUS_MICRO;
++error:
++ mutex_unlock(&st->adis.state_lock);
++ return ret;
+ }
+
+ enum {
+@@ -1278,6 +1324,20 @@ static int adis16480_probe(struct spi_device *spi)
+
+ st->clk_freq = clk_get_rate(st->ext_clk);
+ st->clk_freq *= 1000; /* micro */
++ if (st->clk_mode == ADIS16480_CLK_PPS) {
++ u16 sync_scale;
++
++ /*
++ * In PPS mode, the IMU sample rate is the clk_freq * sync_scale. Hence,
++ * default the IMU sample rate to the highest multiple of the input clock
++ * lower than the IMU max sample rate. The internal sample rate is the
++ * max...
++ */
++ sync_scale = st->chip_info->int_clk / st->clk_freq;
++ ret = __adis_write_reg_16(&st->adis, ADIS16495_REG_SYNC_SCALE, sync_scale);
++ if (ret)
++ return ret;
++ }
+ } else {
+ st->clk_freq = st->chip_info->int_clk;
+ }
+--
+2.30.2
+
--- /dev/null
+From 058937c22fbf3f120e96b06dd263044cd2036dba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:28:24 +0800
+Subject: ima: Fix the error code for restoring the PCR value
+
+From: Li Huafei <lihuafei1@huawei.com>
+
+[ Upstream commit 7990ccafaa37dc6d8bb095d4d7cd997e8903fd10 ]
+
+In ima_restore_measurement_list(), hdr[HDR_PCR].data is pointing to a
+buffer of type u8, which contains the dumped 32-bit pcr value.
+Currently, only the least significant byte is used to restore the pcr
+value. We should convert hdr[HDR_PCR].data to a pointer of type u32
+before fetching the value to restore the correct pcr value.
+
+Fixes: 47fdee60b47f ("ima: use ima_parse_buf() to parse measurements headers")
+Signed-off-by: Li Huafei <lihuafei1@huawei.com>
+Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_template.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
+index e22e510ae92d..4e081e650047 100644
+--- a/security/integrity/ima/ima_template.c
++++ b/security/integrity/ima/ima_template.c
+@@ -494,8 +494,8 @@ int ima_restore_measurement_list(loff_t size, void *buf)
+ }
+ }
+
+- entry->pcr = !ima_canonical_fmt ? *(hdr[HDR_PCR].data) :
+- le32_to_cpu(*(hdr[HDR_PCR].data));
++ entry->pcr = !ima_canonical_fmt ? *(u32 *)(hdr[HDR_PCR].data) :
++ le32_to_cpu(*(u32 *)(hdr[HDR_PCR].data));
+ ret = ima_restore_measurement_entry(entry);
+ if (ret < 0)
+ break;
+--
+2.30.2
+
--- /dev/null
+From d1c062d7768530d7356a7df9f19ef995fb0f3a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 14:53:37 -0700
+Subject: inet: use bigger hash table for IP ID generation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba ]
+
+In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
+I used a very small hash table that could be abused
+by patient attackers to reveal sensitive information.
+
+Switch to a dynamic sizing, depending on RAM size.
+
+Typical big hosts will now use 128x more storage (2 MB)
+to get a similar increase in security and reduction
+of hash collisions.
+
+As a bonus, use of alloc_large_system_hash() spreads
+allocated memory among all NUMA nodes.
+
+Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
+Reported-by: Amit Klein <aksecurity@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 42 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index bba150fdd265..d635b4f32d34 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -66,6 +66,7 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
++#include <linux/memblock.h>
+ #include <linux/string.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+@@ -478,8 +479,10 @@ static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
+ __ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
+ }
+
+-#define IP_IDENTS_SZ 2048u
+-
++/* Hash tables of size 2048..262144 depending on RAM size.
++ * Each bucket uses 8 bytes.
++ */
++static u32 ip_idents_mask __read_mostly;
+ static atomic_t *ip_idents __read_mostly;
+ static u32 *ip_tstamps __read_mostly;
+
+@@ -489,12 +492,16 @@ static u32 *ip_tstamps __read_mostly;
+ */
+ u32 ip_idents_reserve(u32 hash, int segs)
+ {
+- u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
+- atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
+- u32 old = READ_ONCE(*p_tstamp);
+- u32 now = (u32)jiffies;
++ u32 bucket, old, now = (u32)jiffies;
++ atomic_t *p_id;
++ u32 *p_tstamp;
+ u32 delta = 0;
+
++ bucket = hash & ip_idents_mask;
++ p_tstamp = ip_tstamps + bucket;
++ p_id = ip_idents + bucket;
++ old = READ_ONCE(*p_tstamp);
++
+ if (old != now && cmpxchg(p_tstamp, old, now) == old)
+ delta = prandom_u32_max(now - old);
+
+@@ -3553,18 +3560,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
+
+ int __init ip_rt_init(void)
+ {
++ void *idents_hash;
+ int cpu;
+
+- ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
+- GFP_KERNEL);
+- if (!ip_idents)
+- panic("IP: failed to allocate ip_idents\n");
++ /* For modern hosts, this will use 2 MB of memory */
++ idents_hash = alloc_large_system_hash("IP idents",
++ sizeof(*ip_idents) + sizeof(*ip_tstamps),
++ 0,
++ 16, /* one bucket per 64 KB */
++ HASH_ZERO,
++ NULL,
++ &ip_idents_mask,
++ 2048,
++ 256*1024);
++
++ ip_idents = idents_hash;
+
+- prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++ prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
+
+- ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
+- if (!ip_tstamps)
+- panic("IP: failed to allocate ip_tstamps\n");
++ ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
+
+ for_each_possible_cpu(cpu) {
+ struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
+--
+2.30.2
+
--- /dev/null
+From 888cadd4dcd935a134b70d79bd3dee48dcd6ca65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 13:07:39 +0100
+Subject: io_uring: fix overflows checks in provide buffers
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 38134ada0ceea3e848fe993263c0ff6207fd46e7 ]
+
+Colin reported before possible overflow and sign extension problems in
+io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing
+useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension").
+
+Do that with help of check_<op>_overflow helpers. And fix struct
+io_provide_buf::len type, as it doesn't make much sense to keep it
+signed.
+
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/46538827e70fce5f6cdb50897cff4cacc490f380.1618488258.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 2bdd7eab6c66..144056b0cac9 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -614,7 +614,7 @@ struct io_splice {
+ struct io_provide_buf {
+ struct file *file;
+ __u64 addr;
+- __s32 len;
++ __u32 len;
+ __u32 bgid;
+ __u16 nbufs;
+ __u16 bid;
+@@ -3979,7 +3979,7 @@ static int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
+ static int io_provide_buffers_prep(struct io_kiocb *req,
+ const struct io_uring_sqe *sqe)
+ {
+- unsigned long size;
++ unsigned long size, tmp_check;
+ struct io_provide_buf *p = &req->pbuf;
+ u64 tmp;
+
+@@ -3993,6 +3993,12 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
+ p->addr = READ_ONCE(sqe->addr);
+ p->len = READ_ONCE(sqe->len);
+
++ if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,
++ &size))
++ return -EOVERFLOW;
++ if (check_add_overflow((unsigned long)p->addr, size, &tmp_check))
++ return -EOVERFLOW;
++
+ size = (unsigned long)p->len * p->nbufs;
+ if (!access_ok(u64_to_user_ptr(p->addr), size))
+ return -EFAULT;
+--
+2.30.2
+
--- /dev/null
+From 73ccfa20ae17527d73403a6b72f595d3a51f66a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 20:01:41 +0200
+Subject: iommu/amd: Put newline after closing bracket in warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit 304c73ba69459d4c18c2a4b843be6f5777b4b85c ]
+
+Currently, on the Dell OptiPlex 5055 the EFR mismatch warning looks like
+below.
+
+ [ 1.479774] smpboot: CPU0: AMD Ryzen 5 PRO 1500 Quad-Core Processor (family: 0x17, model: 0x1, stepping: 0x1)
+ […]
+ [ 2.507370] AMD-Vi: [Firmware Warn]: EFR mismatch. Use IVHD EFR (0xf77ef22294ada : 0x400f77ef22294ada
+ ).
+
+Add the newline after the `).`, so it’s on one line.
+
+Fixes: a44092e326d4 ("iommu/amd: Use IVHD EFR for early initialization of IOMMU features")
+Cc: iommu@lists.linux-foundation.org
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Brijesh Singh <brijesh.singh@amd.com>
+Cc: Robert Richter <rrichter@amd.com>
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://lore.kernel.org/r/20210412180141.29605-1-pmenzel@molgen.mpg.de
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 321f5906e6ed..f7e31018cd0b 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1837,7 +1837,7 @@ static void __init late_iommu_features_init(struct amd_iommu *iommu)
+ * IVHD and MMIO conflict.
+ */
+ if (features != iommu->features)
+- pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n).",
++ pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx).\n",
+ features, iommu->features);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c3fc1e446c1d330fe2dd4116c1729a11e4f395a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 16:16:03 +0800
+Subject: iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 655c447c97d7fe462e6cd9e15809037be028bc70 ]
+
+In arm_smmu_gerror_handler(), the value of the SMMU_GERROR register is
+filtered by GERROR_ERR_MASK. However, the GERROR_ERR_MASK does not contain
+the SFM bit. As a result, the subsequent error processing is not performed
+when only the SFM error occurs.
+
+Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
+Reported-by: Rui Zhu <zhurui3@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210324081603.1074-1-thunder.leizhen@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+index f985817c967a..230b6f6b3901 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+@@ -115,7 +115,7 @@
+ #define GERROR_PRIQ_ABT_ERR (1 << 3)
+ #define GERROR_EVTQ_ABT_ERR (1 << 2)
+ #define GERROR_CMDQ_ERR (1 << 0)
+-#define GERROR_ERR_MASK 0xfd
++#define GERROR_ERR_MASK 0x1fd
+
+ #define ARM_SMMU_GERRORN 0x64
+
+--
+2.30.2
+
--- /dev/null
+From 314e7e7893ff62a0273c8ba93bd38451e058168d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 17:36:11 +0000
+Subject: iommu: Check dev->iommu in iommu_dev_xxx functions
+
+From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
+
+[ Upstream commit b9abb19fa5fd2d8a4be61c6cd4b2a48aa1a17f9c ]
+
+The device iommu probe/attach might have failed leaving dev->iommu
+to NULL and device drivers may still invoke these functions resulting
+in a crash in iommu vendor driver code.
+
+Hence make sure we check that.
+
+Fixes: a3a195929d40 ("iommu: Add APIs for multiple domains per device")
+Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/20210303173611.520-1-shameerali.kolothum.thodi@huawei.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index d0b0a15dba84..e10cfa99057c 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -2878,10 +2878,12 @@ EXPORT_SYMBOL_GPL(iommu_fwspec_add_ids);
+ */
+ int iommu_dev_enable_feature(struct device *dev, enum iommu_dev_features feat)
+ {
+- const struct iommu_ops *ops = dev->bus->iommu_ops;
++ if (dev->iommu && dev->iommu->iommu_dev) {
++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops;
+
+- if (ops && ops->dev_enable_feat)
+- return ops->dev_enable_feat(dev, feat);
++ if (ops->dev_enable_feat)
++ return ops->dev_enable_feat(dev, feat);
++ }
+
+ return -ENODEV;
+ }
+@@ -2894,10 +2896,12 @@ EXPORT_SYMBOL_GPL(iommu_dev_enable_feature);
+ */
+ int iommu_dev_disable_feature(struct device *dev, enum iommu_dev_features feat)
+ {
+- const struct iommu_ops *ops = dev->bus->iommu_ops;
++ if (dev->iommu && dev->iommu->iommu_dev) {
++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops;
+
+- if (ops && ops->dev_disable_feat)
+- return ops->dev_disable_feat(dev, feat);
++ if (ops->dev_disable_feat)
++ return ops->dev_disable_feat(dev, feat);
++ }
+
+ return -EBUSY;
+ }
+@@ -2905,10 +2909,12 @@ EXPORT_SYMBOL_GPL(iommu_dev_disable_feature);
+
+ bool iommu_dev_feature_enabled(struct device *dev, enum iommu_dev_features feat)
+ {
+- const struct iommu_ops *ops = dev->bus->iommu_ops;
++ if (dev->iommu && dev->iommu->iommu_dev) {
++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops;
+
+- if (ops && ops->dev_feat_enabled)
+- return ops->dev_feat_enabled(dev, feat);
++ if (ops->dev_feat_enabled)
++ return ops->dev_feat_enabled(dev, feat);
++ }
+
+ return false;
+ }
+--
+2.30.2
+
--- /dev/null
+From 5a44fddbea3dd8f79631f9f482bc669e844a276f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 16:32:34 +0000
+Subject: iommu/dma: Resurrect the "forcedac" option
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 3542dcb15cef66c0b9e6c3b33168eb657e0d9520 ]
+
+In converting intel-iommu over to the common IOMMU DMA ops, it quietly
+lost the functionality of its "forcedac" option. Since this is a handy
+thing both for testing and for performance optimisation on certain
+platforms, reimplement it under the common IOMMU parameter namespace.
+
+For the sake of fixing the inadvertent breakage of the Intel-specific
+parameter, remove the dmar_forcedac remnants and hook it up as an alias
+while documenting the transition to the new common parameter.
+
+Fixes: c588072bba6b ("iommu/vt-d: Convert intel iommu driver to the iommu ops")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/7eece8e0ea7bfbe2cd0e30789e0d46df573af9b0.1614961776.git.robin.murphy@arm.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 15 ++++++++-------
+ drivers/iommu/dma-iommu.c | 13 ++++++++++++-
+ drivers/iommu/intel/iommu.c | 5 ++---
+ include/linux/dma-iommu.h | 2 ++
+ 4 files changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 04545725f187..835f810f2f26 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1869,13 +1869,6 @@
+ bypassed by not enabling DMAR with this option. In
+ this case, gfx device will use physical address for
+ DMA.
+- forcedac [X86-64]
+- With this option iommu will not optimize to look
+- for io virtual address below 32-bit forcing dual
+- address cycle on pci bus for cards supporting greater
+- than 32-bit addressing. The default is to look
+- for translation below 32-bit and if not available
+- then look in the higher range.
+ strict [Default Off]
+ With this option on every unmap_single operation will
+ result in a hardware IOTLB flush operation as opposed
+@@ -1964,6 +1957,14 @@
+ nobypass [PPC/POWERNV]
+ Disable IOMMU bypass, using IOMMU for PCI devices.
+
++ iommu.forcedac= [ARM64, X86] Control IOVA allocation for PCI devices.
++ Format: { "0" | "1" }
++ 0 - Try to allocate a 32-bit DMA address first, before
++ falling back to the full range if needed.
++ 1 - Allocate directly from the full usable range,
++ forcing Dual Address Cycle for PCI cards supporting
++ greater than 32-bit addressing.
++
+ iommu.strict= [ARM64] Configure TLB invalidation behaviour
+ Format: { "0" | "1" }
+ 0 - Lazy mode.
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index af765c813cc8..fdd095e1fa52 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -52,6 +52,17 @@ struct iommu_dma_cookie {
+ };
+
+ static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
++bool iommu_dma_forcedac __read_mostly;
++
++static int __init iommu_dma_forcedac_setup(char *str)
++{
++ int ret = kstrtobool(str, &iommu_dma_forcedac);
++
++ if (!ret && iommu_dma_forcedac)
++ pr_info("Forcing DAC for PCI devices\n");
++ return ret;
++}
++early_param("iommu.forcedac", iommu_dma_forcedac_setup);
+
+ void iommu_dma_free_cpu_cached_iovas(unsigned int cpu,
+ struct iommu_domain *domain)
+@@ -444,7 +455,7 @@ static dma_addr_t iommu_dma_alloc_iova(struct iommu_domain *domain,
+ dma_limit = min(dma_limit, (u64)domain->geometry.aperture_end);
+
+ /* Try to get PCI devices a SAC address */
+- if (dma_limit > DMA_BIT_MASK(32) && dev_is_pci(dev))
++ if (dma_limit > DMA_BIT_MASK(32) && !iommu_dma_forcedac && dev_is_pci(dev))
+ iova = alloc_iova_fast(iovad, iova_len,
+ DMA_BIT_MASK(32) >> shift, false);
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 881c9f2a5c7d..66fab7944b39 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -360,7 +360,6 @@ int intel_iommu_enabled = 0;
+ EXPORT_SYMBOL_GPL(intel_iommu_enabled);
+
+ static int dmar_map_gfx = 1;
+-static int dmar_forcedac;
+ static int intel_iommu_strict;
+ static int intel_iommu_superpage = 1;
+ static int iommu_identity_mapping;
+@@ -451,8 +450,8 @@ static int __init intel_iommu_setup(char *str)
+ dmar_map_gfx = 0;
+ pr_info("Disable GFX device mapping\n");
+ } else if (!strncmp(str, "forcedac", 8)) {
+- pr_info("Forcing DAC for PCI devices\n");
+- dmar_forcedac = 1;
++ pr_warn("intel_iommu=forcedac deprecated; use iommu.forcedac instead\n");
++ iommu_dma_forcedac = true;
+ } else if (!strncmp(str, "strict", 6)) {
+ pr_info("Disable batched IOTLB flush\n");
+ intel_iommu_strict = 1;
+diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
+index 706b68d1359b..13d1f4c14d7b 100644
+--- a/include/linux/dma-iommu.h
++++ b/include/linux/dma-iommu.h
+@@ -40,6 +40,8 @@ void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list);
+ void iommu_dma_free_cpu_cached_iovas(unsigned int cpu,
+ struct iommu_domain *domain);
+
++extern bool iommu_dma_forcedac;
++
+ #else /* CONFIG_IOMMU_DMA */
+
+ struct iommu_domain;
+--
+2.30.2
+
--- /dev/null
+From b4405f7bf1adf18e95d21064fe14ffb9a10a6f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 11:38:24 +0800
+Subject: iommu: Fix a boundary issue to avoid performance drop
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 3431c3f660a39f6ced954548a59dba6541ce3eb1 ]
+
+After the change of patch ("iommu: Switch gather->end to the
+inclusive end"), the performace drops from 1600+K IOPS to 1200K in our
+kunpeng ARM64 platform.
+We find that the range [start1, end1) actually is joint from the range
+[end1, end2), but it is considered as disjoint after the change,
+so it needs more times of TLB sync, and spends more time on it.
+So fix the boundary issue to avoid performance drop.
+
+Fixes: 862c3715de8f ("iommu: Switch gather->end to the inclusive end")
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/1616643504-120688-1-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/iommu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/iommu.h b/include/linux/iommu.h
+index 5e7fe519430a..9ca6e6b8084d 100644
+--- a/include/linux/iommu.h
++++ b/include/linux/iommu.h
+@@ -547,7 +547,7 @@ static inline void iommu_iotlb_gather_add_page(struct iommu_domain *domain,
+ * structure can be rewritten.
+ */
+ if (gather->pgsize != size ||
+- end < gather->start || start > gather->end) {
++ end + 1 < gather->start || start > gather->end + 1) {
+ if (gather->pgsize)
+ iommu_iotlb_sync(domain, gather);
+ gather->pgsize = size;
+--
+2.30.2
+
--- /dev/null
+From 2c3eb6bacd732e6ee992529e93d04d3f2fe0b842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 12:54:49 +0200
+Subject: iommu/mediatek: Always enable the clk on resume
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit b34ea31fe013569d42b7e8681ef3f717f77c5b72 ]
+
+In mtk_iommu_runtime_resume always enable the clk, even
+if m4u_dom is null. Otherwise the 'suspend' cb might
+disable the clk which is already disabled causing the warning:
+
+[ 1.586104] infra_m4u already disabled
+[ 1.586133] WARNING: CPU: 0 PID: 121 at drivers/clk/clk.c:952 clk_core_disable+0xb0/0xb8
+[ 1.594391] mtk-iommu 10205000.iommu: bound 18001000.larb (ops mtk_smi_larb_component_ops)
+[ 1.598108] Modules linked in:
+[ 1.598114] CPU: 0 PID: 121 Comm: kworker/0:2 Not tainted 5.12.0-rc5 #69
+[ 1.609246] mtk-iommu 10205000.iommu: bound 14027000.larb (ops mtk_smi_larb_component_ops)
+[ 1.617487] Hardware name: Google Elm (DT)
+[ 1.617491] Workqueue: pm pm_runtime_work
+[ 1.620545] mtk-iommu 10205000.iommu: bound 19001000.larb (ops mtk_smi_larb_component_ops)
+
+[ 1.627229] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)
+[ 1.659297] pc : clk_core_disable+0xb0/0xb8
+[ 1.663475] lr : clk_core_disable+0xb0/0xb8
+[ 1.667652] sp : ffff800011b9bbe0
+[ 1.670959] x29: ffff800011b9bbe0 x28: 0000000000000000
+[ 1.676267] x27: ffff800011448000 x26: ffff8000100cfd98
+[ 1.681574] x25: ffff800011b9bd48 x24: 0000000000000000
+[ 1.686882] x23: 0000000000000000 x22: ffff8000106fad90
+[ 1.692189] x21: 000000000000000a x20: ffff0000c0048500
+[ 1.697496] x19: ffff0000c0048500 x18: ffffffffffffffff
+[ 1.702804] x17: 0000000000000000 x16: 0000000000000000
+[ 1.708112] x15: ffff800011460300 x14: fffffffffffe0000
+[ 1.713420] x13: ffff8000114602d8 x12: 0720072007200720
+[ 1.718727] x11: 0720072007200720 x10: 0720072007200720
+[ 1.724035] x9 : ffff800011b9bbe0 x8 : ffff800011b9bbe0
+[ 1.729342] x7 : 0000000000000009 x6 : ffff8000114b8328
+[ 1.734649] x5 : 0000000000000000 x4 : 0000000000000000
+[ 1.739956] x3 : 00000000ffffffff x2 : ffff800011460298
+[ 1.745263] x1 : 1af1d7de276f4500 x0 : 0000000000000000
+[ 1.750572] Call trace:
+[ 1.753010] clk_core_disable+0xb0/0xb8
+[ 1.756840] clk_core_disable_lock+0x24/0x40
+[ 1.761105] clk_disable+0x20/0x30
+[ 1.764501] mtk_iommu_runtime_suspend+0x88/0xa8
+[ 1.769114] pm_generic_runtime_suspend+0x2c/0x48
+[ 1.773815] __rpm_callback+0xe0/0x178
+[ 1.777559] rpm_callback+0x24/0x88
+[ 1.781041] rpm_suspend+0xdc/0x470
+[ 1.784523] rpm_idle+0x12c/0x170
+[ 1.787831] pm_runtime_work+0xa8/0xc0
+[ 1.791573] process_one_work+0x1e8/0x360
+[ 1.795580] worker_thread+0x44/0x478
+[ 1.799237] kthread+0x150/0x158
+[ 1.802460] ret_from_fork+0x10/0x30
+[ 1.806034] ---[ end trace 82402920ef64573b ]---
+[ 1.810728] ------------[ cut here ]------------
+
+In addition, we now don't need to enable the clock from the
+function mtk_iommu_hw_init since it is already enabled by the resume.
+
+Fixes: c0b57581b73b ("iommu/mediatek: Add power-domain operation")
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Yong Wu <yong.wu@mediatek.com>
+Link: https://lore.kernel.org/r/20210416105449.4744-1-dafna.hirschfeld@collabora.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 6ecc007f07cd..e168a682806a 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -688,13 +688,6 @@ static const struct iommu_ops mtk_iommu_ops = {
+ static int mtk_iommu_hw_init(const struct mtk_iommu_data *data)
+ {
+ u32 regval;
+- int ret;
+-
+- ret = clk_prepare_enable(data->bclk);
+- if (ret) {
+- dev_err(data->dev, "Failed to enable iommu bclk(%d)\n", ret);
+- return ret;
+- }
+
+ if (data->plat_data->m4u_plat == M4U_MT8173) {
+ regval = F_MMU_PREFETCH_RT_REPLACE_MOD |
+@@ -760,7 +753,6 @@ static int mtk_iommu_hw_init(const struct mtk_iommu_data *data)
+ if (devm_request_irq(data->dev, data->irq, mtk_iommu_isr, 0,
+ dev_name(data->dev), (void *)data)) {
+ writel_relaxed(0, data->base + REG_MMU_PT_BASE_ADDR);
+- clk_disable_unprepare(data->bclk);
+ dev_err(data->dev, "Failed @ IRQ-%d Request\n", data->irq);
+ return -ENODEV;
+ }
+@@ -977,14 +969,19 @@ static int __maybe_unused mtk_iommu_runtime_resume(struct device *dev)
+ void __iomem *base = data->base;
+ int ret;
+
+- /* Avoid first resume to affect the default value of registers below. */
+- if (!m4u_dom)
+- return 0;
+ ret = clk_prepare_enable(data->bclk);
+ if (ret) {
+ dev_err(data->dev, "Failed to enable clk(%d) in resume\n", ret);
+ return ret;
+ }
++
++ /*
++ * Uppon first resume, only enable the clk and return, since the values of the
++ * registers are not yet set.
++ */
++ if (!m4u_dom)
++ return 0;
++
+ writel_relaxed(reg->wr_len_ctrl, base + REG_MMU_WR_LEN_CTRL);
+ writel_relaxed(reg->misc_ctrl, base + REG_MMU_MISC_CTRL);
+ writel_relaxed(reg->dcm_dis, base + REG_MMU_DCM_DIS);
+--
+2.30.2
+
--- /dev/null
+From 7db4963a30c0b23362efe57f5681628ff6964a7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 10:41:56 +0800
+Subject: iommu/vt-d: Don't set then clear private data in prq_event_thread()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 1d421058c815d54113d9afdf6db3f995c788cf0d ]
+
+The VT-d specification (section 7.6) requires that the value in the
+Private Data field of a Page Group Response Descriptor must match
+the value in the Private Data field of the respective Page Request
+Descriptor.
+
+The private data field of a page group response descriptor is set then
+immediately cleared in prq_event_thread(). This breaks the rule defined
+by the VT-d specification. Fix it by moving clearing code up.
+
+Fixes: 5b438f4ba315d ("iommu/vt-d: Support page request in scalable mode")
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210320024156.640798-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 4627437ae1c0..547a6cf57057 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -1031,12 +1031,12 @@ no_pasid:
+ QI_PGRP_RESP_TYPE;
+ resp.qw1 = QI_PGRP_IDX(req->prg_index) |
+ QI_PGRP_LPIG(req->lpig);
++ resp.qw2 = 0;
++ resp.qw3 = 0;
+
+ if (req->priv_data_present)
+ memcpy(&resp.qw2, req->priv_data,
+ sizeof(req->priv_data));
+- resp.qw2 = 0;
+- resp.qw3 = 0;
+ qi_submit_sync(iommu, &resp, 1, 0);
+ }
+ prq_advance:
+--
+2.30.2
+
--- /dev/null
+From b328e66ed32229e9f3bbcee55ae28a9c477041b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Apr 2021 09:08:17 +0200
+Subject: iommu/vt-d: Fix an error handling path in
+ 'intel_prepare_irq_remapping()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 745610c4a3e3baaebf6d1f8cd5b4d82892432520 ]
+
+If 'intel_cap_audit()' fails, we should return directly, as already done in
+the surrounding error handling path.
+
+Fixes: ad3d19029979 ("iommu/vt-d: Audit IOMMU Capabilities and add helper functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/98d531caabe66012b4fffc7813fd4b9470afd517.1618124777.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/irq_remapping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c
+index 611ef5243cb6..5c16ebe037a1 100644
+--- a/drivers/iommu/intel/irq_remapping.c
++++ b/drivers/iommu/intel/irq_remapping.c
+@@ -736,7 +736,7 @@ static int __init intel_prepare_irq_remapping(void)
+ return -ENODEV;
+
+ if (intel_cap_audit(CAP_AUDIT_STATIC_IRQR, NULL))
+- goto error;
++ return -ENODEV;
+
+ if (!dmar_ir_support())
+ return -ENODEV;
+--
+2.30.2
+
--- /dev/null
+From cfa2df4928eb3e6d50f856c952fc6f8d99c15097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 10:54:13 +0800
+Subject: iommu/vt-d: Invalidate PASID cache when root/context entry changed
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit c0474a606ecb9326227b4d68059942f9db88a897 ]
+
+When the Intel IOMMU is operating in the scalable mode, some information
+from the root and context table may be used to tag entries in the PASID
+cache. Software should invalidate the PASID-cache when changing root or
+context table entries.
+
+Suggested-by: Ashok Raj <ashok.raj@intel.com>
+Fixes: 7373a8cc38197 ("iommu/vt-d: Setup context and enable RID2PASID support")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210320025415.641201-4-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 18 +++++++++---------
+ include/linux/intel-iommu.h | 1 +
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 36d60536ae8d..7e551da6c1fb 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -1346,6 +1346,11 @@ static void iommu_set_root_entry(struct intel_iommu *iommu)
+ readl, (sts & DMA_GSTS_RTPS), sts);
+
+ raw_spin_unlock_irqrestore(&iommu->register_lock, flag);
++
++ iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
++ if (sm_supported(iommu))
++ qi_flush_pasid_cache(iommu, 0, QI_PC_GLOBAL, 0);
++ iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+ }
+
+ void iommu_flush_write_buffer(struct intel_iommu *iommu)
+@@ -2453,6 +2458,10 @@ static void domain_context_clear_one(struct intel_iommu *iommu, u8 bus, u8 devfn
+ (((u16)bus) << 8) | devfn,
+ DMA_CCMD_MASK_NOBIT,
+ DMA_CCMD_DEVICE_INVL);
++
++ if (sm_supported(iommu))
++ qi_flush_pasid_cache(iommu, did_old, QI_PC_ALL_PASIDS, 0);
++
+ iommu->flush.flush_iotlb(iommu,
+ did_old,
+ 0,
+@@ -3301,8 +3310,6 @@ static int __init init_dmars(void)
+ register_pasid_allocator(iommu);
+ #endif
+ iommu_set_root_entry(iommu);
+- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+ }
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+@@ -3492,12 +3499,7 @@ static int init_iommu_hw(void)
+ }
+
+ iommu_flush_write_buffer(iommu);
+-
+ iommu_set_root_entry(iommu);
+-
+- iommu->flush.flush_context(iommu, 0, 0, 0,
+- DMA_CCMD_GLOBAL_INVL);
+- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+ iommu_enable_translation(iommu);
+ iommu_disable_protect_mem_regions(iommu);
+ }
+@@ -3880,8 +3882,6 @@ static int intel_iommu_add(struct dmar_drhd_unit *dmaru)
+ goto disable_iommu;
+
+ iommu_set_root_entry(iommu);
+- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+ iommu_enable_translation(iommu);
+
+ iommu_disable_protect_mem_regions(iommu);
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 1bc46b88711a..d1f32b33415a 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -372,6 +372,7 @@ enum {
+ /* PASID cache invalidation granu */
+ #define QI_PC_ALL_PASIDS 0
+ #define QI_PC_PASID_SEL 1
++#define QI_PC_GLOBAL 3
+
+ #define QI_EIOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK)
+ #define QI_EIOTLB_IH(ih) (((u64)ih) << 6)
+--
+2.30.2
+
--- /dev/null
+From 1fb09c5c7f1fb640b44cf7af5fcb26f3c736a366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 02:13:59 -0800
+Subject: iommu/vt-d: Reject unsupported page request modes
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 78a523fe73b81b4447beb2d6c78c9fafae24eebb ]
+
+When supervisor/privilige mode SVM is used, we bind init_mm.pgd with
+a supervisor PASID. There should not be any page fault for init_mm.
+Execution request with DMA read is also not supported.
+
+This patch checks PRQ descriptor for both unsupported configurations,
+reject them both with invalid responses.
+
+Fixes: 1c4f88b7f1f92 ("iommu/vt-d: Shared virtual address in scalable mode")
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Link: https://lore.kernel.org/r/1614680040-1989-4-git-send-email-jacob.jun.pan@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 574a7e657a9a..4627437ae1c0 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -920,7 +920,17 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ ((unsigned long long *)req)[1]);
+ goto no_pasid;
+ }
+-
++ /* We shall not receive page request for supervisor SVM */
++ if (req->pm_req && (req->rd_req | req->wr_req)) {
++ pr_err("Unexpected page request in Privilege Mode");
++ /* No need to find the matching sdev as for bad_req */
++ goto no_pasid;
++ }
++ /* DMA read with exec requeset is not supported. */
++ if (req->exe_req && req->rd_req) {
++ pr_err("Execution request not supported\n");
++ goto no_pasid;
++ }
+ if (!svm || svm->pasid != req->pasid) {
+ rcu_read_lock();
+ svm = ioasid_find(NULL, req->pasid, NULL);
+--
+2.30.2
+
--- /dev/null
+From 119465cd97218d814bc3236885d3d487e2a141f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 10:54:12 +0800
+Subject: iommu/vt-d: Remove WO permissions on second-level paging entries
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit eea53c5816889ee8b64544fa2e9311a81184ff9c ]
+
+When the first level page table is used for IOVA translation, it only
+supports Read-Only and Read-Write permissions. The Write-Only permission
+is not supported as the PRESENT bit (implying Read permission) should
+always set. When using second level, we still give separate permissions
+that allows WriteOnly which seems inconsistent and awkward. We want to
+have consistent behavior. After moving to 1st level, we don't want things
+to work sometimes, and break if we use 2nd level for the same mappings.
+Hence remove this configuration.
+
+Suggested-by: Ashok Raj <ashok.raj@intel.com>
+Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210320025415.641201-3-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index b5d3301b2700..36d60536ae8d 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -2346,8 +2346,9 @@ __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+ return -EINVAL;
+
+ attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP);
++ attr |= DMA_FL_PTE_PRESENT;
+ if (domain_use_first_level(domain)) {
+- attr |= DMA_FL_PTE_PRESENT | DMA_FL_PTE_XD | DMA_FL_PTE_US;
++ attr |= DMA_FL_PTE_XD | DMA_FL_PTE_US;
+
+ if (domain->domain.type == IOMMU_DOMAIN_DMA) {
+ attr |= DMA_FL_PTE_ACCESS;
+--
+2.30.2
+
--- /dev/null
+From e4eb53d4ee23fa9cca36fe34ee594cc2a8ff8d17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 10:11:45 +0800
+Subject: iommu/vt-d: Report right snoop capability when using FL for IOVA
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 6c00612d0cba10f7d0917cf1f73c945003ed4cd7 ]
+
+The Intel VT-d driver checks wrong register to report snoop capablility
+when using first level page table for GPA to HPA translation. This might
+lead the IOMMU driver to say that it supports snooping control, but in
+reality, it does not. Fix this by always setting PASID-table-entry.PGSNP
+whenever a pasid entry is setting up for GPA to HPA translation so that
+the IOMMU driver could report snoop capability as long as it runs in the
+scalable mode.
+
+Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level")
+Suggested-by: Rajesh Sankaran <rajesh.sankaran@intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Suggested-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210330021145.13824-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 12 +++++++++++-
+ drivers/iommu/intel/pasid.c | 16 ++++++++++++++++
+ drivers/iommu/intel/pasid.h | 1 +
+ 3 files changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 66fab7944b39..b5d3301b2700 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -657,7 +657,14 @@ static int domain_update_iommu_snooping(struct intel_iommu *skip)
+ rcu_read_lock();
+ for_each_active_iommu(iommu, drhd) {
+ if (iommu != skip) {
+- if (!ecap_sc_support(iommu->ecap)) {
++ /*
++ * If the hardware is operating in the scalable mode,
++ * the snooping control is always supported since we
++ * always set PASID-table-entry.PGSNP bit if the domain
++ * is managed outside (UNMANAGED).
++ */
++ if (!sm_supported(iommu) &&
++ !ecap_sc_support(iommu->ecap)) {
+ ret = 0;
+ break;
+ }
+@@ -2528,6 +2535,9 @@ static int domain_setup_first_level(struct intel_iommu *iommu,
+
+ flags |= (level == 5) ? PASID_FLAG_FL5LP : 0;
+
++ if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED)
++ flags |= PASID_FLAG_PAGE_SNOOP;
++
+ return intel_pasid_setup_first_level(iommu, dev, (pgd_t *)pgd, pasid,
+ domain->iommu_did[iommu->seq_id],
+ flags);
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index f26cb6195b2c..5093d317ff1a 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -411,6 +411,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value)
+ pasid_set_bits(&pe->val[1], 1 << 23, value << 23);
+ }
+
++/*
++ * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode
++ * PASID entry.
++ */
++static inline void
++pasid_set_pgsnp(struct pasid_entry *pe)
++{
++ pasid_set_bits(&pe->val[1], 1ULL << 24, 1ULL << 24);
++}
++
+ /*
+ * Setup the First Level Page table Pointer field (Bit 140~191)
+ * of a scalable mode PASID entry.
+@@ -565,6 +575,9 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu,
+ }
+ }
+
++ if (flags & PASID_FLAG_PAGE_SNOOP)
++ pasid_set_pgsnp(pte);
++
+ pasid_set_domain_id(pte, did);
+ pasid_set_address_width(pte, iommu->agaw);
+ pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap));
+@@ -643,6 +656,9 @@ int intel_pasid_setup_second_level(struct intel_iommu *iommu,
+ pasid_set_fault_enable(pte);
+ pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap));
+
++ if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED)
++ pasid_set_pgsnp(pte);
++
+ /*
+ * Since it is a second level only translation setup, we should
+ * set SRE bit as well (addresses are expected to be GPAs).
+diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
+index 444c0bec221a..086ebd697319 100644
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -48,6 +48,7 @@
+ */
+ #define PASID_FLAG_SUPERVISOR_MODE BIT(0)
+ #define PASID_FLAG_NESTED BIT(1)
++#define PASID_FLAG_PAGE_SNOOP BIT(2)
+
+ /*
+ * The PASID_FLAG_FL5LP flag Indicates using 5-level paging for first-
+--
+2.30.2
+
--- /dev/null
+From 9a4c9b3bdb9dc603e18ad2ee0e54b9779f344d95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 10:54:11 +0800
+Subject: iommu/vt-d: Report the right page fault address
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 03d205094af45bca4f8e0498c461a893aa3ec6d9 ]
+
+The Address field of the Page Request Descriptor only keeps bit [63:12]
+of the offending address. Convert it to a full address before reporting
+it to device drivers.
+
+Fixes: eb8d93ea3c1d3 ("iommu/vt-d: Report page request faults for guest SVA")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210320025415.641201-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 547a6cf57057..ecb6314fdd5c 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -862,7 +862,7 @@ intel_svm_prq_report(struct device *dev, struct page_req_dsc *desc)
+ /* Fill in event data for device specific processing */
+ memset(&event, 0, sizeof(struct iommu_fault_event));
+ event.fault.type = IOMMU_FAULT_PAGE_REQ;
+- event.fault.prm.addr = desc->addr;
++ event.fault.prm.addr = (u64)desc->addr << VTD_PAGE_SHIFT;
+ event.fault.prm.pasid = desc->pasid;
+ event.fault.prm.grpid = desc->prg_index;
+ event.fault.prm.perm = prq_to_iommu_prot(desc);
+--
+2.30.2
+
--- /dev/null
+From e8b2e33d77ffb11daf30b557545173788832bb3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 14:18:35 +0100
+Subject: irqchip/gic-v3: Fix OF_BAD_ADDR error handling
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e13d96670a4c050d4883e6743a9e9858e5cfe10 ]
+
+When building with extra warnings enabled, clang points out a
+mistake in the error handling:
+
+drivers/irqchip/irq-gic-v3-mbi.c:306:21: error: result of comparison of constant 18446744073709551615 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
+ if (mbi_phys_base == OF_BAD_ADDR) {
+
+Truncate the constant to the same type as the variable it gets compared
+to, to shut make the check work and void the warning.
+
+Fixes: 505287525c24 ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210323131842.2773094-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-mbi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
+index 563a9b366294..e81e89a81cb5 100644
+--- a/drivers/irqchip/irq-gic-v3-mbi.c
++++ b/drivers/irqchip/irq-gic-v3-mbi.c
+@@ -303,7 +303,7 @@ int __init mbi_init(struct fwnode_handle *fwnode, struct irq_domain *parent)
+ reg = of_get_property(np, "mbi-alias", NULL);
+ if (reg) {
+ mbi_phys_base = of_translate_address(np, reg);
+- if (mbi_phys_base == OF_BAD_ADDR) {
++ if (mbi_phys_base == (phys_addr_t)OF_BAD_ADDR) {
+ ret = -ENXIO;
+ goto err_free_mbi;
+ }
+--
+2.30.2
+
--- /dev/null
+From 7c76c27f649a529404481fd81767a926865e53be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Apr 2021 13:25:44 +0300
+Subject: iwlwifi: dbg: disable ini debug in 9000 family and below
+
+From: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
+
+[ Upstream commit 7c81a025054cd0aeeeaf17aba2e9757f0a6a38a1 ]
+
+Yoyo based debug is not applicable to old devices. As init debug is
+enabled by default in the driver, it needs to be disabled to work the
+old debug mechanism in old devices.
+
+Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
+Fixes: b0d8d2c27007 ("iwlwifi: yoyo: enable yoyo by default")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210411132130.805401a1b8ec.I30db38184a418cfc1c5ca1a305cc14a52501d415@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 579bc81cc0ae..4cd8c39cc3e9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2018-2020 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+ */
+ #include <linux/firmware.h>
+ #include "iwl-drv.h"
+@@ -426,7 +426,8 @@ void iwl_dbg_tlv_load_bin(struct device *dev, struct iwl_trans *trans)
+ const struct firmware *fw;
+ int res;
+
+- if (!iwlwifi_mod_params.enable_ini)
++ if (!iwlwifi_mod_params.enable_ini ||
++ trans->trans_cfg->device_family <= IWL_DEVICE_FAMILY_9000)
+ return;
+
+ res = firmware_request_nowarn(&fw, "iwl-debug-yoyo.bin", dev);
+--
+2.30.2
+
--- /dev/null
+From 6ea6b26912a3469d178ad224616612ded32c164d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Apr 2021 12:46:30 +0300
+Subject: iwlwifi: rs-fw: don't support stbc for HE 160
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit a9174578262b86f15cb1882f35e53b1fae0649fd ]
+
+Our HE doesn't support it so never set HE 160 stbc
+
+Fixes: 3e467b8e4cf4 ("iwlwifi: rs-fw: enable STBC in he correctly")
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210411124418.550fd1903eb7.I8ddbc2f87044a5ef78d916c9c59be797811a1b7f@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mvm/rs-fw.c | 20 ++++++++-----------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+index 8772b65c9dab..2d58cb969918 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+ * Copyright (C) 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018-2020 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+ */
+ #include "rs.h"
+ #include "fw-api.h"
+@@ -72,19 +72,15 @@ static u16 rs_fw_get_config_flags(struct iwl_mvm *mvm,
+ bool vht_ena = vht_cap->vht_supported;
+ u16 flags = 0;
+
++ /* get STBC flags */
+ if (mvm->cfg->ht_params->stbc &&
+ (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1)) {
+- if (he_cap->has_he) {
+- if (he_cap->he_cap_elem.phy_cap_info[2] &
+- IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
+- flags |= IWL_TLC_MNG_CFG_FLAGS_STBC_MSK;
+-
+- if (he_cap->he_cap_elem.phy_cap_info[7] &
+- IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
+- flags |= IWL_TLC_MNG_CFG_FLAGS_HE_STBC_160MHZ_MSK;
+- } else if ((ht_cap->cap & IEEE80211_HT_CAP_RX_STBC) ||
+- (vht_ena &&
+- (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK)))
++ if (he_cap->has_he && he_cap->he_cap_elem.phy_cap_info[2] &
++ IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
++ flags |= IWL_TLC_MNG_CFG_FLAGS_STBC_MSK;
++ else if (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK)
++ flags |= IWL_TLC_MNG_CFG_FLAGS_STBC_MSK;
++ else if (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC)
+ flags |= IWL_TLC_MNG_CFG_FLAGS_STBC_MSK;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 8a574b1cd581716c43d61042324efd8fdf868237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:54:15 -0700
+Subject: kfifo: fix ternary sign extension bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]
+
+The intent with this code was to return negative error codes but instead
+it returns positives.
+
+The problem is how type promotion works with ternary operations. These
+functions return long, "ret" is an int and "copied" is a u32. The
+negative error code is first cast to u32 so it becomes a high positive and
+then cast to long where it's still a positive.
+
+We could fix this by declaring "ret" as a ssize_t but let's just get rid
+of the ternaries instead.
+
+Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda
+Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/kfifo/bytestream-example.c | 8 ++++++--
+ samples/kfifo/inttype-example.c | 8 ++++++--
+ samples/kfifo/record-example.c | 8 ++++++--
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c
+index c406f03ee551..5a90aa527877 100644
+--- a/samples/kfifo/bytestream-example.c
++++ b/samples/kfifo/bytestream-example.c
+@@ -122,8 +122,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -138,8 +140,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct proc_ops fifo_proc_ops = {
+diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c
+index 78977fc4a23f..e5403d8c971a 100644
+--- a/samples/kfifo/inttype-example.c
++++ b/samples/kfifo/inttype-example.c
+@@ -115,8 +115,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -131,8 +133,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct proc_ops fifo_proc_ops = {
+diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c
+index c507998a2617..f64f3d62d6c2 100644
+--- a/samples/kfifo/record-example.c
++++ b/samples/kfifo/record-example.c
+@@ -129,8 +129,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -145,8 +147,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct proc_ops fifo_proc_ops = {
+--
+2.30.2
+
--- /dev/null
+From 264f1082d2f5a1465bd7d156a79e333c8b441ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 10:18:17 +0200
+Subject: kthread: Fix PF_KTHREAD vs to_kthread() race
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 3a7956e25e1d7b3c148569e78895e1f3178122a9 ]
+
+The kthread_is_per_cpu() construct relies on only being called on
+PF_KTHREAD tasks (per the WARN in to_kthread). This gives rise to the
+following usage pattern:
+
+ if ((p->flags & PF_KTHREAD) && kthread_is_per_cpu(p))
+
+However, as reported by syzcaller, this is broken. The scenario is:
+
+ CPU0 CPU1 (running p)
+
+ (p->flags & PF_KTHREAD) // true
+
+ begin_new_exec()
+ me->flags &= ~(PF_KTHREAD|...);
+ kthread_is_per_cpu(p)
+ to_kthread(p)
+ WARN(!(p->flags & PF_KTHREAD) <-- *SPLAT*
+
+Introduce __to_kthread() that omits the WARN and is sure to check both
+values.
+
+Use this to remove the problematic pattern for kthread_is_per_cpu()
+and fix a number of other kthread_*() functions that have similar
+issues but are currently not used in ways that would expose the
+problem.
+
+Notably kthread_func() is only ever called on 'current', while
+kthread_probe_data() is only used for PF_WQ_WORKER, which implies the
+task is from kthread_create*().
+
+Fixes: ac687e6e8c26 ("kthread: Extract KTHREAD_IS_PER_CPU")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Valentin Schneider <Valentin.Schneider@arm.com>
+Link: https://lkml.kernel.org/r/YH6WJc825C4P0FCK@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kthread.c | 33 +++++++++++++++++++++++++++------
+ kernel/sched/core.c | 2 +-
+ kernel/sched/fair.c | 2 +-
+ 3 files changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 1578973c5740..6d3c488a0f82 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -84,6 +84,25 @@ static inline struct kthread *to_kthread(struct task_struct *k)
+ return (__force void *)k->set_child_tid;
+ }
+
++/*
++ * Variant of to_kthread() that doesn't assume @p is a kthread.
++ *
++ * Per construction; when:
++ *
++ * (p->flags & PF_KTHREAD) && p->set_child_tid
++ *
++ * the task is both a kthread and struct kthread is persistent. However
++ * PF_KTHREAD on it's own is not, kernel_thread() can exec() (See umh.c and
++ * begin_new_exec()).
++ */
++static inline struct kthread *__to_kthread(struct task_struct *p)
++{
++ void *kthread = (__force void *)p->set_child_tid;
++ if (kthread && !(p->flags & PF_KTHREAD))
++ kthread = NULL;
++ return kthread;
++}
++
+ void free_kthread_struct(struct task_struct *k)
+ {
+ struct kthread *kthread;
+@@ -168,8 +187,9 @@ EXPORT_SYMBOL_GPL(kthread_freezable_should_stop);
+ */
+ void *kthread_func(struct task_struct *task)
+ {
+- if (task->flags & PF_KTHREAD)
+- return to_kthread(task)->threadfn;
++ struct kthread *kthread = __to_kthread(task);
++ if (kthread)
++ return kthread->threadfn;
+ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(kthread_func);
+@@ -199,10 +219,11 @@ EXPORT_SYMBOL_GPL(kthread_data);
+ */
+ void *kthread_probe_data(struct task_struct *task)
+ {
+- struct kthread *kthread = to_kthread(task);
++ struct kthread *kthread = __to_kthread(task);
+ void *data = NULL;
+
+- copy_from_kernel_nofault(&data, &kthread->data, sizeof(data));
++ if (kthread)
++ copy_from_kernel_nofault(&data, &kthread->data, sizeof(data));
+ return data;
+ }
+
+@@ -514,9 +535,9 @@ void kthread_set_per_cpu(struct task_struct *k, int cpu)
+ set_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
+ }
+
+-bool kthread_is_per_cpu(struct task_struct *k)
++bool kthread_is_per_cpu(struct task_struct *p)
+ {
+- struct kthread *kthread = to_kthread(k);
++ struct kthread *kthread = __to_kthread(p);
+ if (!kthread)
+ return false;
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 98191218d891..17ad829a114c 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7652,7 +7652,7 @@ static void balance_push(struct rq *rq)
+ * histerical raisins.
+ */
+ if (rq->idle == push_task ||
+- ((push_task->flags & PF_KTHREAD) && kthread_is_per_cpu(push_task)) ||
++ kthread_is_per_cpu(push_task) ||
+ is_migration_disabled(push_task)) {
+
+ /*
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index b5ffe808b07b..d078767f677f 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7608,7 +7608,7 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env)
+ return 0;
+
+ /* Disregard pcpu kthreads; they are where they need to be. */
+- if ((p->flags & PF_KTHREAD) && kthread_is_per_cpu(p))
++ if (kthread_is_per_cpu(p))
+ return 0;
+
+ if (!cpumask_test_cpu(env->dst_cpu, p->cpus_ptr)) {
+--
+2.30.2
+
--- /dev/null
+From cab71633ef1953ea9fe74b3e5279ecec9d4997d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 12:17:59 +0000
+Subject: KVM: arm64: Fix error return code in init_hyp_mode()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 52b9e265d22bccc5843e167da76ab119874e2883 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: eeeee7193df0 ("KVM: arm64: Bootstrap PSCI SMC handler in nVHE EL2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210406121759.5407-1-wangwensheng4@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/arm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
+index 7f06ba76698d..85261015ce5d 100644
+--- a/arch/arm64/kvm/arm.c
++++ b/arch/arm64/kvm/arm.c
+@@ -1808,8 +1808,10 @@ static int init_hyp_mode(void)
+ if (is_protected_kvm_enabled()) {
+ init_cpu_logical_map();
+
+- if (!init_psci_relay())
++ if (!init_psci_relay()) {
++ err = -ENODEV;
+ goto out_err;
++ }
+ }
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 9fa9b1cb139ddf767c361cded239439c7b1ead1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 15:48:57 +0100
+Subject: KVM: arm64: Initialize VCPU mdcr_el2 before loading it
+
+From: Alexandru Elisei <alexandru.elisei@arm.com>
+
+[ Upstream commit 263d6287da1433aba11c5b4046388f2cdf49675c ]
+
+When a VCPU is created, the kvm_vcpu struct is initialized to zero in
+kvm_vm_ioctl_create_vcpu(). On VHE systems, the first time
+vcpu.arch.mdcr_el2 is loaded on hardware is in vcpu_load(), before it is
+set to a sensible value in kvm_arm_setup_debug() later in the run loop. The
+result is that KVM executes for a short time with MDCR_EL2 set to zero.
+
+This has several unintended consequences:
+
+* Setting MDCR_EL2.HPMN to 0 is constrained unpredictable according to ARM
+ DDI 0487G.a, page D13-3820. The behavior specified by the architecture
+ in this case is for the PE to behave as if MDCR_EL2.HPMN is set to a
+ value less than or equal to PMCR_EL0.N, which means that an unknown
+ number of counters are now disabled by MDCR_EL2.HPME, which is zero.
+
+* The host configuration for the other debug features controlled by
+ MDCR_EL2 is temporarily lost. This has been harmless so far, as Linux
+ doesn't use the other fields, but that might change in the future.
+
+Let's avoid both issues by initializing the VCPU's mdcr_el2 field in
+kvm_vcpu_vcpu_first_run_init(), thus making sure that the MDCR_EL2 register
+has a consistent value after each vcpu_load().
+
+Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions")
+Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210407144857.199746-3-alexandru.elisei@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/kvm_host.h | 1 +
+ arch/arm64/kvm/arm.c | 2 +
+ arch/arm64/kvm/debug.c | 88 +++++++++++++++++++++----------
+ 3 files changed, 63 insertions(+), 28 deletions(-)
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 3d10e6527f7d..858c2fcfc043 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -713,6 +713,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {}
+
+ void kvm_arm_init_debug(void);
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_clear_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu);
+diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
+index 85261015ce5d..84b5f79c9eab 100644
+--- a/arch/arm64/kvm/arm.c
++++ b/arch/arm64/kvm/arm.c
+@@ -580,6 +580,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.has_run_once = true;
+
++ kvm_arm_vcpu_init_debug(vcpu);
++
+ if (likely(irqchip_in_kernel(kvm))) {
+ /*
+ * Map the VGIC hardware resources before running a vcpu the
+diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
+index dbc890511631..2484b2cca74b 100644
+--- a/arch/arm64/kvm/debug.c
++++ b/arch/arm64/kvm/debug.c
+@@ -68,6 +68,64 @@ void kvm_arm_init_debug(void)
+ __this_cpu_write(mdcr_el2, kvm_call_hyp_ret(__kvm_get_mdcr_el2));
+ }
+
++/**
++ * kvm_arm_setup_mdcr_el2 - configure vcpu mdcr_el2 value
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * This ensures we will trap access to:
++ * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
++ * - Debug ROM Address (MDCR_EL2_TDRA)
++ * - OS related registers (MDCR_EL2_TDOSA)
++ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ */
++static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu)
++{
++ /*
++ * This also clears MDCR_EL2_E2PB_MASK to disable guest access
++ * to the profiling buffer.
++ */
++ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
++ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
++ MDCR_EL2_TPMS |
++ MDCR_EL2_TTRF |
++ MDCR_EL2_TPMCR |
++ MDCR_EL2_TDRA |
++ MDCR_EL2_TDOSA);
++
++ /* Is the VM being debugged by userspace? */
++ if (vcpu->guest_debug)
++ /* Route all software debug exceptions to EL2 */
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
++
++ /*
++ * Trap debug register access when one of the following is true:
++ * - Userspace is using the hardware to debug the guest
++ * (KVM_GUESTDBG_USE_HW is set).
++ * - The guest is not using debug (KVM_ARM64_DEBUG_DIRTY is clear).
++ */
++ if ((vcpu->guest_debug & KVM_GUESTDBG_USE_HW) ||
++ !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY))
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
++
++ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
++}
++
++/**
++ * kvm_arm_vcpu_init_debug - setup vcpu debug traps
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * Set vcpu initial mdcr_el2 value.
++ */
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu)
++{
++ preempt_disable();
++ kvm_arm_setup_mdcr_el2(vcpu);
++ preempt_enable();
++}
++
+ /**
+ * kvm_arm_reset_debug_ptr - reset the debug ptr to point to the vcpu state
+ */
+@@ -83,13 +141,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+ * @vcpu: the vcpu pointer
+ *
+ * This is called before each entry into the hypervisor to setup any
+- * debug related registers. Currently this just ensures we will trap
+- * access to:
+- * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
+- * - Debug ROM Address (MDCR_EL2_TDRA)
+- * - OS related registers (MDCR_EL2_TDOSA)
+- * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
+- * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ * debug related registers.
+ *
+ * Additionally, KVM only traps guest accesses to the debug registers if
+ * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY
+@@ -101,28 +153,14 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ {
+- bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY);
+ unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2;
+
+ trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug);
+
+- /*
+- * This also clears MDCR_EL2_E2PB_MASK to disable guest access
+- * to the profiling buffer.
+- */
+- vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
+- vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
+- MDCR_EL2_TPMS |
+- MDCR_EL2_TTRF |
+- MDCR_EL2_TPMCR |
+- MDCR_EL2_TDRA |
+- MDCR_EL2_TDOSA);
++ kvm_arm_setup_mdcr_el2(vcpu);
+
+ /* Is Guest debugging in effect? */
+ if (vcpu->guest_debug) {
+- /* Route all software debug exceptions to EL2 */
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
+-
+ /* Save guest debug state */
+ save_guest_debug_regs(vcpu);
+
+@@ -176,7 +214,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.debug_ptr = &vcpu->arch.external_debug_state;
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+- trap_debug = true;
+
+ trace_kvm_arm_set_regset("BKPTS", get_num_brps(),
+ &vcpu->arch.debug_ptr->dbg_bcr[0],
+@@ -191,10 +228,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ BUG_ON(!vcpu->guest_debug &&
+ vcpu->arch.debug_ptr != &vcpu->arch.vcpu_debug_state);
+
+- /* Trap debug register access */
+- if (trap_debug)
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
+-
+ /* If KDE or MDE are set, perform a full save/restore cycle. */
+ if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE))
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+@@ -203,7 +236,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2)
+ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
+
+- trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
+ trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1));
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d209e83463872be62cb7f6fb1269f6483dfe30e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 11:48:34 +1000
+Subject: KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 5088eb4092df12d701af8e0e92860b7186365279 ]
+
+The host CTRL (runlatch) value is not restored after guest exit. The
+host CTRL should always be 1 except in CPU idle code, so this can result
+in the host running with runlatch clear, and potentially switching to
+a different vCPU which then runs with runlatch clear as well.
+
+This has little effect on P9 machines, CTRL is only responsible for some
+PMU counter logic in the host and so other than corner cases of software
+relying on that, or explicitly reading the runlatch value (Linux does
+not appear to be affected but it's possible non-Linux guests could be),
+there should be no execution correctness problem, though it could be
+used as a covert channel between guests.
+
+There may be microcontrollers, firmware or monitoring tools that sample
+the runlatch value out-of-band, however since the register is writable
+by guests, these values would (should) not be relied upon for correct
+operation of the host, so suboptimal performance or incorrect reporting
+should be the worst problem.
+
+Fixes: 95a6432ce9038 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210412014845.1517916-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 13bad6bf4c95..208a053c9adf 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -3728,7 +3728,10 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
+ vcpu->arch.dec_expires = dec + tb;
+ vcpu->cpu = -1;
+ vcpu->arch.thread_cpu = -1;
++ /* Save guest CTRL register, set runlatch to 1 */
+ vcpu->arch.ctrl = mfspr(SPRN_CTRLF);
++ if (!(vcpu->arch.ctrl & 1))
++ mtspr(SPRN_CTRLT, vcpu->arch.ctrl | 1);
+
+ vcpu->arch.iamr = mfspr(SPRN_IAMR);
+ vcpu->arch.pspb = mfspr(SPRN_PSPB);
+--
+2.30.2
+
--- /dev/null
+From c63c185c5f11fbf4d38e9abec8919fc8e3acf1b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 19:11:13 -0700
+Subject: KVM: SVM: Disable SEV/SEV-ES if NPT is disabled
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit fa13680f5668cff05302a2f4753c49334a83a064 ]
+
+Disable SEV and SEV-ES if NPT is disabled. While the APM doesn't clearly
+state that NPT is mandatory, it's alluded to by:
+
+ The guest page tables, managed by the guest, may mark data memory pages
+ as either private or shared, thus allowing selected pages to be shared
+ outside the guest.
+
+And practically speaking, shadow paging can't work since KVM can't read
+the guest's page tables.
+
+Fixes: e9df09428996 ("KVM: SVM: Add sev module_param")
+Cc: Brijesh Singh <brijesh.singh@amd.com
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422021125.3417167-4-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/svm.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index d5620361eae7..309725151313 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -968,21 +968,6 @@ static __init int svm_hardware_setup(void)
+ kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
+ }
+
+- if (IS_ENABLED(CONFIG_KVM_AMD_SEV) && sev) {
+- sev_hardware_setup();
+- } else {
+- sev = false;
+- sev_es = false;
+- }
+-
+- svm_adjust_mmio_mask();
+-
+- for_each_possible_cpu(cpu) {
+- r = svm_cpu_init(cpu);
+- if (r)
+- goto err;
+- }
+-
+ /*
+ * KVM's MMU doesn't support using 2-level paging for itself, and thus
+ * NPT isn't supported if the host is using 2-level paging since host
+@@ -997,6 +982,21 @@ static __init int svm_hardware_setup(void)
+ kvm_configure_mmu(npt_enabled, get_max_npt_level(), PG_LEVEL_1G);
+ pr_info("kvm: Nested Paging %sabled\n", npt_enabled ? "en" : "dis");
+
++ if (IS_ENABLED(CONFIG_KVM_AMD_SEV) && sev && npt_enabled) {
++ sev_hardware_setup();
++ } else {
++ sev = false;
++ sev_es = false;
++ }
++
++ svm_adjust_mmio_mask();
++
++ for_each_possible_cpu(cpu) {
++ r = svm_cpu_init(cpu);
++ if (r)
++ goto err;
++ }
++
+ if (nrips) {
+ if (!boot_cpu_has(X86_FEATURE_NRIPS))
+ nrips = false;
+--
+2.30.2
+
--- /dev/null
+From e57dabd9637ee4636dd61949aad7a444dcbfba8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 19:11:12 -0700
+Subject: KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit f31b88b35f90f6b7ae4abc1015494a285f459221 ]
+
+Free sev_asid_bitmap if the reclaim bitmap allocation fails, othwerise
+KVM will unnecessarily keep the bitmap when SEV is not fully enabled.
+
+Freeing the page is also necessary to avoid introducing a bug when a
+future patch eliminates svm_sev_enabled() in favor of using the global
+'sev' flag directly. While sev_hardware_enabled() checks max_sev_asid,
+which is true even if KVM setup fails, 'sev' will be true if and only
+if KVM setup fully succeeds.
+
+Fixes: 33af3a7ef9e6 ("KVM: SVM: Reduce WBINVD/DF_FLUSH invocations")
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422021125.3417167-3-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/sev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
+index d5ccb929643a..019130011d0f 100644
+--- a/arch/x86/kvm/svm/sev.c
++++ b/arch/x86/kvm/svm/sev.c
+@@ -1348,8 +1348,11 @@ void __init sev_hardware_setup(void)
+ goto out;
+
+ sev_reclaim_asid_bitmap = bitmap_zalloc(max_sev_asid, GFP_KERNEL);
+- if (!sev_reclaim_asid_bitmap)
++ if (!sev_reclaim_asid_bitmap) {
++ bitmap_free(sev_asid_bitmap);
++ sev_asid_bitmap = NULL;
+ goto out;
++ }
+
+ pr_info("SEV supported: %u ASIDs\n", max_sev_asid - min_sev_asid + 1);
+ sev_supported = true;
+--
+2.30.2
+
--- /dev/null
+From a904bd927c5694e58da5d57806bebebaa715bd9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 19:11:11 -0700
+Subject: KVM: SVM: Zero out the VMCB array used to track SEV ASID association
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 3b1902b87bf11f1c6a84368470dc13da6f3da3bd ]
+
+Zero out the array of VMCB pointers so that pre_sev_run() won't see
+garbage when querying the array to detect when an SEV ASID is being
+associated with a new VMCB. In practice, reading random values is all
+but guaranteed to be benign as a false negative (which is extremely
+unlikely on its own) can only happen on CPU0 on the first VMRUN and would
+only cause KVM to skip the ASID flush. For anything bad to happen, a
+previous instance of KVM would have to exit without flushing the ASID,
+_and_ KVM would have to not flush the ASID at any time while building the
+new SEV guest.
+
+Cc: Borislav Petkov <bp@suse.de>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
+Fixes: 70cd94e60c73 ("KVM: SVM: VMRUN should use associated ASID when SEV is enabled")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422021125.3417167-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/svm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index 9c260c73f334..d5620361eae7 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -564,9 +564,8 @@ static int svm_cpu_init(int cpu)
+ clear_page(page_address(sd->save_area));
+
+ if (svm_sev_enabled()) {
+- sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1,
+- sizeof(void *),
+- GFP_KERNEL);
++ sd->sev_vmcbs = kcalloc(max_sev_asid + 1, sizeof(void *),
++ GFP_KERNEL);
+ if (!sd->sev_vmcbs)
+ goto free_save_area;
+ }
+--
+2.30.2
+
--- /dev/null
+From 2f4954b4b80856d5cf78621c2f27e58001f64b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 19:38:31 -0700
+Subject: KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit dbdd096a5a74b94f6b786a47baef2085859b0dce ]
+
+Disable pass-through of the FS and GS base MSRs for 32-bit KVM. Intel's
+SDM unequivocally states that the MSRs exist if and only if the CPU
+supports x86-64. FS_BASE and GS_BASE are mostly a non-issue; a clever
+guest could opportunistically use the MSRs without issue. KERNEL_GS_BASE
+is a bigger problem, as a clever guest would subtly be broken if it were
+migrated, as KVM disallows software access to the MSRs, and unlike the
+direct variants, KERNEL_GS_BASE needs to be explicitly migrated as it's
+not captured in the VMCS.
+
+Fixes: 25c5f225beda ("KVM: VMX: Enable MSR Bitmap feature")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210422023831.3473491-1-seanjc@google.com>
+[*NOT* for stable kernels. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx/nested.c | 2 ++
+ arch/x86/kvm/vmx/vmx.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
+index 4a44d24bf733..1727057c5313 100644
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -619,6 +619,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
+ }
+
+ /* KVM unconditionally exposes the FS/GS base MSRs to L1. */
++#ifdef CONFIG_X86_64
+ nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0,
+ MSR_FS_BASE, MSR_TYPE_RW);
+
+@@ -627,6 +628,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
+
+ nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0,
+ MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
++#endif
+
+ /*
+ * Checking the L0->L1 bitmap is trying to verify two things:
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index db50ee04ad37..f705e0d9f161 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -156,9 +156,11 @@ static u32 vmx_possible_passthrough_msrs[MAX_POSSIBLE_PASSTHROUGH_MSRS] = {
+ MSR_IA32_SPEC_CTRL,
+ MSR_IA32_PRED_CMD,
+ MSR_IA32_TSC,
++#ifdef CONFIG_X86_64
+ MSR_FS_BASE,
+ MSR_GS_BASE,
+ MSR_KERNEL_GS_BASE,
++#endif
+ MSR_IA32_SYSENTER_CS,
+ MSR_IA32_SYSENTER_ESP,
+ MSR_IA32_SYSENTER_EIP,
+@@ -6935,9 +6937,11 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu)
+ bitmap_fill(vmx->shadow_msr_intercept.write, MAX_POSSIBLE_PASSTHROUGH_MSRS);
+
+ vmx_disable_intercept_for_msr(vcpu, MSR_IA32_TSC, MSR_TYPE_R);
++#ifdef CONFIG_X86_64
+ vmx_disable_intercept_for_msr(vcpu, MSR_FS_BASE, MSR_TYPE_RW);
+ vmx_disable_intercept_for_msr(vcpu, MSR_GS_BASE, MSR_TYPE_RW);
+ vmx_disable_intercept_for_msr(vcpu, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
++#endif
+ vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
+ vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
+ vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
+--
+2.30.2
+
--- /dev/null
+From 345732d0c68efec783ab20320f3553621dd5b0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 12:08:37 +0000
+Subject: KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
+
+From: David Edmondson <david.edmondson@oracle.com>
+
+[ Upstream commit d9e46d344e62a0d56fd86a8289db5bed8a57c92e ]
+
+If the VM entry/exit controls for loading/saving MSR_EFER are either
+not available (an older processor or explicitly disabled) or not
+used (host and guest values are the same), reading GUEST_IA32_EFER
+from the VMCS returns an inaccurate value.
+
+Because of this, in dump_vmcs() don't use GUEST_IA32_EFER to decide
+whether to print the PDPTRs - always do so if the fields exist.
+
+Fixes: 4eb64dce8d0a ("KVM: x86: dump VMCS on invalid entry")
+Signed-off-by: David Edmondson <david.edmondson@oracle.com>
+Message-Id: <20210318120841.133123-2-david.edmondson@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx/vmx.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index a82b8f7a9d39..db50ee04ad37 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -5792,7 +5792,6 @@ void dump_vmcs(void)
+ u32 vmentry_ctl, vmexit_ctl;
+ u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control;
+ unsigned long cr4;
+- u64 efer;
+
+ if (!dump_invalid_vmcs) {
+ pr_warn_ratelimited("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n");
+@@ -5804,7 +5803,6 @@ void dump_vmcs(void)
+ cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+ pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL);
+ cr4 = vmcs_readl(GUEST_CR4);
+- efer = vmcs_read64(GUEST_IA32_EFER);
+ secondary_exec_control = 0;
+ if (cpu_has_secondary_exec_ctrls())
+ secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+@@ -5816,9 +5814,7 @@ void dump_vmcs(void)
+ pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
+ cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK));
+ pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3));
+- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
+- (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA))
+- {
++ if (cpu_has_vmx_ept()) {
+ pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n",
+ vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1));
+ pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
+@@ -5844,7 +5840,8 @@ void dump_vmcs(void)
+ if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) ||
+ (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER)))
+ pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
+- efer, vmcs_read64(GUEST_IA32_PAT));
++ vmcs_read64(GUEST_IA32_EFER),
++ vmcs_read64(GUEST_IA32_PAT));
+ pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n",
+ vmcs_read64(GUEST_IA32_DEBUGCTL),
+ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS));
+--
+2.30.2
+
--- /dev/null
+From 305ddea7384fc056d90ac9f63e5fe0bc596e828a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 12:47:30 -0800
+Subject: KVM: x86/mmu: Retry page faults that hit an invalid memslot
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit e0c378684b6545ad2d4403bb701d0ac4932b4e95 ]
+
+Retry page faults (re-enter the guest) that hit an invalid memslot
+instead of treating the memslot as not existing, i.e. handling the
+page fault as an MMIO access. When deleting a memslot, SPTEs aren't
+zapped and the TLBs aren't flushed until after the memslot has been
+marked invalid.
+
+Handling the invalid slot as MMIO means there's a small window where a
+page fault could replace a valid SPTE with an MMIO SPTE. The legacy
+MMU handles such a scenario cleanly, but the TDP MMU assumes such
+behavior is impossible (see the BUG() in __handle_changed_spte()).
+There's really no good reason why the legacy MMU should allow such a
+scenario, and closing this hole allows for additional cleanups.
+
+Fixes: 2f2fad0897cb ("kvm: x86/mmu: Add functions to handle changed TDP SPTEs")
+Cc: Ben Gardon <bgardon@google.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210225204749.1512652-6-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 4d37dfc0d3a8..cd0faa187674 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -3665,6 +3665,14 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
+ struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
+ bool async;
+
++ /*
++ * Retry the page fault if the gfn hit a memslot that is being deleted
++ * or moved. This ensures any existing SPTEs for the old memslot will
++ * be zapped before KVM inserts a new MMIO SPTE for the gfn.
++ */
++ if (slot && (slot->flags & KVM_MEMSLOT_INVALID))
++ return true;
++
+ /* Don't expose private memslots to L2. */
+ if (is_guest_mode(vcpu) && !kvm_is_visible_memslot(slot)) {
+ *pfn = KVM_PFN_NOSLOT;
+--
+2.30.2
+
--- /dev/null
+From 395075df244430d51696ec7813cc7d2141951443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Mar 2021 13:09:17 -0800
+Subject: libbpf: Add explicit padding to bpf_xdp_set_link_opts
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit dde7b3f5f2f458297aeccfd4783e53ab8ca046db ]
+
+Adding such anonymous padding fixes the issue with uninitialized portions of
+bpf_xdp_set_link_opts when using LIBBPF_DECLARE_OPTS macro with inline field
+initialization:
+
+DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts, .old_fd = -1);
+
+When such code is compiled in debug mode, compiler is generating code that
+leaves padding bytes uninitialized, which triggers error inside libbpf APIs
+that do strict zero initialization checks for OPTS structs.
+
+Adding anonymous padding field fixes the issue.
+
+Fixes: bd5ca3ef93cd ("libbpf: Add function to set link XDP fd while specifying old program")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210313210920.1959628-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
+index 3c35eb401931..3d690d4e785c 100644
+--- a/tools/lib/bpf/libbpf.h
++++ b/tools/lib/bpf/libbpf.h
+@@ -507,6 +507,7 @@ struct xdp_link_info {
+ struct bpf_xdp_set_link_opts {
+ size_t sz;
+ int old_fd;
++ size_t :0;
+ };
+ #define bpf_xdp_set_link_opts__last_field old_fd
+
+--
+2.30.2
+
--- /dev/null
+From cd9529cc2629e8d2b395dd24c9609dfd6d1579a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 19:21:17 +0000
+Subject: libbpf: Add explicit padding to btf_dump_emit_type_decl_opts
+
+From: KP Singh <kpsingh@kernel.org>
+
+[ Upstream commit ea24b19562fe5f72c78319dbb347b701818956d9 ]
+
+Similar to
+https://lore.kernel.org/bpf/20210313210920.1959628-2-andrii@kernel.org/
+
+When DECLARE_LIBBPF_OPTS is used with inline field initialization, e.g:
+
+ DECLARE_LIBBPF_OPTS(btf_dump_emit_type_decl_opts, opts,
+ .field_name = var_ident,
+ .indent_level = 2,
+ .strip_mods = strip_mods,
+ );
+
+and compiled in debug mode, the compiler generates code which
+leaves the padding uninitialized and triggers errors within libbpf APIs
+which require strict zero initialization of OPTS structs.
+
+Adding anonymous padding field fixes the issue.
+
+Fixes: 9f81654eebe8 ("libbpf: Expose BTF-to-C type declaration emitting API")
+Suggested-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: KP Singh <kpsingh@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210319192117.2310658-1-kpsingh@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
+index 1237bcd1dd17..5b8a6ea44b38 100644
+--- a/tools/lib/bpf/btf.h
++++ b/tools/lib/bpf/btf.h
+@@ -173,6 +173,7 @@ struct btf_dump_emit_type_decl_opts {
+ int indent_level;
+ /* strip all the const/volatile/restrict mods */
+ bool strip_mods;
++ size_t :0;
+ };
+ #define btf_dump_emit_type_decl_opts__last_field strip_mods
+
+--
+2.30.2
+
--- /dev/null
+From aadce72fd8ec043dbd52851a93a273abe143ab37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 17:52:41 +0200
+Subject: libbpf: Initialize the bpf_seq_printf parameters array field by field
+
+From: Florent Revest <revest@chromium.org>
+
+[ Upstream commit 83cd92b46484aa8f64cdc0bff8ac6940d1f78519 ]
+
+When initializing the __param array with a one liner, if all args are
+const, the initial array value will be placed in the rodata section but
+because libbpf does not support relocation in the rodata section, any
+pointer in this array will stay NULL.
+
+Fixes: c09add2fbc5a ("tools/libbpf: Add bpf_iter support")
+Signed-off-by: Florent Revest <revest@chromium.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210419155243.1632274-5-revest@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_tracing.h | 40 +++++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
+index f9ef37707888..1c2e91ee041d 100644
+--- a/tools/lib/bpf/bpf_tracing.h
++++ b/tools/lib/bpf/bpf_tracing.h
+@@ -413,20 +413,38 @@ typeof(name(0)) name(struct pt_regs *ctx) \
+ } \
+ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
+
++#define ___bpf_fill0(arr, p, x) do {} while (0)
++#define ___bpf_fill1(arr, p, x) arr[p] = x
++#define ___bpf_fill2(arr, p, x, args...) arr[p] = x; ___bpf_fill1(arr, p + 1, args)
++#define ___bpf_fill3(arr, p, x, args...) arr[p] = x; ___bpf_fill2(arr, p + 1, args)
++#define ___bpf_fill4(arr, p, x, args...) arr[p] = x; ___bpf_fill3(arr, p + 1, args)
++#define ___bpf_fill5(arr, p, x, args...) arr[p] = x; ___bpf_fill4(arr, p + 1, args)
++#define ___bpf_fill6(arr, p, x, args...) arr[p] = x; ___bpf_fill5(arr, p + 1, args)
++#define ___bpf_fill7(arr, p, x, args...) arr[p] = x; ___bpf_fill6(arr, p + 1, args)
++#define ___bpf_fill8(arr, p, x, args...) arr[p] = x; ___bpf_fill7(arr, p + 1, args)
++#define ___bpf_fill9(arr, p, x, args...) arr[p] = x; ___bpf_fill8(arr, p + 1, args)
++#define ___bpf_fill10(arr, p, x, args...) arr[p] = x; ___bpf_fill9(arr, p + 1, args)
++#define ___bpf_fill11(arr, p, x, args...) arr[p] = x; ___bpf_fill10(arr, p + 1, args)
++#define ___bpf_fill12(arr, p, x, args...) arr[p] = x; ___bpf_fill11(arr, p + 1, args)
++#define ___bpf_fill(arr, args...) \
++ ___bpf_apply(___bpf_fill, ___bpf_narg(args))(arr, 0, args)
++
+ /*
+ * BPF_SEQ_PRINTF to wrap bpf_seq_printf to-be-printed values
+ * in a structure.
+ */
+-#define BPF_SEQ_PRINTF(seq, fmt, args...) \
+- ({ \
+- _Pragma("GCC diagnostic push") \
+- _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
+- static const char ___fmt[] = fmt; \
+- unsigned long long ___param[] = { args }; \
+- _Pragma("GCC diagnostic pop") \
+- int ___ret = bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \
+- ___param, sizeof(___param)); \
+- ___ret; \
+- })
++#define BPF_SEQ_PRINTF(seq, fmt, args...) \
++({ \
++ static const char ___fmt[] = fmt; \
++ unsigned long long ___param[___bpf_narg(args)]; \
++ \
++ _Pragma("GCC diagnostic push") \
++ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
++ ___bpf_fill(___param, args); \
++ _Pragma("GCC diagnostic pop") \
++ \
++ bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \
++ ___param, sizeof(___param)); \
++})
+
+ #endif
+--
+2.30.2
+
--- /dev/null
+From 6ae7639bbef0b62bf9a1ca6c45e6553e19e0935b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:12:48 +0100
+Subject: liquidio: Fix unintented sign extension of a left shift of a u16
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ]
+
+The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port
+(a u16) left 24 places. There are two subtle issues here, first the
+shift gets promoted to an signed int and then sign extended to a u64.
+If oct->pcie_port is 0x80 or more then the upper bits get sign extended
+to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it
+needs to be cast to a u64 for all the bits to not overflow.
+
+It is entirely possible that the u16 port value is never large enough
+for this to fail, but it is useful to fix unintended overflows such
+as this.
+
+Fix this by casting the port parameter to the macro to a u64 before
+the shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 5bc67f587ba7 ("liquidio: CN23XX register definitions")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+index e6d4ad99cc38..3f1c189646f4 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+@@ -521,7 +521,7 @@
+ #define CN23XX_BAR1_INDEX_OFFSET 3
+
+ #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \
+- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \
++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \
+ ((idx) << CN23XX_BAR1_INDEX_OFFSET))
+
+ /*############################ DPI #########################*/
+--
+2.30.2
+
--- /dev/null
+From b77691708ae1a3f0477da0496435d4733cf5075f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 20:00:45 +0000
+Subject: m68k: Add missing mmap_read_lock() to sys_cacheflush()
+
+From: Liam Howlett <liam.howlett@oracle.com>
+
+[ Upstream commit f829b4b212a315b912cb23fd10aaf30534bb5ce9 ]
+
+When the superuser flushes the entire cache, the mmap_read_lock() is not
+taken, but mmap_read_unlock() is called. Add the missing
+mmap_read_lock() call.
+
+Fixes: cd2567b6850b1648 ("m68k: call find_vma with the mmap_sem held in sys_cacheflush()")
+Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Link: https://lore.kernel.org/r/20210407200032.764445-1-Liam.Howlett@Oracle.com
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/sys_m68k.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/m68k/kernel/sys_m68k.c b/arch/m68k/kernel/sys_m68k.c
+index 1c235d8f53f3..f55bdcb8e4f1 100644
+--- a/arch/m68k/kernel/sys_m68k.c
++++ b/arch/m68k/kernel/sys_m68k.c
+@@ -388,6 +388,8 @@ sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len)
+ ret = -EPERM;
+ if (!capable(CAP_SYS_ADMIN))
+ goto out;
++
++ mmap_read_lock(current->mm);
+ } else {
+ struct vm_area_struct *vma;
+
+--
+2.30.2
+
--- /dev/null
+From 32cfcb885e03c542815369d8ccd7a973f145cf9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 18:37:51 +1100
+Subject: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 43262178c043032e7c42d00de44c818ba05f9967 ]
+
+Don't clear the timer 1 configuration bits when clearing the interrupt flag
+and counter overflow. As Michael reported, "This results in no timer
+interrupts being delivered after the first. Initialization then hangs
+in calibrate_delay as the jiffies counter is not updated."
+
+On mvme16x, enable the timer after requesting the irq, consistent with
+mvme147.
+
+Cc: Michael Pavone <pavone@retrodev.com>
+Fixes: 7529b90d051e ("m68k: mvme147: Handle timer counter overflow")
+Fixes: 19999a8b8782 ("m68k: mvme16x: Handle timer counter overflow")
+Reported-and-tested-by: Michael Pavone <pavone@retrodev.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Link: https://lore.kernel.org/r/4fdaa113db089b8fb607f7dd818479f8cdcc4547.1617089871.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/include/asm/mvme147hw.h | 3 +++
+ arch/m68k/mvme147/config.c | 14 ++++++++------
+ arch/m68k/mvme16x/config.c | 14 ++++++++------
+ 3 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/arch/m68k/include/asm/mvme147hw.h b/arch/m68k/include/asm/mvme147hw.h
+index 257b29184af9..e28eb1c0e0bf 100644
+--- a/arch/m68k/include/asm/mvme147hw.h
++++ b/arch/m68k/include/asm/mvme147hw.h
+@@ -66,6 +66,9 @@ struct pcc_regs {
+ #define PCC_INT_ENAB 0x08
+
+ #define PCC_TIMER_INT_CLR 0x80
++
++#define PCC_TIMER_TIC_EN 0x01
++#define PCC_TIMER_COC_EN 0x02
+ #define PCC_TIMER_CLR_OVF 0x04
+
+ #define PCC_LEVEL_ABORT 0x07
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index cfdc7f912e14..e1e90c49a496 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -114,8 +114,10 @@ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ unsigned long flags;
+
+ local_irq_save(flags);
+- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+- m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF;
++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN |
++ PCC_TIMER_TIC_EN;
++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR |
++ PCC_LEVEL_TIMER1;
+ clk_total += PCC_TIMER_CYCLES;
+ legacy_timer_tick(1);
+ local_irq_restore(flags);
+@@ -133,10 +135,10 @@ void mvme147_sched_init (void)
+ /* Init the clock with a value */
+ /* The clock counter increments until 0xFFFF then reloads */
+ m147_pcc->t1_preload = PCC_TIMER_PRELOAD;
+- m147_pcc->t1_cntrl = 0x0; /* clear timer */
+- m147_pcc->t1_cntrl = 0x3; /* start timer */
+- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR; /* clear pending ints */
+- m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN |
++ PCC_TIMER_TIC_EN;
++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR |
++ PCC_LEVEL_TIMER1;
+
+ clocksource_register_hz(&mvme147_clk, PCC_TIMER_CLOCK_FREQ);
+ }
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 30357fe4ba6c..b59593c7cfb9 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -366,6 +366,7 @@ static u32 clk_total;
+ #define PCCTOVR1_COC_EN 0x02
+ #define PCCTOVR1_OVR_CLR 0x04
+
++#define PCCTIC1_INT_LEVEL 6
+ #define PCCTIC1_INT_CLR 0x08
+ #define PCCTIC1_INT_EN 0x10
+
+@@ -374,8 +375,8 @@ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ unsigned long flags;
+
+ local_irq_save(flags);
+- out_8(PCCTIC1, in_8(PCCTIC1) | PCCTIC1_INT_CLR);
+- out_8(PCCTOVR1, PCCTOVR1_OVR_CLR);
++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL);
+ clk_total += PCC_TIMER_CYCLES;
+ legacy_timer_tick(1);
+ local_irq_restore(flags);
+@@ -389,14 +390,15 @@ void mvme16x_sched_init(void)
+ int irq;
+
+ /* Using PCCchip2 or MC2 chip tick timer 1 */
+- out_be32(PCCTCNT1, 0);
+- out_be32(PCCTCMP1, PCC_TIMER_CYCLES);
+- out_8(PCCTOVR1, in_8(PCCTOVR1) | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
+- out_8(PCCTIC1, PCCTIC1_INT_EN | 6);
+ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, IRQF_TIMER, "timer",
+ NULL))
+ panic ("Couldn't register timer int");
+
++ out_be32(PCCTCNT1, 0);
++ out_be32(PCCTCMP1, PCC_TIMER_CYCLES);
++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL);
++
+ clocksource_register_hz(&mvme16x_clk, PCC_TIMER_CLOCK_FREQ);
+
+ if (brdno == 0x0162 || brdno == 0x172)
+--
+2.30.2
+
--- /dev/null
+From 2ccc0a6306e41c00a123c75b21de884de6611e3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 14:31:50 +0200
+Subject: mac80211: bail out if cipher schemes are invalid
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ]
+
+If any of the cipher schemes specified by the driver are invalid, bail
+out and fail the registration rather than just warning. Otherwise, we
+might later crash when we try to use the invalid cipher scheme, e.g.
+if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd
+have an out-of-bounds access in RX validation.
+
+Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support")
+Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 1b9c82616606..0331f3a3c40e 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1141,8 +1141,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ if (local->hw.wiphy->max_scan_ie_len)
+ local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+
+- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
+- local->hw.n_cipher_schemes));
++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
++ local->hw.n_cipher_schemes))) {
++ result = -EINVAL;
++ goto fail_workqueue;
++ }
+
+ result = ieee80211_init_cipher_suites(local);
+ if (result < 0)
+--
+2.30.2
+
--- /dev/null
+From 7634b048169a4d8eff2ac22e2657e23f1021861a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 14:15:35 +0800
+Subject: mailbox: sprd: Introduce refcnt when clients requests/free channels
+
+From: Orson Zhai <orson.zhai@unisoc.com>
+
+[ Upstream commit 9468ab84032f96496e998cfa173cd1d0ac316bcd ]
+
+Unisoc mailbox has no way to be enabled/disabled for any single channel.
+They can only be set to startup or shutdown as a whole device at same time.
+
+Add a variable to count references to avoid mailbox FIFO being reset
+unexpectedly when clients are requesting or freeing channels.
+
+Also add a lock to dismiss possible conflicts from register r/w in
+different startup or shutdown threads. And fix the crash problem when early
+interrupts come from channel which has not been requested by client yet.
+
+Fixes: ca27fc26cd22 ("mailbox: sprd: Add Spreadtrum mailbox driver")
+Signed-off-by: Orson Zhai <orson.zhai@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 43 +++++++++++++++++++++++-----------
+ 1 file changed, 29 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 4c325301a2fe..94d9067dc8d0 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -60,6 +60,8 @@ struct sprd_mbox_priv {
+ struct clk *clk;
+ u32 outbox_fifo_depth;
+
++ struct mutex lock;
++ u32 refcnt;
+ struct mbox_chan chan[SPRD_MBOX_CHAN_MAX];
+ };
+
+@@ -115,7 +117,11 @@ static irqreturn_t sprd_mbox_outbox_isr(int irq, void *data)
+ id = readl(priv->outbox_base + SPRD_MBOX_ID);
+
+ chan = &priv->chan[id];
+- mbox_chan_received_data(chan, (void *)msg);
++ if (chan->cl)
++ mbox_chan_received_data(chan, (void *)msg);
++ else
++ dev_warn_ratelimited(priv->dev,
++ "message's been dropped at ch[%d]\n", id);
+
+ /* Trigger to update outbox FIFO pointer */
+ writel(0x1, priv->outbox_base + SPRD_MBOX_TRIGGER);
+@@ -215,18 +221,22 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ struct sprd_mbox_priv *priv = to_sprd_mbox_priv(chan->mbox);
+ u32 val;
+
+- /* Select outbox FIFO mode and reset the outbox FIFO status */
+- writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
++ mutex_lock(&priv->lock);
++ if (priv->refcnt++ == 0) {
++ /* Select outbox FIFO mode and reset the outbox FIFO status */
++ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
+- writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
++ /* Enable inbox FIFO overflow and delivery interrupt */
++ val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
++ val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+- /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+- writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ /* Enable outbox FIFO not empty interrupt */
++ val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
++ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ }
++ mutex_unlock(&priv->lock);
+
+ return 0;
+ }
+@@ -235,9 +245,13 @@ static void sprd_mbox_shutdown(struct mbox_chan *chan)
+ {
+ struct sprd_mbox_priv *priv = to_sprd_mbox_priv(chan->mbox);
+
+- /* Disable inbox & outbox interrupt */
+- writel(SPRD_INBOX_FIFO_IRQ_MASK, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- writel(SPRD_OUTBOX_FIFO_IRQ_MASK, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ mutex_lock(&priv->lock);
++ if (--priv->refcnt == 0) {
++ /* Disable inbox & outbox interrupt */
++ writel(SPRD_INBOX_FIFO_IRQ_MASK, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
++ writel(SPRD_OUTBOX_FIFO_IRQ_MASK, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ }
++ mutex_unlock(&priv->lock);
+ }
+
+ static const struct mbox_chan_ops sprd_mbox_ops = {
+@@ -266,6 +280,7 @@ static int sprd_mbox_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ priv->dev = dev;
++ mutex_init(&priv->lock);
+
+ /*
+ * The Spreadtrum mailbox uses an inbox to send messages to the target
+--
+2.30.2
+
--- /dev/null
+From 155006a17833bd46a7a2e7ade23a1d54699419e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 23:32:25 +0100
+Subject: media: aspeed: fix clock handling logic
+
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+
+[ Upstream commit 3536169f8531c2c5b153921dc7d1ac9fd570cda7 ]
+
+Video engine uses eclk and vclk for its clock sources and its reset
+control is coupled with eclk so the current clock enabling sequence works
+like below.
+
+ Enable eclk
+ De-assert Video Engine reset
+ 10ms delay
+ Enable vclk
+
+It introduces improper reset on the Video Engine hardware and eventually
+the hardware generates unexpected DMA memory transfers that can corrupt
+memory region in random and sporadic patterns. This issue is observed
+very rarely on some specific AST2500 SoCs but it causes a critical
+kernel panic with making a various shape of signature so it's extremely
+hard to debug. Moreover, the issue is observed even when the video
+engine is not actively used because udevd turns on the video engine
+hardware for a short time to make a query in every boot.
+
+To fix this issue, this commit changes the clock handling logic to make
+the reset de-assertion triggered after enabling both eclk and vclk. Also,
+it adds clk_unprepare call for a case when probe fails.
+
+clk: ast2600: fix reset settings for eclk and vclk
+Video engine reset setting should be coupled with eclk to match it
+with the setting for previous Aspeed SoCs which is defined in
+clk-aspeed.c since all Aspeed SoCs are sharing a single video engine
+driver. Also, reset bit 6 is defined as 'Video Engine' reset in
+datasheet so it should be de-asserted when eclk is enabled. This
+commit fixes the setting.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-ast2600.c | 4 ++--
+ drivers/media/platform/aspeed-video.c | 9 ++++++---
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
+index a55b37fc2c8b..bc3be5f3eae1 100644
+--- a/drivers/clk/clk-ast2600.c
++++ b/drivers/clk/clk-ast2600.c
+@@ -61,10 +61,10 @@ static void __iomem *scu_g6_base;
+ static const struct aspeed_gate_data aspeed_g6_gates[] = {
+ /* clk rst name parent flags */
+ [ASPEED_CLK_GATE_MCLK] = { 0, -1, "mclk-gate", "mpll", CLK_IS_CRITICAL }, /* SDRAM */
+- [ASPEED_CLK_GATE_ECLK] = { 1, -1, "eclk-gate", "eclk", 0 }, /* Video Engine */
++ [ASPEED_CLK_GATE_ECLK] = { 1, 6, "eclk-gate", "eclk", 0 }, /* Video Engine */
+ [ASPEED_CLK_GATE_GCLK] = { 2, 7, "gclk-gate", NULL, 0 }, /* 2D engine */
+ /* vclk parent - dclk/d1clk/hclk/mclk */
+- [ASPEED_CLK_GATE_VCLK] = { 3, 6, "vclk-gate", NULL, 0 }, /* Video Capture */
++ [ASPEED_CLK_GATE_VCLK] = { 3, -1, "vclk-gate", NULL, 0 }, /* Video Capture */
+ [ASPEED_CLK_GATE_BCLK] = { 4, 8, "bclk-gate", "bclk", 0 }, /* PCIe/PCI */
+ /* From dpll */
+ [ASPEED_CLK_GATE_DCLK] = { 5, -1, "dclk-gate", NULL, CLK_IS_CRITICAL }, /* DAC */
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index f2c4dadd6a0e..7bb6babdcade 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -514,8 +514,8 @@ static void aspeed_video_off(struct aspeed_video *video)
+ aspeed_video_write(video, VE_INTERRUPT_STATUS, 0xffffffff);
+
+ /* Turn off the relevant clocks */
+- clk_disable(video->vclk);
+ clk_disable(video->eclk);
++ clk_disable(video->vclk);
+
+ clear_bit(VIDEO_CLOCKS_ON, &video->flags);
+ }
+@@ -526,8 +526,8 @@ static void aspeed_video_on(struct aspeed_video *video)
+ return;
+
+ /* Turn on the relevant clocks */
+- clk_enable(video->eclk);
+ clk_enable(video->vclk);
++ clk_enable(video->eclk);
+
+ set_bit(VIDEO_CLOCKS_ON, &video->flags);
+ }
+@@ -1719,8 +1719,11 @@ static int aspeed_video_probe(struct platform_device *pdev)
+ return rc;
+
+ rc = aspeed_video_setup_video(video);
+- if (rc)
++ if (rc) {
++ clk_unprepare(video->vclk);
++ clk_unprepare(video->eclk);
+ return rc;
++ }
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 1393cbf49c504c607cf612364ba1980123dad828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 12:53:31 +0100
+Subject: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ba11bbf303fafb33989e95473e409f6ab412b18d ]
+
+The "s3a_buf" is freed along with all the other items on the
+"asd->s3a_stats" list. It leads to a double free and a use after free.
+
+Link: https://lore.kernel.org/linux-media/X9dSO3RGf7r0pq2k@mwanda
+Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+index 2ae50decfc8b..9da82855552d 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+@@ -948,10 +948,8 @@ int atomisp_alloc_css_stat_bufs(struct atomisp_sub_device *asd,
+ dev_dbg(isp->dev, "allocating %d dis buffers\n", count);
+ while (count--) {
+ dis_buf = kzalloc(sizeof(struct atomisp_dis_buf), GFP_KERNEL);
+- if (!dis_buf) {
+- kfree(s3a_buf);
++ if (!dis_buf)
+ goto error;
+- }
+ if (atomisp_css_allocate_stat_buffers(
+ asd, stream_id, NULL, dis_buf, NULL)) {
+ kfree(dis_buf);
+--
+2.30.2
+
--- /dev/null
+From 5ed7cf1013de3ad99ca1d5c3c36482554ecfcfc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Sep 2020 17:08:04 +0200
+Subject: media: atomisp: Fixed error handling path
+
+From: Souptick Joarder <jrdr.linux@gmail.com>
+
+[ Upstream commit 16a5dcf7fbc2f5cd10c1e6264262bfa3832fb7d5 ]
+
+Inside alloc_user_pages() based on flag value either pin_user_pages()
+or get_user_pages_fast() will be called. However, these API might fail.
+
+But free_user_pages() called in error handling path doesn't bother
+about return value and will try to unpin bo->pgnr pages, which is
+incorrect.
+
+Fix this by passing the page_nr to free_user_pages(). If page_nr > 0
+pages will be unpinned based on bo->mem_type. This will also take care
+of non error handling path.
+
+allocation")
+
+Link: https://lore.kernel.org/linux-media/1601219284-13275-1-git-send-email-jrdr.linux@gmail.com
+Fixes: 14a638ab96c5 ("media: atomisp: use pin_user_pages() for memory
+Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/hmm/hmm_bo.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
+index f13af2329f48..0168f9839c90 100644
+--- a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
++++ b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
+@@ -857,16 +857,17 @@ static void free_private_pages(struct hmm_buffer_object *bo,
+ kfree(bo->page_obj);
+ }
+
+-static void free_user_pages(struct hmm_buffer_object *bo)
++static void free_user_pages(struct hmm_buffer_object *bo,
++ unsigned int page_nr)
+ {
+ int i;
+
+ hmm_mem_stat.usr_size -= bo->pgnr;
+
+ if (bo->mem_type == HMM_BO_MEM_TYPE_PFN) {
+- unpin_user_pages(bo->pages, bo->pgnr);
++ unpin_user_pages(bo->pages, page_nr);
+ } else {
+- for (i = 0; i < bo->pgnr; i++)
++ for (i = 0; i < page_nr; i++)
+ put_page(bo->pages[i]);
+ }
+ kfree(bo->pages);
+@@ -942,6 +943,8 @@ static int alloc_user_pages(struct hmm_buffer_object *bo,
+ dev_err(atomisp_dev,
+ "get_user_pages err: bo->pgnr = %d, pgnr actually pinned = %d.\n",
+ bo->pgnr, page_nr);
++ if (page_nr < 0)
++ page_nr = 0;
+ goto out_of_mem;
+ }
+
+@@ -954,7 +957,7 @@ static int alloc_user_pages(struct hmm_buffer_object *bo,
+
+ out_of_mem:
+
+- free_user_pages(bo);
++ free_user_pages(bo, page_nr);
+
+ return -ENOMEM;
+ }
+@@ -1037,7 +1040,7 @@ void hmm_bo_free_pages(struct hmm_buffer_object *bo)
+ if (bo->type == HMM_BO_PRIVATE)
+ free_private_pages(bo, &dynamic_pool, &reserved_pool);
+ else if (bo->type == HMM_BO_USER)
+- free_user_pages(bo);
++ free_user_pages(bo, bo->pgnr);
+ else
+ dev_err(atomisp_dev, "invalid buffer type.\n");
+ mutex_unlock(&bo->mutex);
+--
+2.30.2
+
--- /dev/null
+From 8307d43989261a310053f7abbd3829294399da75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 15:21:11 +0100
+Subject: media: ccs: Fix sub-device function
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 8c43126e8c9f0990fa75fb5219c03b20d5ead7b7 ]
+
+Fix sub-device function for the pixel array and the scaler.
+
+It seems that the pixel array had gotten assigned as SCALER whereas the
+scaler had CAM_SENSOR function. Fix this by setting the pixel array
+function to CAM_SENSOR and that of scaler to SCALER.
+
+Fixes: 9ec2ac9bd0f9 ("media: ccs: Give all subdevs a function")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ccs/ccs-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
+index 15afbb4f5b31..4505594996bd 100644
+--- a/drivers/media/i2c/ccs/ccs-core.c
++++ b/drivers/media/i2c/ccs/ccs-core.c
+@@ -3522,11 +3522,11 @@ static int ccs_probe(struct i2c_client *client)
+ sensor->pll.scale_n = CCS_LIM(sensor, SCALER_N_MIN);
+
+ ccs_create_subdev(sensor, sensor->scaler, " scaler", 2,
+- MEDIA_ENT_F_CAM_SENSOR);
++ MEDIA_ENT_F_PROC_VIDEO_SCALER);
+ ccs_create_subdev(sensor, sensor->binner, " binner", 2,
+ MEDIA_ENT_F_PROC_VIDEO_SCALER);
+ ccs_create_subdev(sensor, sensor->pixel_array, " pixel_array", 1,
+- MEDIA_ENT_F_PROC_VIDEO_SCALER);
++ MEDIA_ENT_F_CAM_SENSOR);
+
+ rval = ccs_init_controls(sensor);
+ if (rval < 0)
+--
+2.30.2
+
--- /dev/null
+From bdc040456f188612995c99695a91d062ff9b4f08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 17:43:49 +0200
+Subject: media: cedrus: Fix H265 status definitions
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 147d211cc9b4d753148d1640a1758b25edfbf437 ]
+
+Some of the H265 status flags are wrong. Redefine them to corespond to
+Allwinner CedarC open source userspace library. Only one of these flags
+is actually used and new value also matches value used in libvdpau-sunxi
+library, which is proven to be working.
+
+Note that wrong (old) value in right circumstances (in combination with
+another H265 decoding bug) causes driver lock up. With this fix decoding
+is still broken (green output) but at least driver doesn't lock up.
+
+Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/media/sunxi/cedrus/cedrus_regs.h | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
+index 7718c561823f..92ace87c1c7d 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
+@@ -443,16 +443,17 @@
+ #define VE_DEC_H265_STATUS_STCD_BUSY BIT(21)
+ #define VE_DEC_H265_STATUS_WB_BUSY BIT(20)
+ #define VE_DEC_H265_STATUS_BS_DMA_BUSY BIT(19)
+-#define VE_DEC_H265_STATUS_IQIT_BUSY BIT(18)
++#define VE_DEC_H265_STATUS_IT_BUSY BIT(18)
+ #define VE_DEC_H265_STATUS_INTER_BUSY BIT(17)
+ #define VE_DEC_H265_STATUS_MORE_DATA BIT(16)
+-#define VE_DEC_H265_STATUS_VLD_BUSY BIT(14)
+-#define VE_DEC_H265_STATUS_DEBLOCKING_BUSY BIT(13)
+-#define VE_DEC_H265_STATUS_DEBLOCKING_DRAM_BUSY BIT(12)
+-#define VE_DEC_H265_STATUS_INTRA_BUSY BIT(11)
+-#define VE_DEC_H265_STATUS_SAO_BUSY BIT(10)
+-#define VE_DEC_H265_STATUS_MVP_BUSY BIT(9)
+-#define VE_DEC_H265_STATUS_SWDEC_BUSY BIT(8)
++#define VE_DEC_H265_STATUS_DBLK_BUSY BIT(15)
++#define VE_DEC_H265_STATUS_IREC_BUSY BIT(14)
++#define VE_DEC_H265_STATUS_INTRA_BUSY BIT(13)
++#define VE_DEC_H265_STATUS_MCRI_BUSY BIT(12)
++#define VE_DEC_H265_STATUS_IQIT_BUSY BIT(11)
++#define VE_DEC_H265_STATUS_MVP_BUSY BIT(10)
++#define VE_DEC_H265_STATUS_IS_BUSY BIT(9)
++#define VE_DEC_H265_STATUS_VLD_BUSY BIT(8)
+ #define VE_DEC_H265_STATUS_OVER_TIME BIT(3)
+ #define VE_DEC_H265_STATUS_VLD_DATA_REQ BIT(2)
+ #define VE_DEC_H265_STATUS_ERROR BIT(1)
+--
+2.30.2
+
--- /dev/null
+From e4da15bb088e2dba4a9503281827c0cd516cc25b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 06:53:47 +0100
+Subject: media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit c451ee146d449bbe39835fc3d9007b7f06332415 ]
+
+The media bus bit width of MEDIA_BUS_FMT_RGB101010_1X30 is 30.
+So, 'Bit31' and 'Bit30' cells for the 'MEDIA_BUS_FMT_RGB101010_1X30'
+row should be spaces instead of '0's.
+
+Fixes: 54f38fcae536 ("media: docs: move uAPI book to userspace-api/media")
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/userspace-api/media/v4l/subdev-formats.rst | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/userspace-api/media/v4l/subdev-formats.rst b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+index 7f16cbe46e5c..e6a9faa81197 100644
+--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst
++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst
+@@ -1567,8 +1567,8 @@ The following tables list existing packed RGB formats.
+ - MEDIA_BUS_FMT_RGB101010_1X30
+ - 0x1018
+ -
+- - 0
+- - 0
++ -
++ -
+ - r\ :sub:`9`
+ - r\ :sub:`8`
+ - r\ :sub:`7`
+--
+2.30.2
+
--- /dev/null
+From 779f906f53204691c3c45b52d788bf764835f736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 10:52:05 +0100
+Subject: media: i2c: imx219: Balance runtime PM use-count
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit dd90caa0111e178b52b21e56364bc2244a3973b3 ]
+
+Move incrementing/decrementing runtime PM count to
+imx219_start_streaming()/imx219_stop_streaming() functions respectively.
+
+This fixes an issue of unbalanced runtime PM count in resume callback
+error path where streaming is stopped and runtime PM count is left
+unbalanced.
+
+Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor")
+Reported-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx219.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
+index 82756cbfbaac..49ba39418360 100644
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -1035,37 +1035,47 @@ static int imx219_start_streaming(struct imx219 *imx219)
+ const struct imx219_reg_list *reg_list;
+ int ret;
+
++ ret = pm_runtime_get_sync(&client->dev);
++ if (ret < 0) {
++ pm_runtime_put_noidle(&client->dev);
++ return ret;
++ }
++
+ /* Apply default values of current mode */
+ reg_list = &imx219->mode->reg_list;
+ ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs);
+ if (ret) {
+ dev_err(&client->dev, "%s failed to set mode\n", __func__);
+- return ret;
++ goto err_rpm_put;
+ }
+
+ ret = imx219_set_framefmt(imx219);
+ if (ret) {
+ dev_err(&client->dev, "%s failed to set frame format: %d\n",
+ __func__, ret);
+- return ret;
++ goto err_rpm_put;
+ }
+
+ /* Apply customized values from user */
+ ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler);
+ if (ret)
+- return ret;
++ goto err_rpm_put;
+
+ /* set stream on register */
+ ret = imx219_write_reg(imx219, IMX219_REG_MODE_SELECT,
+ IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING);
+ if (ret)
+- return ret;
++ goto err_rpm_put;
+
+ /* vflip and hflip cannot change during streaming */
+ __v4l2_ctrl_grab(imx219->vflip, true);
+ __v4l2_ctrl_grab(imx219->hflip, true);
+
+ return 0;
++
++err_rpm_put:
++ pm_runtime_put(&client->dev);
++ return ret;
+ }
+
+ static void imx219_stop_streaming(struct imx219 *imx219)
+@@ -1081,12 +1091,13 @@ static void imx219_stop_streaming(struct imx219 *imx219)
+
+ __v4l2_ctrl_grab(imx219->vflip, false);
+ __v4l2_ctrl_grab(imx219->hflip, false);
++
++ pm_runtime_put(&client->dev);
+ }
+
+ static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+ {
+ struct imx219 *imx219 = to_imx219(sd);
+- struct i2c_client *client = v4l2_get_subdevdata(sd);
+ int ret = 0;
+
+ mutex_lock(&imx219->mutex);
+@@ -1096,22 +1107,15 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+ }
+
+ if (enable) {
+- ret = pm_runtime_get_sync(&client->dev);
+- if (ret < 0) {
+- pm_runtime_put_noidle(&client->dev);
+- goto err_unlock;
+- }
+-
+ /*
+ * Apply default & customized values
+ * and then start streaming.
+ */
+ ret = imx219_start_streaming(imx219);
+ if (ret)
+- goto err_rpm_put;
++ goto err_unlock;
+ } else {
+ imx219_stop_streaming(imx219);
+- pm_runtime_put(&client->dev);
+ }
+
+ imx219->streaming = enable;
+@@ -1120,8 +1124,6 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+
+ return ret;
+
+-err_rpm_put:
+- pm_runtime_put(&client->dev);
+ err_unlock:
+ mutex_unlock(&imx219->mutex);
+
+--
+2.30.2
+
--- /dev/null
+From 16a71f3af53d7e2d49a8d3950c2ae9ecc5e89cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 10:52:04 +0100
+Subject: media: i2c: imx219: Move out locking/unlocking of vflip and hflip
+ controls from imx219_set_stream
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 745d4612d2c853c00abadbf69799c8aee7f99c39 ]
+
+Move out locking/unlocking of vflip and hflip controls from
+imx219_set_stream() to the imx219_start_streaming()/
+imx219_stop_streaming() respectively.
+
+This fixes an issue in resume callback error path where streaming is
+stopped and the controls are left in locked state.
+
+Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor")
+Reported-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx219.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
+index 6e3382b85a90..82756cbfbaac 100644
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -1056,8 +1056,16 @@ static int imx219_start_streaming(struct imx219 *imx219)
+ return ret;
+
+ /* set stream on register */
+- return imx219_write_reg(imx219, IMX219_REG_MODE_SELECT,
+- IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING);
++ ret = imx219_write_reg(imx219, IMX219_REG_MODE_SELECT,
++ IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING);
++ if (ret)
++ return ret;
++
++ /* vflip and hflip cannot change during streaming */
++ __v4l2_ctrl_grab(imx219->vflip, true);
++ __v4l2_ctrl_grab(imx219->hflip, true);
++
++ return 0;
+ }
+
+ static void imx219_stop_streaming(struct imx219 *imx219)
+@@ -1070,6 +1078,9 @@ static void imx219_stop_streaming(struct imx219 *imx219)
+ IMX219_REG_VALUE_08BIT, IMX219_MODE_STANDBY);
+ if (ret)
+ dev_err(&client->dev, "%s failed to set stream\n", __func__);
++
++ __v4l2_ctrl_grab(imx219->vflip, false);
++ __v4l2_ctrl_grab(imx219->hflip, false);
+ }
+
+ static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+@@ -1105,10 +1116,6 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+
+ imx219->streaming = enable;
+
+- /* vflip and hflip cannot change during streaming */
+- __v4l2_ctrl_grab(imx219->vflip, enable);
+- __v4l2_ctrl_grab(imx219->hflip, enable);
+-
+ mutex_unlock(&imx219->mutex);
+
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From c242f64e609aeef105a6c2f90c16434e5e95b0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 17:41:39 +0100
+Subject: media: i2c: rdamc21: Fix warning on u8 cast
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 5f58ac04f36e32507d8f60fd47266ae2a60a2fa8 ]
+
+Sparse reports a warning on a cast to u8 of a 16 bits constant.
+
+drivers/media/i2c/rdacm21.c:348:62: warning: cast truncates bits
+from constant value (300a becomes a)
+
+Even if the behaviour is intended, silence the sparse warning replacing
+the cast with a bitwise & operation.
+
+Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module")
+Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rdacm21.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/rdacm21.c b/drivers/media/i2c/rdacm21.c
+index dcc21515e5a4..179d107f494c 100644
+--- a/drivers/media/i2c/rdacm21.c
++++ b/drivers/media/i2c/rdacm21.c
+@@ -345,7 +345,7 @@ static int ov10640_initialize(struct rdacm21_device *dev)
+ /* Read OV10640 ID to test communications. */
+ ov490_write_reg(dev, OV490_SCCB_SLAVE0_DIR, OV490_SCCB_SLAVE_READ);
+ ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_HIGH, OV10640_CHIP_ID >> 8);
+- ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_LOW, (u8)OV10640_CHIP_ID);
++ ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_LOW, OV10640_CHIP_ID & 0xff);
+
+ /* Trigger SCCB slave transaction and give it some time to complete. */
+ ov490_write_reg(dev, OV490_HOST_CMD, OV490_HOST_CMD_TRIGGER);
+--
+2.30.2
+
--- /dev/null
+From 8fc8ed4856a5e5f0c7109c15a47f5138df92021a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 08:55:12 +0100
+Subject: media: ipu3-cio2: Fix pixel-rate derived link frequency
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit a7de6eac6f6f73d48d97a6c93032107775f4593b ]
+
+The driver uses v4l2_get_link_freq() helper to obtain the link frequency
+using the LINK_FREQ but also the PIXEL_RATE control. The divisor for the
+pixel rate derived link frequency was wrong, missing the bus uses double
+data rate. Fix this.
+
+Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Fixes: 4b6c129e87a3 ("media: ipu3-cio2: Use v4l2_get_link_freq helper")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
+index 6e8c0c230e11..fecef85bd62e 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
+@@ -302,7 +302,7 @@ static int cio2_csi2_calc_timing(struct cio2_device *cio2, struct cio2_queue *q,
+ if (!q->sensor)
+ return -ENODEV;
+
+- freq = v4l2_get_link_freq(q->sensor->ctrl_handler, bpp, lanes);
++ freq = v4l2_get_link_freq(q->sensor->ctrl_handler, bpp, lanes * 2);
+ if (freq < 0) {
+ dev_err(dev, "error %lld, invalid link_freq\n", freq);
+ return freq;
+--
+2.30.2
+
--- /dev/null
+From 01718bc4937cd8f736f23f998fe14946ba3d1f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 13:28:02 +0100
+Subject: media: m88ds3103: fix return value check in m88ds3103_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit e61f9ea271933d987ab895c689fa37744f6fc27f ]
+
+In case of error, the function i2c_new_dummy_device() returns
+ERR_PTR() and never returns NULL. The NULL test in the return
+value check should be replaced with IS_ERR().
+
+Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/m88ds3103.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
+index cfa4cdde99d8..02e8aa11e36e 100644
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -1904,8 +1904,8 @@ static int m88ds3103_probe(struct i2c_client *client,
+
+ dev->dt_client = i2c_new_dummy_device(client->adapter,
+ dev->dt_addr);
+- if (!dev->dt_client) {
+- ret = -ENODEV;
++ if (IS_ERR(dev->dt_client)) {
++ ret = PTR_ERR(dev->dt_client);
+ goto err_kfree;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From a8ed6a8ddc6420b99cea31d678b49ff28df505dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Oct 2020 14:16:28 +0200
+Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ]
+
+There a 3 array for-loops that don't check the upper bounds of the
+index into arrays and this may lead to potential out-of-bounds
+reads. Fix this by adding array size upper bounds checks to be
+full safe.
+
+Addresses-Coverity: ("Out-of-bounds read")
+
+Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com
+Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/tuners/m88rs6000t.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c
+index b3505f402476..8647c50b66e5 100644
+--- a/drivers/media/tuners/m88rs6000t.c
++++ b/drivers/media/tuners/m88rs6000t.c
+@@ -525,7 +525,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ PGA2_cri = PGA2_GC >> 2;
+ PGA2_crf = PGA2_GC & 0x03;
+
+- for (i = 0; i <= RF_GC; i++)
++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++)
+ RFG += RFGS[i];
+
+ if (RF_GC == 0)
+@@ -537,12 +537,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ if (RF_GC == 3)
+ RFG += 100;
+
+- for (i = 0; i <= IF_GC; i++)
++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++)
+ IFG += IFGS[i];
+
+ TIAG = TIA_GC * TIA_GS;
+
+- for (i = 0; i <= BB_GC; i++)
++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++)
+ BBG += BBGS[i];
+
+ PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;
+--
+2.30.2
+
--- /dev/null
+From 9a3cc0741ce1816933a31116a6f15d1a24f409af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 15:48:33 +0200
+Subject: media: meson-ge2d: fix rotation parameters
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 87e780db2253a1759822c2c9ea207135fcc059de ]
+
+With these settings, 90deg and 270deg rotation leads to inverted
+vertical, fix them to have correct rotation.
+
+Fixes: 59a635327ca7 ("media: meson: Add M2M driver for the Amlogic GE2D Accelerator Unit")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/meson/ge2d/ge2d.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/meson/ge2d/ge2d.c b/drivers/media/platform/meson/ge2d/ge2d.c
+index 153612ca96fc..a1393fefa8ae 100644
+--- a/drivers/media/platform/meson/ge2d/ge2d.c
++++ b/drivers/media/platform/meson/ge2d/ge2d.c
+@@ -757,7 +757,7 @@ static int ge2d_s_ctrl(struct v4l2_ctrl *ctrl)
+
+ if (ctrl->val == 90) {
+ ctx->hflip = 0;
+- ctx->vflip = 0;
++ ctx->vflip = 1;
+ ctx->xy_swap = 1;
+ } else if (ctrl->val == 180) {
+ ctx->hflip = 1;
+@@ -765,7 +765,7 @@ static int ge2d_s_ctrl(struct v4l2_ctrl *ctrl)
+ ctx->xy_swap = 0;
+ } else if (ctrl->val == 270) {
+ ctx->hflip = 1;
+- ctx->vflip = 1;
++ ctx->vflip = 0;
+ ctx->xy_swap = 1;
+ } else {
+ ctx->hflip = 0;
+--
+2.30.2
+
--- /dev/null
+From 99eca62f59e1a83e2cc040aa1099ef33a2cfdc37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 15:07:14 +0100
+Subject: media: mtk: fix mtk-smi dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4fade8329ab2be2b902fce8db3625fd12234b873 ]
+
+The mtk-smi driver can now be built as a loadable module, but
+this leads to a build time regression when the drivers that
+depend on it are built-in:
+
+aarch64-linux-ld: drivers/media/platform/mtk-mdp/mtk_mdp_comp.o: in function `mtk_mdp_comp_clock_on':
+mtk_mdp_comp.c:(.text.mtk_mdp_comp_clock_on+0x54): undefined reference to `mtk_smi_larb_get'
+aarch64-linux-ld: drivers/media/platform/mtk-mdp/mtk_mdp_comp.o: in function `mtk_mdp_comp_clock_off':
+mtk_mdp_comp.c:(.text.mtk_mdp_comp_clock_off+0x12c): undefined reference to `mtk_smi_larb_put'
+
+Add a dependency on the interface, but keep allowing
+compile-testing without that driver, as it was originally
+intended.
+
+Fixes: 50fc8d9232cd ("memory: mtk-smi: Allow building as module")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/Kconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
+index fd1831e97b22..1ddb5d6354cf 100644
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -244,6 +244,7 @@ config VIDEO_MEDIATEK_JPEG
+ depends on MTK_IOMMU_V1 || MTK_IOMMU || COMPILE_TEST
+ depends on VIDEO_DEV && VIDEO_V4L2
+ depends on ARCH_MEDIATEK || COMPILE_TEST
++ depends on MTK_SMI || (COMPILE_TEST && MTK_SMI=n)
+ select VIDEOBUF2_DMA_CONTIG
+ select V4L2_MEM2MEM_DEV
+ help
+@@ -271,6 +272,7 @@ config VIDEO_MEDIATEK_MDP
+ depends on MTK_IOMMU || COMPILE_TEST
+ depends on VIDEO_DEV && VIDEO_V4L2
+ depends on ARCH_MEDIATEK || COMPILE_TEST
++ depends on MTK_SMI || (COMPILE_TEST && MTK_SMI=n)
+ select VIDEOBUF2_DMA_CONTIG
+ select V4L2_MEM2MEM_DEV
+ select VIDEO_MEDIATEK_VPU
+@@ -291,6 +293,7 @@ config VIDEO_MEDIATEK_VCODEC
+ # our dependencies, to avoid missing symbols during link.
+ depends on VIDEO_MEDIATEK_VPU || !VIDEO_MEDIATEK_VPU
+ depends on MTK_SCP || !MTK_SCP
++ depends on MTK_SMI || (COMPILE_TEST && MTK_SMI=n)
+ select VIDEOBUF2_DMA_CONTIG
+ select V4L2_MEM2MEM_DEV
+ select VIDEO_MEDIATEK_VCODEC_VPU if VIDEO_MEDIATEK_VPU
+--
+2.30.2
+
--- /dev/null
+From 0e7dad662ad0f71f8431cd4247629ce8877a3fbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:58:52 +0200
+Subject: media: [next] staging: media: atomisp: fix memory leak of object
+ flash
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 6045b01dd0e3cd3759eafe7f290ed04c957500b1 ]
+
+In the case where the call to lm3554_platform_data_func returns an
+error there is a memory leak on the error return path of object
+flash. Fix this by adding an error return path that will free
+flash and rename labels fail2 to fail3 and fail1 to fail2.
+
+Link: https://lore.kernel.org/linux-media/20200902165852.201155-1-colin.king@canonical.com
+Fixes: 9289cdf39992 ("staging: media: atomisp: Convert to GPIO descriptors")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/atomisp/i2c/atomisp-lm3554.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
+index 7ca7378b1859..0ab67b2aec67 100644
+--- a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
++++ b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
+@@ -843,8 +843,10 @@ static int lm3554_probe(struct i2c_client *client)
+ return -ENOMEM;
+
+ flash->pdata = lm3554_platform_data_func(client);
+- if (IS_ERR(flash->pdata))
+- return PTR_ERR(flash->pdata);
++ if (IS_ERR(flash->pdata)) {
++ err = PTR_ERR(flash->pdata);
++ goto fail1;
++ }
+
+ v4l2_i2c_subdev_init(&flash->sd, client, &lm3554_ops);
+ flash->sd.internal_ops = &lm3554_internal_ops;
+@@ -856,7 +858,7 @@ static int lm3554_probe(struct i2c_client *client)
+ ARRAY_SIZE(lm3554_controls));
+ if (ret) {
+ dev_err(&client->dev, "error initialize a ctrl_handler.\n");
+- goto fail2;
++ goto fail3;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lm3554_controls); i++)
+@@ -865,14 +867,14 @@ static int lm3554_probe(struct i2c_client *client)
+
+ if (flash->ctrl_handler.error) {
+ dev_err(&client->dev, "ctrl_handler error.\n");
+- goto fail2;
++ goto fail3;
+ }
+
+ flash->sd.ctrl_handler = &flash->ctrl_handler;
+ err = media_entity_pads_init(&flash->sd.entity, 0, NULL);
+ if (err) {
+ dev_err(&client->dev, "error initialize a media entity.\n");
+- goto fail1;
++ goto fail2;
+ }
+
+ flash->sd.entity.function = MEDIA_ENT_F_FLASH;
+@@ -884,14 +886,15 @@ static int lm3554_probe(struct i2c_client *client)
+ err = lm3554_gpio_init(client);
+ if (err) {
+ dev_err(&client->dev, "gpio request/direction_output fail");
+- goto fail2;
++ goto fail3;
+ }
+ return atomisp_register_i2c_module(&flash->sd, NULL, LED_FLASH);
+-fail2:
++fail3:
+ media_entity_cleanup(&flash->sd.entity);
+ v4l2_ctrl_handler_free(&flash->ctrl_handler);
+-fail1:
++fail2:
+ v4l2_device_unregister_subdev(&flash->sd);
++fail1:
+ kfree(flash);
+
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 667d68e5e7885c2788bbe9721008c17535cf091f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 03:50:41 +0100
+Subject: media: omap4iss: return error code when omap4iss_get() failed
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ]
+
+If omap4iss_get() failed, it need return error code in iss_probe().
+
+Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/omap4iss/iss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c
+index dae9073e7d3c..085397045b36 100644
+--- a/drivers/staging/media/omap4iss/iss.c
++++ b/drivers/staging/media/omap4iss/iss.c
+@@ -1236,8 +1236,10 @@ static int iss_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto error;
+
+- if (!omap4iss_get(iss))
++ if (!omap4iss_get(iss)) {
++ ret = -EINVAL;
+ goto error;
++ }
+
+ ret = iss_reset(iss);
+ if (ret < 0)
+--
+2.30.2
+
--- /dev/null
+From 758e3aac308c4f5efa3c5ce95e403309b5f25ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Mar 2021 15:15:28 +0100
+Subject: media: platform: sunxi: sun6i-csi: fix error return code of
+ sun6i_video_start_streaming()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit f3d384e36630e2a552d874e422835606d9cf230a ]
+
+When sun6i_video_remote_subdev() returns NULL to subdev, no error return
+code of sun6i_video_start_streaming() is assigned.
+To fix this bug, ret is assigned with -EINVAL in this case.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Fixes: 5cc7522d8965 ("media: sun6i: Add support for Allwinner CSI V3s")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
+index b55de9ab64d8..3181d0781b61 100644
+--- a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
++++ b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
+@@ -151,8 +151,10 @@ static int sun6i_video_start_streaming(struct vb2_queue *vq, unsigned int count)
+ }
+
+ subdev = sun6i_video_remote_subdev(video, NULL);
+- if (!subdev)
++ if (!subdev) {
++ ret = -EINVAL;
+ goto stop_media_pipeline;
++ }
+
+ config.pixelformat = video->fmt.fmt.pix.pixelformat;
+ config.code = video->mbus_code;
+--
+2.30.2
+
--- /dev/null
+From 5b146f644e62a1f49bf89c13e55d33f96a13c0d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 17:15:10 +0100
+Subject: media: rkisp1: rsz: crash fix when setting src format
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit cbe8373ca7e7cbb4b263b6bf222ccc19f5e119d2 ]
+
+When setting the source media bus code in the resizer,
+we first check that the current media bus code in the
+source is yuv encoded format. This is done by
+retrieving the data from the formats list of the isp
+entity. This cause a crash when the media bus code on the
+source is YUYV8_1_5X8 which is not supported by the isp
+entity. Instead we should test the sink format of the resizer
+which is guaranteed to be supported by the isp entity.
+
+Fixes: 251b6eebb6c49 ("media: staging: rkisp1: rsz: Add support to more YUV encoded mbus codes on src pad")
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Tested-by: Sebastian Fricke <sebastian.fricke.linux@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c
+index 813670ed9577..79deed8adcea 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c
+@@ -520,14 +520,15 @@ static void rkisp1_rsz_set_src_fmt(struct rkisp1_resizer *rsz,
+ struct v4l2_mbus_framefmt *format,
+ unsigned int which)
+ {
+- const struct rkisp1_isp_mbus_info *mbus_info;
+- struct v4l2_mbus_framefmt *src_fmt;
++ const struct rkisp1_isp_mbus_info *sink_mbus_info;
++ struct v4l2_mbus_framefmt *src_fmt, *sink_fmt;
+
++ sink_fmt = rkisp1_rsz_get_pad_fmt(rsz, cfg, RKISP1_RSZ_PAD_SINK, which);
+ src_fmt = rkisp1_rsz_get_pad_fmt(rsz, cfg, RKISP1_RSZ_PAD_SRC, which);
+- mbus_info = rkisp1_isp_mbus_info_get(src_fmt->code);
++ sink_mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code);
+
+ /* for YUV formats, userspace can change the mbus code on the src pad if it is supported */
+- if (mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV &&
++ if (sink_mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV &&
+ rkisp1_rsz_get_yuv_mbus_info(format->code))
+ src_fmt->code = format->code;
+
+--
+2.30.2
+
--- /dev/null
+From c3360681b2ad382af8781650b2a6db4c0277248e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 19:57:09 +0100
+Subject: media: rkvdec: Do not require all controls to be present in every
+ request
+
+From: Daniel Almeida <daniel.almeida@collabora.com>
+
+[ Upstream commit 54676d5f5630b79f7b00c7c43882a58c1815aaf9 ]
+
+According to the v4l2 api, it is allowed to skip
+setting a control if its contents haven't changed for performance
+reasons: userspace should only update the controls that changed from
+last frame rather then updating them all. Still some ancient code
+that checks for mandatory controls has been left in this driver.
+
+Remove it.
+
+Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
+Signed-off-by: Daniel Almeida <daniel.almeida@collabora.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 48 +--------------------------
+ drivers/staging/media/rkvdec/rkvdec.h | 1 -
+ 2 files changed, 1 insertion(+), 48 deletions(-)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index d3eb81ee8dc2..5f0219d117fb 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -55,16 +55,13 @@ static const struct v4l2_ctrl_ops rkvdec_ctrl_ops = {
+
+ static const struct rkvdec_ctrl_desc rkvdec_h264_ctrl_descs[] = {
+ {
+- .mandatory = true,
+ .cfg.id = V4L2_CID_STATELESS_H264_DECODE_PARAMS,
+ },
+ {
+- .mandatory = true,
+ .cfg.id = V4L2_CID_STATELESS_H264_SPS,
+ .cfg.ops = &rkvdec_ctrl_ops,
+ },
+ {
+- .mandatory = true,
+ .cfg.id = V4L2_CID_STATELESS_H264_PPS,
+ },
+ {
+@@ -585,25 +582,7 @@ static const struct vb2_ops rkvdec_queue_ops = {
+
+ static int rkvdec_request_validate(struct media_request *req)
+ {
+- struct media_request_object *obj;
+- const struct rkvdec_ctrls *ctrls;
+- struct v4l2_ctrl_handler *hdl;
+- struct rkvdec_ctx *ctx = NULL;
+- unsigned int count, i;
+- int ret;
+-
+- list_for_each_entry(obj, &req->objects, list) {
+- if (vb2_request_object_is_buffer(obj)) {
+- struct vb2_buffer *vb;
+-
+- vb = container_of(obj, struct vb2_buffer, req_obj);
+- ctx = vb2_get_drv_priv(vb->vb2_queue);
+- break;
+- }
+- }
+-
+- if (!ctx)
+- return -EINVAL;
++ unsigned int count;
+
+ count = vb2_request_buffer_cnt(req);
+ if (!count)
+@@ -611,31 +590,6 @@ static int rkvdec_request_validate(struct media_request *req)
+ else if (count > 1)
+ return -EINVAL;
+
+- hdl = v4l2_ctrl_request_hdl_find(req, &ctx->ctrl_hdl);
+- if (!hdl)
+- return -ENOENT;
+-
+- ret = 0;
+- ctrls = ctx->coded_fmt_desc->ctrls;
+- for (i = 0; ctrls && i < ctrls->num_ctrls; i++) {
+- u32 id = ctrls->ctrls[i].cfg.id;
+- struct v4l2_ctrl *ctrl;
+-
+- if (!ctrls->ctrls[i].mandatory)
+- continue;
+-
+- ctrl = v4l2_ctrl_request_hdl_ctrl_find(hdl, id);
+- if (!ctrl) {
+- ret = -ENOENT;
+- break;
+- }
+- }
+-
+- v4l2_ctrl_request_hdl_put(hdl);
+-
+- if (ret)
+- return ret;
+-
+ return vb2_request_validate(req);
+ }
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.h b/drivers/staging/media/rkvdec/rkvdec.h
+index 77a137cca88e..52ac3874c5e5 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.h
++++ b/drivers/staging/media/rkvdec/rkvdec.h
+@@ -25,7 +25,6 @@
+ struct rkvdec_ctx;
+
+ struct rkvdec_ctrl_desc {
+- u32 mandatory : 1;
+ struct v4l2_ctrl_config cfg;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From cc1498724c311afafec5c25416a3eb06a7888fc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 19:30:18 +0100
+Subject: media: saa7134: use sg_dma_len when building pgtable
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit 4e1cb753c04d74e06d7ca826ea0bcb02526af03e ]
+
+The new AMD IOMMU DMA implementation concatenates sglist entries under
+certain conditions, and because saa7134 accessed the length member
+directly, it did not support this scenario.
+
+This fixes IO_PAGE_FAULTs and choppy DMA audio by using the
+sg_dma_len macro.
+
+Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c
+index 391572a6ec76..efb757d5168a 100644
+--- a/drivers/media/pci/saa7134/saa7134-core.c
++++ b/drivers/media/pci/saa7134/saa7134-core.c
+@@ -243,7 +243,7 @@ int saa7134_pgtable_build(struct pci_dev *pci, struct saa7134_pgtable *pt,
+
+ ptr = pt->cpu + startpage;
+ for (i = 0; i < length; i++, list = sg_next(list)) {
+- for (p = 0; p * 4096 < list->length; p++, ptr++)
++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr++)
+ *ptr = cpu_to_le32(sg_dma_address(list) +
+ list->offset + p * 4096);
+ }
+--
+2.30.2
+
--- /dev/null
+From 8a19fa413bc891de98fc5c879cec10104d2a4bf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 19:52:53 +0100
+Subject: media: saa7146: use sg_dma_len when building pgtable
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit e56429b09d5e0802b86f84ec7c24025886c9f88b ]
+
+The new AMD IOMMU DMA implementation concatenates sglist entries under
+certain conditions, and because saa7146 accessed the length member
+directly, it did not support this scenario.
+
+This fixes IO_PAGE_FAULTs by using the sg_dma_len macro.
+
+Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/saa7146/saa7146_core.c | 2 +-
+ drivers/media/common/saa7146/saa7146_video.c | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
+index f2d13b71416c..e50fa0ff7c5d 100644
+--- a/drivers/media/common/saa7146/saa7146_core.c
++++ b/drivers/media/common/saa7146/saa7146_core.c
+@@ -253,7 +253,7 @@ int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt
+ i, sg_dma_address(list), sg_dma_len(list),
+ list->offset);
+ */
+- for (p = 0; p * 4096 < list->length; p++, ptr++) {
++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr++) {
+ *ptr = cpu_to_le32(sg_dma_address(list) + p * 4096);
+ nr_pages++;
+ }
+diff --git a/drivers/media/common/saa7146/saa7146_video.c b/drivers/media/common/saa7146/saa7146_video.c
+index 7b8795eca589..66215d9106a4 100644
+--- a/drivers/media/common/saa7146/saa7146_video.c
++++ b/drivers/media/common/saa7146/saa7146_video.c
+@@ -247,9 +247,8 @@ static int saa7146_pgtable_build(struct saa7146_dev *dev, struct saa7146_buf *bu
+
+ /* walk all pages, copy all page addresses to ptr1 */
+ for (i = 0; i < length; i++, list++) {
+- for (p = 0; p * 4096 < list->length; p++, ptr1++) {
++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr1++)
+ *ptr1 = cpu_to_le32(sg_dma_address(list) - list->offset);
+- }
+ }
+ /*
+ ptr1 = pt1->cpu;
+--
+2.30.2
+
--- /dev/null
+From 88e30780f7db34be7f3eb9a021de3795e766b8e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 12:27:40 +0100
+Subject: media: v4l2-ctrls.c: fix race condition in hdl->requests list
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit be7e8af98f3af729aa9f08b1053f9533a5cceb91 ]
+
+When a request is re-inited it will release all control handler
+objects that are still in the request. It does that by unbinding
+and putting all those objects. When the object is unbound the
+obj->req pointer is set to NULL, and the object's unbind op is
+called. When the object it put the object's release op is called
+to free the memory.
+
+For a request object that contains a control handler that means
+that v4l2_ctrl_handler_free() is called in the release op.
+
+A control handler used in a request has a pointer to the main
+control handler that is created by the driver and contains the
+current state of all controls. If the device is unbound (due to
+rmmod or a forced unbind), then that main handler is freed, again
+by calling v4l2_ctrl_handler_free(), and any outstanding request
+objects that refer to that main handler have to be unbound and put
+as well.
+
+It does that by this test:
+
+ if (!hdl->req_obj.req && !list_empty(&hdl->requests)) {
+
+I.e. the handler has no pointer to a request, so is the main
+handler, and one or more request objects refer to this main
+handler.
+
+However, this test is wrong since hdl->req_obj.req is actually
+NULL when re-initing a request (the object unbind will set req to
+NULL), and the only reason this seemingly worked is that the
+requests list is typically empty since the request's unbind op
+will remove the handler from the requests list.
+
+But if another thread is at the same time adding a new control
+to a request, then there is a race condition where one thread
+is removing a control handler object from the requests list and
+another thread is adding one. The result is that hdl->requests
+is no longer empty and the code thinks that a main handler is
+being freed instead of a control handler that is part of a request.
+
+There are two bugs here: first the test for hdl->req_obj.req: this
+should be hdl->req_obj.ops since only the main control handler will
+have a NULL pointer there.
+
+The second is that adding or deleting request objects from the
+requests list of the main handler isn't protected by taking the
+main handler's lock.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: John Cox <jc@kynesim.co.uk>
+Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support")
+Tested-by: John Cox <jc@kynesim.co.uk>
+Reported-by: John Cox <jc@kynesim.co.uk>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 4f0209695f13..6219c8185782 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2552,7 +2552,15 @@ void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
+ if (hdl == NULL || hdl->buckets == NULL)
+ return;
+
+- if (!hdl->req_obj.req && !list_empty(&hdl->requests)) {
++ /*
++ * If the main handler is freed and it is used by handler objects in
++ * outstanding requests, then unbind and put those objects before
++ * freeing the main handler.
++ *
++ * The main handler can be identified by having a NULL ops pointer in
++ * the request object.
++ */
++ if (!hdl->req_obj.ops && !list_empty(&hdl->requests)) {
+ struct v4l2_ctrl_handler *req, *next_req;
+
+ list_for_each_entry_safe(req, next_req, &hdl->requests, requests) {
+@@ -3595,8 +3603,8 @@ static void v4l2_ctrl_request_unbind(struct media_request_object *obj)
+ container_of(obj, struct v4l2_ctrl_handler, req_obj);
+ struct v4l2_ctrl_handler *main_hdl = obj->priv;
+
+- list_del_init(&hdl->requests);
+ mutex_lock(main_hdl->lock);
++ list_del_init(&hdl->requests);
+ if (hdl->request_is_queued) {
+ list_del_init(&hdl->requests_queued);
+ hdl->request_is_queued = false;
+@@ -3655,8 +3663,11 @@ static int v4l2_ctrl_request_bind(struct media_request *req,
+ if (!ret) {
+ ret = media_request_object_bind(req, &req_ops,
+ from, false, &hdl->req_obj);
+- if (!ret)
++ if (!ret) {
++ mutex_lock(from->lock);
+ list_add_tail(&hdl->requests, &from->requests);
++ mutex_unlock(from->lock);
++ }
+ }
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 0bf643f8108d3426eb1f1b7f9912a336350926a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 21:22:34 +0100
+Subject: media: venus: core: Fix some resource leaks in the error path of
+ 'venus_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5a465c5391a856a0c1e9554964d660676c35d1b2 ]
+
+If an error occurs after a successful 'of_icc_get()' call, it must be
+undone.
+
+Use 'devm_of_icc_get()' instead of 'of_icc_get()' to avoid the leak.
+Update the remove function accordingly and axe the now unneeded
+'icc_put()' calls.
+
+Fixes: 32f0a6ddc8c9 ("media: venus: Use on-chip interconnect API")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index d2842f496b47..ae374bb2a48f 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -224,11 +224,11 @@ static int venus_probe(struct platform_device *pdev)
+ if (IS_ERR(core->base))
+ return PTR_ERR(core->base);
+
+- core->video_path = of_icc_get(dev, "video-mem");
++ core->video_path = devm_of_icc_get(dev, "video-mem");
+ if (IS_ERR(core->video_path))
+ return PTR_ERR(core->video_path);
+
+- core->cpucfg_path = of_icc_get(dev, "cpu-cfg");
++ core->cpucfg_path = devm_of_icc_get(dev, "cpu-cfg");
+ if (IS_ERR(core->cpucfg_path))
+ return PTR_ERR(core->cpucfg_path);
+
+@@ -367,9 +367,6 @@ static int venus_remove(struct platform_device *pdev)
+
+ hfi_destroy(core);
+
+- icc_put(core->video_path);
+- icc_put(core->cpucfg_path);
+-
+ v4l2_device_unregister(&core->v4l2_dev);
+
+ mutex_destroy(&core->pm_lock);
+--
+2.30.2
+
--- /dev/null
+From ac9b0ae6ca1b3a48097e65ead74dad40cdae8d65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 16:43:27 +0100
+Subject: media: vivid: fix assignment of dev->fbuf_out_flags
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ]
+
+Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise
+mask and the following statement should be bit-wise or'ing in the new flag
+bits but instead is making a direct assignment. Fix this by using the |=
+operator rather than an assignment.
+
+Addresses-Coverity: ("Unused value")
+
+Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/vivid/vivid-vid-out.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/test-drivers/vivid/vivid-vid-out.c b/drivers/media/test-drivers/vivid/vivid-vid-out.c
+index ac1e981e8342..9f731f085179 100644
+--- a/drivers/media/test-drivers/vivid/vivid-vid-out.c
++++ b/drivers/media/test-drivers/vivid/vivid-vid-out.c
+@@ -1021,7 +1021,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh,
+ return -EINVAL;
+ }
+ dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags);
+- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags);
++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4aad7b33dc69d7b7a49e77058f8a57c5dc3729ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 19:38:21 +0000
+Subject: memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ]
+
+Currently the array gpmc_cs is indexed by cs before it cs is range checked
+and the pointer read from this out-of-index read is dereferenced. Fix this
+by performing the range check on cs before the read and the following
+pointer dereference.
+
+Addresses-Coverity: ("Negative array index read")
+Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/omap-gpmc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index cfa730cfd145..f80c2ea39ca4 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -1009,8 +1009,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
+
+ void gpmc_cs_free(int cs)
+ {
+- struct gpmc_cs_data *gpmc = &gpmc_cs[cs];
+- struct resource *res = &gpmc->mem;
++ struct gpmc_cs_data *gpmc;
++ struct resource *res;
+
+ spin_lock(&gpmc_mem_lock);
+ if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
+@@ -1018,6 +1018,9 @@ void gpmc_cs_free(int cs)
+ spin_unlock(&gpmc_mem_lock);
+ return;
+ }
++ gpmc = &gpmc_cs[cs];
++ res = &gpmc->mem;
++
+ gpmc_cs_disable_mem(cs);
+ if (res->flags)
+ release_resource(res);
+--
+2.30.2
+
--- /dev/null
+From 3627dd8ce70750467b39fa53c62387deb0698ce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 11:10:56 +0800
+Subject: memory: pl353: fix mask of ECC page_size config register
+
+From: gexueyuan <gexueyuan@gmail.com>
+
+[ Upstream commit 25dcca7fedcd4e31cb368ad846bfd738c0c6307c ]
+
+The mask for page size of ECC Configuration Register should be 0x3,
+according to the datasheet of PL353 smc.
+
+Fixes: fee10bd22678 ("memory: pl353: Add driver for arm pl353 static memory controller")
+Signed-off-by: gexueyuan <gexueyuan@gmail.com>
+Link: https://lore.kernel.org/r/20210331031056.5326-1-gexueyuan@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/pl353-smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c
+index 3b5b1045edd9..9c0a28416777 100644
+--- a/drivers/memory/pl353-smc.c
++++ b/drivers/memory/pl353-smc.c
+@@ -63,7 +63,7 @@
+ /* ECC memory config register specific constants */
+ #define PL353_SMC_ECC_MEMCFG_MODE_MASK 0xC
+ #define PL353_SMC_ECC_MEMCFG_MODE_SHIFT 2
+-#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0xC
++#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0x3
+
+ #define PL353_SMC_DC_UPT_NAND_REGS ((4 << 23) | /* CS: NAND chip */ \
+ (2 << 21)) /* UpdateRegs operation */
+--
+2.30.2
+
--- /dev/null
+From 9f29f6e25d9ea364e4be163fb90a2ed8e7d5ae06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 17:43:57 +0200
+Subject: memory: renesas-rpc-if: fix possible NULL pointer dereference of
+ resource
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 59e27d7c94aa02da039b000d33c304c179395801 ]
+
+The platform_get_resource_byname() can return NULL which would be
+immediately dereferenced by resource_size(). Instead dereference it
+after validating the resource.
+
+Addresses-Coverity: Dereference null return value
+Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210407154357.70200-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/renesas-rpc-if.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
+index 8d36e221def1..45eed659b0c6 100644
+--- a/drivers/memory/renesas-rpc-if.c
++++ b/drivers/memory/renesas-rpc-if.c
+@@ -192,10 +192,10 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
+ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap");
+- rpc->size = resource_size(res);
+ rpc->dirmap = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(rpc->dirmap))
+ rpc->dirmap = NULL;
++ rpc->size = resource_size(res);
+
+ rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+
+--
+2.30.2
+
--- /dev/null
+From a2e110a1dce49009dde66303135e80778ff0dc0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 17:45:35 +0200
+Subject: memory: samsung: exynos5422-dmc: handle clk_set_parent() failure
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 132c17c3ff878c7beaba51bdd275d5cc654c0e33 ]
+
+clk_set_parent() can fail and ignoring such case could lead to invalid
+clock setup for given frequency.
+
+Addresses-Coverity: Unchecked return value
+Fixes: 6e7674c3c6df ("memory: Add DMC driver for Exynos5422")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://lore.kernel.org/r/20210407154535.70756-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/samsung/exynos5422-dmc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/memory/samsung/exynos5422-dmc.c b/drivers/memory/samsung/exynos5422-dmc.c
+index 1dabb509dec3..dee503640e12 100644
+--- a/drivers/memory/samsung/exynos5422-dmc.c
++++ b/drivers/memory/samsung/exynos5422-dmc.c
+@@ -1298,7 +1298,9 @@ static int exynos5_dmc_init_clks(struct exynos5_dmc *dmc)
+
+ dmc->curr_volt = target_volt;
+
+- clk_set_parent(dmc->mout_mx_mspll_ccore, dmc->mout_spll);
++ ret = clk_set_parent(dmc->mout_mx_mspll_ccore, dmc->mout_spll);
++ if (ret)
++ return ret;
+
+ clk_prepare_enable(dmc->fout_bpll);
+ clk_prepare_enable(dmc->mout_bpll);
+--
+2.30.2
+
--- /dev/null
+From b248c3c86da05c5f48b0585af9c3e50a4b36528b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:10:04 -0800
+Subject: mfd: intel_pmt: Fix nuisance messages and handling of disabled
+ capabilities
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit a1a5c1c3df282dc122508a17500317266ef19e46 ]
+
+Some products will be available that have PMT capabilities that are not
+supported. Remove the warnings in this instance to avoid nuisance messages
+and confusion.
+
+Also return an error code for capabilities that are disabled by quirk to
+prevent them from keeping the driver loaded if only disabled capabilities
+are found.
+
+Fixes: 4f8217d5b0ca ("mfd: Intel Platform Monitoring Technology support")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel_pmt.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mfd/intel_pmt.c b/drivers/mfd/intel_pmt.c
+index 744b230cdcca..65da2b17a204 100644
+--- a/drivers/mfd/intel_pmt.c
++++ b/drivers/mfd/intel_pmt.c
+@@ -79,19 +79,18 @@ static int pmt_add_dev(struct pci_dev *pdev, struct intel_dvsec_header *header,
+ case DVSEC_INTEL_ID_WATCHER:
+ if (quirks & PMT_QUIRK_NO_WATCHER) {
+ dev_info(dev, "Watcher not supported\n");
+- return 0;
++ return -EINVAL;
+ }
+ name = "pmt_watcher";
+ break;
+ case DVSEC_INTEL_ID_CRASHLOG:
+ if (quirks & PMT_QUIRK_NO_CRASHLOG) {
+ dev_info(dev, "Crashlog not supported\n");
+- return 0;
++ return -EINVAL;
+ }
+ name = "pmt_crashlog";
+ break;
+ default:
+- dev_err(dev, "Unrecognized PMT capability: %d\n", id);
+ return -EINVAL;
+ }
+
+@@ -174,12 +173,8 @@ static int pmt_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ header.offset = INTEL_DVSEC_TABLE_OFFSET(table);
+
+ ret = pmt_add_dev(pdev, &header, quirks);
+- if (ret) {
+- dev_warn(&pdev->dev,
+- "Failed to add device for DVSEC id %d\n",
+- header.id);
++ if (ret)
+ continue;
+- }
+
+ found_devices = true;
+ } while (true);
+--
+2.30.2
+
--- /dev/null
+From 072dde5b0b59fa6db4536de1892c2221bb6c6e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:51:35 +0100
+Subject: mfd: stm32-timers: Avoid clearing auto reload register
+
+From: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+
+[ Upstream commit 4917e498c6894ba077867aff78f82cffd5ffbb5c ]
+
+The ARR register is cleared unconditionally upon probing, after the maximum
+value has been read. This initial condition is rather not intuitive, when
+considering the counter child driver. It rather expects the maximum value
+by default:
+- The counter interface shows a zero value by default for 'ceiling'
+ attribute.
+- Enabling the counter without any prior configuration makes it doesn't
+ count.
+
+The reset value of ARR register is the maximum. So Choice here
+is to backup it, and restore it then, instead of clearing its value.
+It also fixes the initial condition seen by the counter driver.
+
+Fixes: d0f949e220fd ("mfd: Add STM32 Timers driver")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stm32-timers.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/stm32-timers.c b/drivers/mfd/stm32-timers.c
+index add603359124..44ed2fce0319 100644
+--- a/drivers/mfd/stm32-timers.c
++++ b/drivers/mfd/stm32-timers.c
+@@ -158,13 +158,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = {
+
+ static void stm32_timers_get_arr_size(struct stm32_timers *ddata)
+ {
++ u32 arr;
++
++ /* Backup ARR to restore it after getting the maximum value */
++ regmap_read(ddata->regmap, TIM_ARR, &arr);
++
+ /*
+ * Only the available bits will be written so when readback
+ * we get the maximum value of auto reload register
+ */
+ regmap_write(ddata->regmap, TIM_ARR, ~0L);
+ regmap_read(ddata->regmap, TIM_ARR, &ddata->max_arr);
+- regmap_write(ddata->regmap, TIM_ARR, 0x0);
++ regmap_write(ddata->regmap, TIM_ARR, arr);
+ }
+
+ static int stm32_timers_dma_probe(struct device *dev,
+--
+2.30.2
+
--- /dev/null
+From d8a87187a09d3997a6fba4adda334d86f65eadcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Mar 2021 17:43:46 +0100
+Subject: mips: bmips: fix syscon-reboot nodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit cde58b861a1d365568588adda59d42351c0c4ad3 ]
+
+Commit a23c4134955e added the clock controller nodes, incorrectly changing the
+syscon-reboot nodes addresses.
+
+Fixes: a23c4134955e ("MIPS: BMIPS: add clock controller nodes")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/brcm/bcm3368.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6358.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6362.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6368.dtsi | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/mips/boot/dts/brcm/bcm3368.dtsi b/arch/mips/boot/dts/brcm/bcm3368.dtsi
+index 69cbef472377..d4b2b430dad0 100644
+--- a/arch/mips/boot/dts/brcm/bcm3368.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm3368.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@fff8c008 {
+ compatible = "syscon";
+- reg = <0xfff8c000 0x4>;
++ reg = <0xfff8c008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm63268.dtsi b/arch/mips/boot/dts/brcm/bcm63268.dtsi
+index e0021ff9f144..940594436872 100644
+--- a/arch/mips/boot/dts/brcm/bcm63268.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm63268.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@10000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6358.dtsi b/arch/mips/boot/dts/brcm/bcm6358.dtsi
+index 9d93e7f5e6fc..d79c88c2fc9c 100644
+--- a/arch/mips/boot/dts/brcm/bcm6358.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6358.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@fffe0008 {
+ compatible = "syscon";
+- reg = <0xfffe0000 0x4>;
++ reg = <0xfffe0008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6362.dtsi b/arch/mips/boot/dts/brcm/bcm6362.dtsi
+index eb10341b75ba..8a21cb761ffd 100644
+--- a/arch/mips/boot/dts/brcm/bcm6362.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6362.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@10000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6368.dtsi b/arch/mips/boot/dts/brcm/bcm6368.dtsi
+index 52c19f40b9cc..8e87867ebc04 100644
+--- a/arch/mips/boot/dts/brcm/bcm6368.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6368.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@100000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 011d6f46914f21af8fa7eefbb9791f546951606d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 20:50:01 +0800
+Subject: MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 66633abd0642f1e89d26e15f36fb13d3a1c535ff ]
+
+After commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to
+archs where they work"), bpf_probe_read{, str}() functions were no longer
+available on MIPS, so there exist some errors when running bpf program:
+
+root@linux:/home/loongson/bcc# python examples/tracing/task_switch.py
+bpf: Failed to load program: Invalid argument
+[...]
+11: (85) call bpf_probe_read#4
+unknown func bpf_probe_read#4
+[...]
+Exception: Failed to load BPF program count_sched: Invalid argument
+
+ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should be restricted to archs
+with non-overlapping address ranges, but they can overlap in EVA mode
+on MIPS, so select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE if !EVA in
+arch/mips/Kconfig, otherwise the bpf old helper bpf_probe_read() will
+not be available.
+
+This is similar with the commit d195b1d1d119 ("powerpc/bpf: Enable
+bpf_probe_read{, str}() on powerpc again").
+
+Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index d89efba3d8a4..e89d63cd92d1 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -6,6 +6,7 @@ config MIPS
+ select ARCH_BINFMT_ELF_STATE if MIPS_FP_SUPPORT
+ select ARCH_HAS_FORTIFY_SOURCE
+ select ARCH_HAS_KCOV
++ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE if !EVA
+ select ARCH_HAS_PTE_SPECIAL if !(32BIT && CPU_HAS_RIXI)
+ select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+ select ARCH_HAS_UBSAN_SANITIZE_ALL
+--
+2.30.2
+
--- /dev/null
+From 15353e297929641d9d5158004c205c3781912a7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 10:34:02 +0800
+Subject: MIPS: fix local_irq_{disable,enable} in asmmacro.h
+
+From: Huang Pei <huangpei@loongson.cn>
+
+[ Upstream commit 05c4e2721d7af0df7bc1378a23712a0fd16947b5 ]
+
+commit ba9196d2e005 ("MIPS: Make DIEI support as a config option")
+use CPU_HAS_DIEI to indicate whether di/ei is implemented correctly,
+without this patch, "local_irq_disable" from entry.S in 3A1000
+(with buggy di/ei) lose protection of commit e97c5b609880 ("MIPS:
+Make irqflags.h functions preempt-safe for non-mipsr2 cpus")
+
+Fixes: ba9196d2e005 ("MIPS: Make DIEI support as a config option")
+Signed-off-by: Huang Pei <huangpei@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/asmmacro.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 86f2323ebe6b..ca83ada7015f 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -44,8 +44,7 @@
+ .endm
+ #endif
+
+-#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR5) || \
+- defined(CONFIG_CPU_MIPSR6)
++#ifdef CONFIG_CPU_HAS_DIEI
+ .macro local_irq_enable reg=t0
+ ei
+ irq_enable_hazard
+--
+2.30.2
+
--- /dev/null
+From 9d4a20a3caaefc2ac707362ff66ace65f13430c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 11:24:51 +0800
+Subject: MIPS: loongson64: fix bug when PAGE_SIZE > 16KB
+
+From: Huang Pei <huangpei@loongson.cn>
+
+[ Upstream commit 509d36a941a3466b78d4377913623d210b162458 ]
+
+When page size larger than 16KB, arguments "vaddr + size(16KB)" in
+"ioremap_page_range(vaddr, vaddr + size,...)" called by
+"add_legacy_isa_io" is not page-aligned.
+
+As loongson64 needs at least page size 16KB to get rid of cache alias,
+and "vaddr" is 64KB-aligned, and 64KB is largest page size supported,
+rounding "size" up to PAGE_SIZE is enough for all page size supported.
+
+Fixes: 6d0068ad15e4 ("MIPS: Loongson64: Process ISA Node in DeviceTree")
+Signed-off-by: Huang Pei <huangpei@loongson.cn>
+Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/loongson64/init.c b/arch/mips/loongson64/init.c
+index cfa788bca871..1c664b23c0f9 100644
+--- a/arch/mips/loongson64/init.c
++++ b/arch/mips/loongson64/init.c
+@@ -126,7 +126,7 @@ static int __init add_legacy_isa_io(struct fwnode_handle *fwnode, resource_size_
+ return -ENOMEM;
+
+ range->fwnode = fwnode;
+- range->size = size;
++ range->size = size = round_up(size, PAGE_SIZE);
+ range->hw_start = hw_start;
+ range->flags = LOGIC_PIO_CPU_MMIO;
+
+--
+2.30.2
+
--- /dev/null
+From 25886bc2342686f4747e0d95d3048aec9d0cadba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 20:12:37 -0700
+Subject: MIPS: pci-legacy: stop using of_pci_range_to_resource
+
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+
+[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ]
+
+Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after
+of_pci_range_to_resource() change").
+
+Most MIPS platforms do not define PCI_IOBASE, nor implement
+pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS
+platforms. of_pci_range_to_resource passes the _start address_ of the IO
+range into pci_address_to_pio, which then checks it against
+IO_SPACE_LIMIT and fails, because for MIPS platforms that use
+pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much
+higher than 0xffff.
+
+In fact, pci-mt7621 in staging already works around this problem, see
+commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set
+resource limits")
+
+So just stop using of_pci_range_to_resource, which does not work for
+MIPS.
+
+Fixes PCI errors like:
+ pci_bus 0000:00: root bus resource [io 0xffffffff]
+
+Fixes: 0b0b0893d49b ("of/pci: Fix the conversion of IO ranges into IO resources")
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Cc: Liviu Dudau <Liviu.Dudau@arm.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/pci/pci-legacy.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c
+index 39052de915f3..3a909194284a 100644
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -166,8 +166,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node)
+ res = hose->mem_resource;
+ break;
+ }
+- if (res != NULL)
+- of_pci_range_to_resource(&range, node, res);
++ if (res != NULL) {
++ res->name = node->full_name;
++ res->flags = range.flags;
++ res->start = range.cpu_addr;
++ res->end = range.cpu_addr + range.size - 1;
++ res->parent = res->child = res->sibling = NULL;
++ }
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 949584a07d9f45171078a9c72e2b7d04a8f5b7b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:56:39 -0700
+Subject: mm: memcontrol: slab: fix obtain a reference to a freeing memcg
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 9f38f03ae8d5f57371b71aa6b4275765b65454fd ]
+
+Patch series "Use obj_cgroup APIs to charge kmem pages", v5.
+
+Since Roman's series "The new cgroup slab memory controller" applied.
+All slab objects are charged with the new APIs of obj_cgroup. The new
+APIs introduce a struct obj_cgroup to charge slab objects. It prevents
+long-living objects from pinning the original memory cgroup in the
+memory. But there are still some corner objects (e.g. allocations
+larger than order-1 page on SLUB) which are not charged with the new
+APIs. Those objects (include the pages which are allocated from buddy
+allocator directly) are charged as kmem pages which still hold a
+reference to the memory cgroup.
+
+E.g. We know that the kernel stack is charged as kmem pages because the
+size of the kernel stack can be greater than 2 pages (e.g. 16KB on
+x86_64 or arm64). If we create a thread (suppose the thread stack is
+charged to memory cgroup A) and then move it from memory cgroup A to
+memory cgroup B. Because the kernel stack of the thread hold a
+reference to the memory cgroup A. The thread can pin the memory cgroup
+A in the memory even if we remove the cgroup A. If we want to see this
+scenario by using the following script. We can see that the system has
+added 500 dying cgroups (This is not a real world issue, just a script
+to show that the large kmallocs are charged as kmem pages which can pin
+the memory cgroup in the memory).
+
+ #!/bin/bash
+
+ cat /proc/cgroups | grep memory
+
+ cd /sys/fs/cgroup/memory
+ echo 1 > memory.move_charge_at_immigrate
+
+ for i in range{1..500}
+ do
+ mkdir kmem_test
+ echo $$ > kmem_test/cgroup.procs
+ sleep 3600 &
+ echo $$ > cgroup.procs
+ echo `cat kmem_test/cgroup.procs` > cgroup.procs
+ rmdir kmem_test
+ done
+
+ cat /proc/cgroups | grep memory
+
+This patchset aims to make those kmem pages to drop the reference to
+memory cgroup by using the APIs of obj_cgroup. Finally, we can see that
+the number of the dying cgroups will not increase if we run the above test
+script.
+
+This patch (of 7):
+
+The rcu_read_lock/unlock only can guarantee that the memcg will not be
+freed, but it cannot guarantee the success of css_get (which is in the
+refill_stock when cached memcg changed) to memcg.
+
+ rcu_read_lock()
+ memcg = obj_cgroup_memcg(old)
+ __memcg_kmem_uncharge(memcg)
+ refill_stock(memcg)
+ if (stock->cached != memcg)
+ // css_get can change the ref counter from 0 back to 1.
+ css_get(&memcg->css)
+ rcu_read_unlock()
+
+This fix is very like the commit:
+
+ eefbfa7fd678 ("mm: memcg/slab: fix use after free in obj_cgroup_charge")
+
+Fix this by holding a reference to the memcg which is passed to the
+__memcg_kmem_uncharge() before calling __memcg_kmem_uncharge().
+
+Link: https://lkml.kernel.org/r/20210319163821.20704-1-songmuchun@bytedance.com
+Link: https://lkml.kernel.org/r/20210319163821.20704-2-songmuchun@bytedance.com
+Fixes: 3de7d4f25a74 ("mm: memcg/slab: optimize objcg stock draining")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Cc: Xiongchun Duan <duanxiongchun@bytedance.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memcontrol.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index e064ac0d850a..e876ba693998 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3181,9 +3181,17 @@ static void drain_obj_stock(struct memcg_stock_pcp *stock)
+ unsigned int nr_bytes = stock->nr_bytes & (PAGE_SIZE - 1);
+
+ if (nr_pages) {
++ struct mem_cgroup *memcg;
++
+ rcu_read_lock();
+- __memcg_kmem_uncharge(obj_cgroup_memcg(old), nr_pages);
++retry:
++ memcg = obj_cgroup_memcg(old);
++ if (unlikely(!css_tryget(&memcg->css)))
++ goto retry;
+ rcu_read_unlock();
++
++ __memcg_kmem_uncharge(memcg, nr_pages);
++ css_put(&memcg->css);
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 448fce2837abd2e1162eef4288eceb09d5575551 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 23:02:19 -0700
+Subject: mm/memory-failure: unnecessary amount of unmapping
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ]
+
+It appears that unmap_mapping_range() actually takes a 'size' as its third
+argument rather than a location, the current calling fashion causes
+unnecessary amount of unmapping to occur.
+
+Link: https://lkml.kernel.org/r/20210420002821.2749748-1-jane.chu@oracle.com
+Fixes: 6100e34b2526e ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages")
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 24210c9bd843..bd3945446d47 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1368,7 +1368,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
+ * communicated in siginfo, see kill_proc()
+ */
+ start = (page->index << PAGE_SHIFT) & ~(size - 1);
+- unmap_mapping_range(page->mapping, start, start + size, 0);
++ unmap_mapping_range(page->mapping, start, size, 0);
+ }
+ kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags);
+ rc = 0;
+--
+2.30.2
+
--- /dev/null
+From b6053f7a8300ec89984740a13fbcf0668eb4977f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:54:42 -0700
+Subject: mm, slub: enable slub_debug static key when creating cache with
+ explicit debug flags
+
+From: Vlastimil Babka <vbabka@suse.cz>
+
+[ Upstream commit 1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66 ]
+
+Commit ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")
+introduced a static key to optimize the case where no debugging is
+enabled for any cache. The static key is enabled when slub_debug boot
+parameter is passed, or CONFIG_SLUB_DEBUG_ON enabled.
+
+However, some caches might be created with one or more debugging flags
+explicitly passed to kmem_cache_create(), and the commit missed this.
+Thus the debugging functionality would not be actually performed for
+these caches unless the static key gets enabled by boot param or config.
+
+This patch fixes it by checking for debugging flags passed to
+kmem_cache_create() and enabling the static key accordingly.
+
+Note such explicit debugging flags should not be used outside of
+debugging and testing as they will now enable the static key globally.
+btrfs_init_cachep() creates a cache with SLAB_RED_ZONE but that's a
+mistake that's being corrected [1]. rcu_torture_stats() creates a cache
+with SLAB_STORE_USER, but that is a testing module so it's OK and will
+start working as intended after this patch.
+
+Also note that in case of backports to kernels before v5.12 that don't
+have 59450bbc12be ("mm, slab, slub: stop taking cpu hotplug lock"),
+static_branch_enable_cpuslocked() should be used.
+
+[1] https://lore.kernel.org/linux-btrfs/20210315141824.26099-1-dsterba@suse.com/
+
+Link: https://lkml.kernel.org/r/20210315153415.24404-1-vbabka@suse.cz
+Fixes: ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Reported-by: Oliver Glitta <glittao@gmail.com>
+Acked-by: David Rientjes <rientjes@google.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: "Paul E. McKenney" <paulmck@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/slub.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 3021ce9bf1b3..0fa68cfa648b 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -3827,6 +3827,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+
+ static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
+ {
++#ifdef CONFIG_SLUB_DEBUG
++ /*
++ * If no slub_debug was enabled globally, the static key is not yet
++ * enabled by setup_slub_debug(). Enable it if the cache is being
++ * created with any of the debugging flags passed explicitly.
++ */
++ if (flags & SLAB_DEBUG_FLAGS)
++ static_branch_enable(&slub_debug_enabled);
++#endif
+ s->flags = kmem_cache_flags(s->size, flags, s->name);
+ #ifdef CONFIG_SLAB_FREELIST_HARDENED
+ s->random = get_random_long();
+--
+2.30.2
+
--- /dev/null
+From 414bcecfed38637bf303e38b7290adfd914576ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:57:58 -0700
+Subject: mm/sparse: add the missing sparse_buffer_fini() in error branch
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ]
+
+sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a
+WARN issue would be through the next time sparse_buffer_init() runs.
+
+Add the missing sparse_buffer_fini() in error branch.
+
+Link: https://lkml.kernel.org/r/20210325113155.118574-1-wangwensheng4@huawei.com
+Fixes: 85c77f791390 ("mm/sparse: add new sparse_init_nid() and sparse_init()")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/sparse.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 7bd23f9d6cef..33406ea2ecc4 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -547,6 +547,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin,
+ pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.",
+ __func__, nid);
+ pnum_begin = pnum;
++ sparse_buffer_fini();
+ goto failed;
+ }
+ check_usemap_section_nr(nid, usage);
+--
+2.30.2
+
--- /dev/null
+From 154af051c627d117dd605c90eeae95e08cc636f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 15:38:02 -0700
+Subject: mptcp: fix format specifiers for unsigned int
+
+From: Geliang Tang <geliangtang@gmail.com>
+
+[ Upstream commit e4b6135134a75f530bd634ea7c168efaf0f9dff3 ]
+
+Some of the sequence numbers are printed as the negative ones in the debug
+log:
+
+[ 46.250932] MPTCP: DSS
+[ 46.250940] MPTCP: data_fin=0 dsn64=0 use_map=0 ack64=1 use_ack=1
+[ 46.250948] MPTCP: data_ack=2344892449471675613
+[ 46.251012] MPTCP: msk=000000006e157e3f status=10
+[ 46.251023] MPTCP: msk=000000006e157e3f snd_data_fin_enable=0 pending=0 snd_nxt=2344892449471700189 write_seq=2344892449471700189
+[ 46.251343] MPTCP: msk=00000000ec44a129 ssk=00000000f7abd481 sending dfrag at seq=-1658937016627538668 len=100 already sent=0
+[ 46.251360] MPTCP: data_seq=16787807057082012948 subflow_seq=1 data_len=100 dsn64=1
+
+This patch used the format specifier %u instead of %d for the unsigned int
+values to fix it.
+
+Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()")
+Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Geliang Tang <geliangtang@gmail.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 4bde960e19dc..5043c7cb0782 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1275,7 +1275,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
+ int avail_size;
+ size_t ret = 0;
+
+- pr_debug("msk=%p ssk=%p sending dfrag at seq=%lld len=%d already sent=%d",
++ pr_debug("msk=%p ssk=%p sending dfrag at seq=%llu len=%u already sent=%u",
+ msk, ssk, dfrag->data_seq, dfrag->data_len, info->sent);
+
+ /* compute send limit */
+@@ -1693,7 +1693,7 @@ static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ if (!msk->first_pending)
+ WRITE_ONCE(msk->first_pending, dfrag);
+ }
+- pr_debug("msk=%p dfrag at seq=%lld len=%d sent=%d new=%d", msk,
++ pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d", msk,
+ dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
+ !dfrag_collapsed);
+
+--
+2.30.2
+
--- /dev/null
+From f7243ac7a579620a45798c35610714533a4c53c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 09:40:33 -0700
+Subject: mptcp: Retransmit DATA_FIN
+
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+
+[ Upstream commit 6477dd39e62c3a67cfa368ddc127410b4ae424c6 ]
+
+With this change, the MPTCP-level retransmission timer is used to resend
+DATA_FIN. The retranmit timer is not stopped while waiting for a
+MPTCP-level ACK of DATA_FIN, and retransmitted DATA_FINs are sent on all
+subflows. The retry interval starts at TCP_RTO_MIN and then doubles on
+each attempt, up to TCP_RTO_MAX.
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/146
+Fixes: 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 5043c7cb0782..65e5d3eb1078 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -399,6 +399,14 @@ static bool mptcp_pending_data_fin(struct sock *sk, u64 *seq)
+ return false;
+ }
+
++static void mptcp_set_datafin_timeout(const struct sock *sk)
++{
++ struct inet_connection_sock *icsk = inet_csk(sk);
++
++ mptcp_sk(sk)->timer_ival = min(TCP_RTO_MAX,
++ TCP_RTO_MIN << icsk->icsk_retransmits);
++}
++
+ static void mptcp_set_timeout(const struct sock *sk, const struct sock *ssk)
+ {
+ long tout = ssk && inet_csk(ssk)->icsk_pending ?
+@@ -1052,7 +1060,7 @@ out:
+ }
+
+ if (snd_una == READ_ONCE(msk->snd_nxt)) {
+- if (msk->timer_ival)
++ if (msk->timer_ival && !mptcp_data_fin_enabled(msk))
+ mptcp_stop_timer(sk);
+ } else {
+ mptcp_reset_timer(sk);
+@@ -2276,8 +2284,19 @@ static void __mptcp_retrans(struct sock *sk)
+
+ __mptcp_clean_una_wakeup(sk);
+ dfrag = mptcp_rtx_head(sk);
+- if (!dfrag)
++ if (!dfrag) {
++ if (mptcp_data_fin_enabled(msk)) {
++ struct inet_connection_sock *icsk = inet_csk(sk);
++
++ icsk->icsk_retransmits++;
++ mptcp_set_datafin_timeout(sk);
++ mptcp_send_ack(msk);
++
++ goto reset_timer;
++ }
++
+ return;
++ }
+
+ ssk = mptcp_subflow_get_retrans(msk);
+ if (!ssk)
+@@ -2460,6 +2479,8 @@ void mptcp_subflow_shutdown(struct sock *sk, struct sock *ssk, int how)
+ pr_debug("Sending DATA_FIN on subflow %p", ssk);
+ mptcp_set_timeout(sk, ssk);
+ tcp_send_ack(ssk);
++ if (!mptcp_timer_pending(sk))
++ mptcp_reset_timer(sk);
+ }
+ break;
+ }
+--
+2.30.2
+
--- /dev/null
+From 273fc50603c8a03ee5c333ed0e6cc3d7379f22ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:29:34 +0100
+Subject: mt76: check return value of mt76_txq_send_burst in
+ mt76_txq_schedule_list
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 57b8b57516c5108b0078051a31c68dc9dfcbf68f ]
+
+Since mt76_txq_send_burst routine can report a negative error code,
+check the returned value before incrementing the number of transmitted
+frames in mt76_txq_schedule_list routine.
+Return -EBUSY directly if the device is in reset or in power management.
+
+Fixes: 90fdc1717b186 ("mt76: use mac80211 txq scheduling")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/tx.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index b8fe8adc43a3..451ed60c6296 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -461,11 +461,11 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)
+ int ret = 0;
+
+ while (1) {
++ int n_frames = 0;
++
+ if (test_bit(MT76_STATE_PM, &phy->state) ||
+- test_bit(MT76_RESET, &phy->state)) {
+- ret = -EBUSY;
+- break;
+- }
++ test_bit(MT76_RESET, &phy->state))
++ return -EBUSY;
+
+ if (dev->queue_ops->tx_cleanup &&
+ q->queued + 2 * MT_TXQ_FREE_THR >= q->ndesc) {
+@@ -497,11 +497,16 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid)
+ }
+
+ if (!mt76_txq_stopped(q))
+- ret += mt76_txq_send_burst(phy, q, mtxq);
++ n_frames = mt76_txq_send_burst(phy, q, mtxq);
+
+ spin_unlock_bh(&q->lock);
+
+ ieee80211_return_txq(phy->hw, txq, false);
++
++ if (unlikely(n_frames < 0))
++ return n_frames;
++
++ ret += n_frames;
+ }
+
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From dfff4b200ccd8cea91ca9dc354496807a2237c6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 18:28:43 +0100
+Subject: mt76: connac: fix kernel warning adding monitor interface
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit c996f0346e40e3b1ac2ebaf0681df898fb157f60 ]
+
+Fix the following kernel warning adding a monitor interface in
+mt76_connac_mcu_uni_add_dev routine.
+
+[ 507.984882] ------------[ cut here ]------------
+[ 507.989515] WARNING: CPU: 1 PID: 3017 at mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]
+[ 508.059379] CPU: 1 PID: 3017 Comm: ifconfig Not tainted 5.4.98 #0
+[ 508.065461] Hardware name: MT7622_MT7531 RFB (DT)
+[ 508.070156] pstate: 80000005 (Nzcv daif -PAN -UAO)
+[ 508.074939] pc : mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]
+[ 508.081806] lr : mt7921_eeprom_init+0x1288/0x1cb8 [mt7921e]
+[ 508.087367] sp : ffffffc013a33930
+[ 508.090671] x29: ffffffc013a33930 x28: ffffff801e628ac0
+[ 508.095973] x27: ffffff801c7f1200 x26: ffffff801c7eb008
+[ 508.101275] x25: ffffff801c7eaef0 x24: ffffff801d025610
+[ 508.106577] x23: ffffff801d022990 x22: ffffff801d024de8
+[ 508.111879] x21: ffffff801d0226a0 x20: ffffff801c7eaee8
+[ 508.117181] x19: ffffff801d0226a0 x18: 000000005d00b000
+[ 508.122482] x17: 00000000ffffffff x16: 0000000000000000
+[ 508.127785] x15: 0000000000000080 x14: ffffff801d704000
+[ 508.133087] x13: 0000000000000040 x12: 0000000000000002
+[ 508.138389] x11: 000000000000000c x10: 0000000000000000
+[ 508.143691] x9 : 0000000000000020 x8 : 0000000000000001
+[ 508.148992] x7 : 0000000000000000 x6 : 0000000000000000
+[ 508.154294] x5 : ffffff801c7eaee8 x4 : 0000000000000006
+[ 508.159596] x3 : 0000000000000001 x2 : 0000000000000000
+[ 508.164898] x1 : ffffff801c7eac08 x0 : ffffff801d0226a0
+[ 508.170200] Call trace:
+[ 508.172640] mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]
+[ 508.179159] mt7921_eeprom_init+0x1288/0x1cb8 [mt7921e]
+[ 508.184394] drv_add_interface+0x34/0x88 [mac80211]
+[ 508.189271] ieee80211_add_virtual_monitor+0xe0/0xb48 [mac80211]
+[ 508.195277] ieee80211_do_open+0x86c/0x918 [mac80211]
+[ 508.200328] ieee80211_do_open+0x900/0x918 [mac80211]
+[ 508.205372] __dev_open+0xcc/0x150
+[ 508.208763] __dev_change_flags+0x134/0x198
+[ 508.212937] dev_change_flags+0x20/0x60
+[ 508.216764] devinet_ioctl+0x3e8/0x748
+[ 508.220503] inet_ioctl+0x1e4/0x350
+[ 508.223983] sock_do_ioctl+0x48/0x2a0
+[ 508.227635] sock_ioctl+0x310/0x4f8
+[ 508.231116] do_vfs_ioctl+0xa4/0xac0
+[ 508.234681] ksys_ioctl+0x44/0x90
+[ 508.237985] __arm64_sys_ioctl+0x1c/0x48
+[ 508.241901] el0_svc_common.constprop.1+0x7c/0x100
+[ 508.246681] el0_svc_handler+0x18/0x20
+[ 508.250421] el0_svc+0x8/0x1c8
+[ 508.253465] ---[ end trace c7b90fee13d72c39 ]---
+[ 508.261278] ------------[ cut here ]------------
+
+Fixes: d0e274af2f2e4 ("mt76: mt76_connac: create mcu library")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 4356bf130dbd..8e9e42b77692 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -946,6 +946,7 @@ int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy,
+
+ switch (vif->type) {
+ case NL80211_IFTYPE_MESH_POINT:
++ case NL80211_IFTYPE_MONITOR:
+ case NL80211_IFTYPE_AP:
+ basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
+ break;
+--
+2.30.2
+
--- /dev/null
+From 4b3b711ac3acaa4d7a63d95809ecfba1fa96e0cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:28:47 +0100
+Subject: mt76: connac: fix up the setting for ht40 mode in
+ mt76_connac_mcu_uni_add_bss
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit a7e3033fcdb60ad51b03896ae99ad9447389bed0 ]
+
+Use proper value for ht40 mode configuration in mt76_connac_mcu_uni_add_bss
+routine and not ht20 one
+
+Fixes: d0e274af2f2e4 ("mt76: mt76_connac: create mcu library")
+Co-developed-by: Soul Huang <Soul.Huang@mediatek.com>
+Signed-off-by: Soul Huang <Soul.Huang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 6cbccfb05f8b..4356bf130dbd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -1195,6 +1195,7 @@ int mt76_connac_mcu_uni_add_bss(struct mt76_phy *phy,
+ .center_chan = ieee80211_frequency_to_channel(freq1),
+ .center_chan2 = ieee80211_frequency_to_channel(freq2),
+ .tx_streams = hweight8(phy->antenna_mask),
++ .ht_op_info = 4, /* set HT 40M allowed */
+ .rx_streams = phy->chainmask,
+ .short_st = true,
+ },
+@@ -1287,6 +1288,7 @@ int mt76_connac_mcu_uni_add_bss(struct mt76_phy *phy,
+ case NL80211_CHAN_WIDTH_20:
+ default:
+ rlm_req.rlm.bw = CMD_CBW_20MHZ;
++ rlm_req.rlm.ht_op_info = 0;
+ break;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a61c1edbf9611e57d4c2a0f448f42b9cfe71de95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 16:06:02 +0800
+Subject: mt76: mt7615: cleanup mcu tx queue in mt7615_dma_reset()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 69e74d7f23d515fb559b2e0bebfdf4c458d9507d ]
+
+With this patch, mt7615_mac_reset_work() can recover system back.
+
+Fixes: e637763b606b ("mt76: move mcu queues to mt76_dev q_mcu array")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index f594ea25ece6..d73841480544 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -1970,15 +1970,17 @@ void mt7615_dma_reset(struct mt7615_dev *dev)
+ mt76_clear(dev, MT_WPDMA_GLO_CFG,
+ MT_WPDMA_GLO_CFG_RX_DMA_EN | MT_WPDMA_GLO_CFG_TX_DMA_EN |
+ MT_WPDMA_GLO_CFG_TX_WRITEBACK_DONE);
++
+ usleep_range(1000, 2000);
+
+- mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_WM], true);
+ for (i = 0; i < __MT_TXQ_MAX; i++)
+ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
+
+- mt76_for_each_q_rx(&dev->mt76, i) {
++ for (i = 0; i < __MT_MCUQ_MAX; i++)
++ mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
++
++ mt76_for_each_q_rx(&dev->mt76, i)
+ mt76_queue_rx_reset(dev, i);
+- }
+
+ mt76_set(dev, MT_WPDMA_GLO_CFG,
+ MT_WPDMA_GLO_CFG_RX_DMA_EN | MT_WPDMA_GLO_CFG_TX_DMA_EN |
+--
+2.30.2
+
--- /dev/null
+From df28f2c6090f018c488701b28d57ea741b1c03bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 14:20:32 +0100
+Subject: mt76: mt7615: Fix a dereference of pointer sta before it is null
+ checked
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4a52d6abb193aea0f2923a2c917502bd2d718630 ]
+
+Currently the assignment of idx dereferences pointer sta before
+sta is null checked, leading to a potential null pointer dereference.
+Fix this by assigning idx when it is required after the null check on
+pointer sta.
+
+Addresses-Coverity: ("Dereference before null check")
+Fixes: a4a5a430b076 ("mt76: mt7615: fix TSF configuration")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+index 4a370b9f7a17..f8d3673c2cae 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+@@ -67,7 +67,7 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
+ struct mt7615_rate_desc *rate = &wrd->rate;
+ struct mt7615_sta *sta = wrd->sta;
+ u32 w5, w27, addr, val;
+- u16 idx = sta->vif->mt76.omac_idx;
++ u16 idx;
+
+ lockdep_assert_held(&dev->mt76.mutex);
+
+@@ -119,6 +119,7 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
+
+ sta->rate_probe = sta->rateset[rate->rateset].probe_rate.idx != -1;
+
++ idx = sta->vif->mt76.omac_idx;
+ idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
+ addr = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
+
+--
+2.30.2
+
--- /dev/null
+From 0a48b0bb7223883d9db374bd03ab80b0784626d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 13:34:56 +0800
+Subject: mt76: mt7615: fix memleak when mt7615_unregister_device()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 8ab31da7b89f71c4c2defcca989fab7b42f87d71 ]
+
+mt7615_tx_token_put() should get call before mt76_free_pending_txwi().
+
+Fixes: a6275e934605 ("mt76: mt7615: reset token when mac_reset happens")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+index 72395925ddee..15b417d6d889 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+@@ -163,10 +163,9 @@ void mt7615_unregister_device(struct mt7615_dev *dev)
+ mt76_unregister_device(&dev->mt76);
+ if (mcu_running)
+ mt7615_mcu_exit(dev);
+- mt7615_dma_cleanup(dev);
+
+ mt7615_tx_token_put(dev);
+-
++ mt7615_dma_cleanup(dev);
+ tasklet_disable(&dev->irq_tasklet);
+
+ mt76_free_device(&dev->mt76);
+--
+2.30.2
+
--- /dev/null
+From 4910486cc31a124f71e3c747ac5b2b8c0ff5ac9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:22:11 +0100
+Subject: mt76: mt7615: fix memory leak in mt7615_coredump_work
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 49cc85059a2cb656f96ff3693f891e8fe8f669a9 ]
+
+Similar to the issue fixed in mt7921_coredump_work, fix a possible memory
+leak in mt7615_coredump_work routine.
+
+Fixes: d2bf7959d9c0f ("mt76: mt7663: introduce coredump support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index 1abfd58e8f49..b313442b2d9e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -2308,8 +2308,10 @@ void mt7615_coredump_work(struct work_struct *work)
+ break;
+
+ skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
+- if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ)
+- break;
++ if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
++ dev_kfree_skb(skb);
++ continue;
++ }
+
+ memcpy(data, skb->data, skb->len);
+ data += skb->len;
+--
+2.30.2
+
--- /dev/null
+From d06a681dc154460df374137976b38a533c873d65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 11:42:49 +0100
+Subject: mt76: mt7615: fix mib stats counter reporting to mac80211
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 2eb6f6c437745bce46bd7a8f3a22a732d5b9becb ]
+
+In order to properly report MIB counters to mac80211, resets stats in
+mt7615_get_stats routine and hold mt76 mutex accessing MIB counters.
+Sum up MIB counters in mt7615_mac_update_mib_stats routine.
+
+Fixes: c388d8584bc83 ("mt76: mt7615: add a get_stats() callback")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7615/mac.c | 26 ++++++-------------
+ .../net/wireless/mediatek/mt76/mt7615/main.c | 6 +++++
+ .../wireless/mediatek/mt76/mt7615/mt7615.h | 10 +++----
+ 3 files changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index e9c341e193f4..f594ea25ece6 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -1825,10 +1825,8 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy)
+ int i, aggr;
+ u32 val, val2;
+
+- memset(mib, 0, sizeof(*mib));
+-
+- mib->fcs_err_cnt = mt76_get_field(dev, MT_MIB_SDR3(ext_phy),
+- MT_MIB_SDR3_FCS_ERR_MASK);
++ mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(ext_phy),
++ MT_MIB_SDR3_FCS_ERR_MASK);
+
+ val = mt76_get_field(dev, MT_MIB_SDR14(ext_phy),
+ MT_MIB_AMPDU_MPDU_COUNT);
+@@ -1841,24 +1839,16 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy)
+ aggr = ext_phy ? ARRAY_SIZE(dev->mt76.aggr_stats) / 2 : 0;
+ for (i = 0; i < 4; i++) {
+ val = mt76_rr(dev, MT_MIB_MB_SDR1(ext_phy, i));
+-
+- val2 = FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val);
+- if (val2 > mib->ack_fail_cnt)
+- mib->ack_fail_cnt = val2;
+-
+- val2 = FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val);
+- if (val2 > mib->ba_miss_cnt)
+- mib->ba_miss_cnt = val2;
++ mib->ba_miss_cnt += FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val);
++ mib->ack_fail_cnt += FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK,
++ val);
+
+ val = mt76_rr(dev, MT_MIB_MB_SDR0(ext_phy, i));
+- val2 = FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val);
+- if (val2 > mib->rts_retries_cnt) {
+- mib->rts_cnt = FIELD_GET(MT_MIB_RTS_COUNT_MASK, val);
+- mib->rts_retries_cnt = val2;
+- }
++ mib->rts_cnt += FIELD_GET(MT_MIB_RTS_COUNT_MASK, val);
++ mib->rts_retries_cnt += FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK,
++ val);
+
+ val = mt76_rr(dev, MT_TX_AGG_CNT(ext_phy, i));
+-
+ dev->mt76.aggr_stats[aggr++] += val & 0xffff;
+ dev->mt76.aggr_stats[aggr++] += val >> 16;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+index ca74575569ae..8263ff81bb7b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+@@ -803,11 +803,17 @@ mt7615_get_stats(struct ieee80211_hw *hw,
+ struct mt7615_phy *phy = mt7615_hw_phy(hw);
+ struct mib_stats *mib = &phy->mib;
+
++ mt7615_mutex_acquire(phy->dev);
++
+ stats->dot11RTSSuccessCount = mib->rts_cnt;
+ stats->dot11RTSFailureCount = mib->rts_retries_cnt;
+ stats->dot11FCSErrorCount = mib->fcs_err_cnt;
+ stats->dot11ACKFailureCount = mib->ack_fail_cnt;
+
++ memset(mib, 0, sizeof(*mib));
++
++ mt7615_mutex_release(phy->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
+index 491841bc6291..4bc0c379c579 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
+@@ -133,11 +133,11 @@ struct mt7615_vif {
+ };
+
+ struct mib_stats {
+- u16 ack_fail_cnt;
+- u16 fcs_err_cnt;
+- u16 rts_cnt;
+- u16 rts_retries_cnt;
+- u16 ba_miss_cnt;
++ u32 ack_fail_cnt;
++ u32 fcs_err_cnt;
++ u32 rts_cnt;
++ u32 rts_retries_cnt;
++ u32 ba_miss_cnt;
+ unsigned long aggr_per;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 8804c74d6e966bfed7aadb38c5668713eb36a22f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 16:43:11 +0800
+Subject: mt76: mt7615: fix TSF configuration
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit a4a5a430b076860691e95337787bc666c8ab28ff ]
+
+The index of TSF counters should follow HWBSSID.
+
+Fixes: d8d59f66d136 ("mt76: mt7615: support 16 interfaces")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 +++++-
+ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 16 ++++++++++++++--
+ drivers/net/wireless/mediatek/mt76/mt7615/regs.h | 7 ++++---
+ .../net/wireless/mediatek/mt76/mt7615/usb_sdio.c | 6 +++++-
+ 4 files changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index b313442b2d9e..e9c341e193f4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -966,6 +966,7 @@ void mt7615_mac_set_rates(struct mt7615_phy *phy, struct mt7615_sta *sta,
+ struct mt7615_dev *dev = phy->dev;
+ struct mt7615_rate_desc rd;
+ u32 w5, w27, addr;
++ u16 idx = sta->vif->mt76.omac_idx;
+
+ if (!mt76_is_mmio(&dev->mt76)) {
+ mt7615_mac_queue_rate_update(phy, sta, probe_rate, rates);
+@@ -1017,7 +1018,10 @@ void mt7615_mac_set_rates(struct mt7615_phy *phy, struct mt7615_sta *sta,
+
+ mt76_wr(dev, addr + 27 * 4, w27);
+
+- mt76_set(dev, MT_LPON_T0CR, MT_LPON_T0CR_MODE); /* TSF read */
++ idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
++ addr = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
++
++ mt76_set(dev, addr, MT_LPON_TCR_MODE); /* TSF read */
+ sta->rate_set_tsf = mt76_rr(dev, MT_LPON_UTTR0) & ~BIT(0);
+ sta->rate_set_tsf |= rd.rateset;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+index 25faf486d279..ca74575569ae 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+@@ -814,15 +814,21 @@ mt7615_get_stats(struct ieee80211_hw *hw,
+ static u64
+ mt7615_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
++ struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
+ struct mt7615_dev *dev = mt7615_hw_dev(hw);
+ union {
+ u64 t64;
+ u32 t32[2];
+ } tsf;
++ u16 idx = mvif->mt76.omac_idx;
++ u32 reg;
++
++ idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
++ reg = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
+
+ mt7615_mutex_acquire(dev);
+
+- mt76_set(dev, MT_LPON_T0CR, MT_LPON_T0CR_MODE); /* TSF read */
++ mt76_set(dev, reg, MT_LPON_TCR_MODE); /* TSF read */
+ tsf.t32[0] = mt76_rr(dev, MT_LPON_UTTR0);
+ tsf.t32[1] = mt76_rr(dev, MT_LPON_UTTR1);
+
+@@ -835,18 +841,24 @@ static void
+ mt7615_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ u64 timestamp)
+ {
++ struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
+ struct mt7615_dev *dev = mt7615_hw_dev(hw);
+ union {
+ u64 t64;
+ u32 t32[2];
+ } tsf = { .t64 = timestamp, };
++ u16 idx = mvif->mt76.omac_idx;
++ u32 reg;
++
++ idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
++ reg = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
+
+ mt7615_mutex_acquire(dev);
+
+ mt76_wr(dev, MT_LPON_UTTR0, tsf.t32[0]);
+ mt76_wr(dev, MT_LPON_UTTR1, tsf.t32[1]);
+ /* TSF software overwrite */
+- mt76_set(dev, MT_LPON_T0CR, MT_LPON_T0CR_WRITE);
++ mt76_set(dev, reg, MT_LPON_TCR_WRITE);
+
+ mt7615_mutex_release(dev);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/regs.h b/drivers/net/wireless/mediatek/mt76/mt7615/regs.h
+index 6e5db015b32c..6e4710d3ddd3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/regs.h
+@@ -447,9 +447,10 @@ enum mt7615_reg_base {
+
+ #define MT_LPON(_n) ((dev)->reg_map[MT_LPON_BASE] + (_n))
+
+-#define MT_LPON_T0CR MT_LPON(0x010)
+-#define MT_LPON_T0CR_MODE GENMASK(1, 0)
+-#define MT_LPON_T0CR_WRITE BIT(0)
++#define MT_LPON_TCR0(_n) MT_LPON(0x010 + ((_n) * 4))
++#define MT_LPON_TCR2(_n) MT_LPON(0x0f8 + ((_n) - 2) * 4)
++#define MT_LPON_TCR_MODE GENMASK(1, 0)
++#define MT_LPON_TCR_WRITE BIT(0)
+
+ #define MT_LPON_UTTR0 MT_LPON(0x018)
+ #define MT_LPON_UTTR1 MT_LPON(0x01c)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+index 203256862dfd..4a370b9f7a17 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+@@ -67,6 +67,7 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
+ struct mt7615_rate_desc *rate = &wrd->rate;
+ struct mt7615_sta *sta = wrd->sta;
+ u32 w5, w27, addr, val;
++ u16 idx = sta->vif->mt76.omac_idx;
+
+ lockdep_assert_held(&dev->mt76.mutex);
+
+@@ -118,7 +119,10 @@ static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,
+
+ sta->rate_probe = sta->rateset[rate->rateset].probe_rate.idx != -1;
+
+- mt76_set(dev, MT_LPON_T0CR, MT_LPON_T0CR_MODE); /* TSF read */
++ idx = idx > HW_BSSID_MAX ? HW_BSSID_0 : idx;
++ addr = idx > 1 ? MT_LPON_TCR2(idx): MT_LPON_TCR0(idx);
++
++ mt76_set(dev, addr, MT_LPON_TCR_MODE); /* TSF read */
+ val = mt76_rr(dev, MT_LPON_UTTR0);
+ sta->rate_set_tsf = (val & ~BIT(0)) | rate->rateset;
+
+--
+2.30.2
+
--- /dev/null
+From c01fb811490099cb17e177da92be9e1ee094c26a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Feb 2021 18:42:15 +0100
+Subject: mt76: mt7615: fix tx skb dma unmap
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit ebee7885bb12a8fe2c2f9bac87dbd87a05b645f9 ]
+
+The first pointer in the txp needs to be unmapped as well, otherwise it will
+leak DMA mapping entries
+
+Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index 62cbca5f3be4..1abfd58e8f49 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -690,7 +690,7 @@ mt7615_txp_skb_unmap_fw(struct mt76_dev *dev, struct mt7615_fw_txp *txp)
+ {
+ int i;
+
+- for (i = 1; i < txp->nbuf; i++)
++ for (i = 0; i < txp->nbuf; i++)
+ dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]),
+ le16_to_cpu(txp->len[i]), DMA_TO_DEVICE);
+ }
+--
+2.30.2
+
--- /dev/null
+From 4731402a38e45e74cb1294b1eb3426d5869bec29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 21:25:21 +0800
+Subject: mt76: mt7663: fix when beacon filter is being applied
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 4bec61d9fb9629c21e60cd24a97235ea1f6020ec ]
+
+HW beacon filter command is being applied until we're in associated state
+because the command would rely on the associated access point's beacon
+interval and DTIM information.
+
+Fixes: 7124198ab1a4 ("mt76: mt7615: enable beacon filtering by default for offload fw")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+index 8263ff81bb7b..6107e827b383 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+@@ -217,8 +217,6 @@ static int mt7615_add_interface(struct ieee80211_hw *hw,
+ ret = mt7615_mcu_add_dev_info(phy, vif, true);
+ if (ret)
+ goto out;
+-
+- mt7615_mac_set_beacon_filter(phy, vif, true);
+ out:
+ mt7615_mutex_release(dev);
+
+@@ -244,7 +242,6 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw,
+
+ mt76_connac_free_pending_tx_skbs(&dev->pm, &msta->wcid);
+
+- mt7615_mac_set_beacon_filter(phy, vif, false);
+ mt7615_mcu_add_dev_info(phy, vif, false);
+
+ rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+@@ -544,6 +541,9 @@ static void mt7615_bss_info_changed(struct ieee80211_hw *hw,
+ if (changed & BSS_CHANGED_ARP_FILTER)
+ mt7615_mcu_update_arp_filter(hw, vif, info);
+
++ if (changed & BSS_CHANGED_ASSOC)
++ mt7615_mac_set_beacon_filter(phy, vif, info->assoc);
++
+ mt7615_mutex_release(dev);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 325ae5844e9589eb819cfc89267c5099dac2054d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 21:25:23 +0800
+Subject: mt76: mt7663s: fix the possible device hang in high traffic
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 45247a85614b49b07b9dc59a4e6783b17e766ff2 ]
+
+Use the additional memory barrier to ensure the skb list up-to-date
+between the skb producer and consumer to avoid the invalid skb content
+written into sdio controller and then cause device hang due to mcu assert
+caught by WR_TIMEOUT_INT.
+
+Fixes: 1522ff731f84 ("mt76: mt7663s: introduce sdio tx aggregation")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 ++
+ drivers/net/wireless/mediatek/mt76/sdio.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+index 37fe65ced4fd..4393dd21ebbb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+@@ -225,6 +225,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ struct mt76_queue_entry *e = &q->entry[q->first];
+ struct sk_buff *iter;
+
++ smp_rmb();
++
+ if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) {
+ __skb_put_zero(e->skb, 4);
+ err = __mt7663s_xmit_queue(dev, e->skb->data,
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
+index 0b6facb17ff7..a18d2896ee1f 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/sdio.c
+@@ -256,6 +256,9 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+
+ q->entry[q->head].skb = tx_info.skb;
+ q->entry[q->head].buf_sz = len;
++
++ smp_wmb();
++
+ q->head = (q->head + 1) % q->ndesc;
+ q->queued++;
+
+--
+2.30.2
+
--- /dev/null
+From e97da3a3a07f1c10675d7bf22d5fb5b2a23208d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 21:25:22 +0800
+Subject: mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx
+ aggregation
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 455ae5aabcc72fed7e5c803d59d122415500dc08 ]
+
+Each packet should be padded with the additional zero to become 4-bytes
+alignment in sdio tx aggregation.
+
+Fixes: 1522ff731f84 ("mt76: mt7663s: introduce sdio tx aggregation")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+index 9fb506f2ace6..37fe65ced4fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+@@ -218,6 +218,7 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ int qid, err, nframes = 0, len = 0, pse_sz = 0, ple_sz = 0;
+ bool mcu = q == dev->q_mcu[MT_MCUQ_WM];
+ struct mt76_sdio *sdio = &dev->sdio;
++ u8 pad;
+
+ qid = mcu ? ARRAY_SIZE(sdio->xmit_buf) - 1 : q->qid;
+ while (q->first != q->head) {
+@@ -234,7 +235,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ goto next;
+ }
+
+- if (len + e->skb->len + 4 > MT76S_XMIT_BUF_SZ)
++ pad = roundup(e->skb->len, 4) - e->skb->len;
++ if (len + e->skb->len + pad + 4 > MT76S_XMIT_BUF_SZ)
+ break;
+
+ if (mt7663s_tx_pick_quota(sdio, mcu, e->buf_sz, &pse_sz,
+@@ -252,6 +254,11 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ len += iter->len;
+ nframes++;
+ }
++
++ if (unlikely(pad)) {
++ memset(sdio->xmit_buf[qid] + len, 0, pad);
++ len += pad;
++ }
+ next:
+ q->first = (q->first + 1) % q->ndesc;
+ e->done = true;
+--
+2.30.2
+
--- /dev/null
+From d1c5854bca1d28565b4d104138096db3ef2620c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 02:28:56 +0800
+Subject: mt76: mt7915: cleanup mcu tx queue in mt7915_dma_reset()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 1ebea45ef027ee31cd50ed92903071391e792edb ]
+
+Cleanup mcu queues in mt7915_mac_reset_work().
+
+Fixes: e637763b606b ("mt76: move mcu queues to mt76_dev q_mcu array")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index 555274a2f436..819670767521 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -1470,9 +1470,8 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+ }
+
+ static void
+-mt7915_dma_reset(struct mt7915_phy *phy)
++mt7915_dma_reset(struct mt7915_dev *dev)
+ {
+- struct mt7915_dev *dev = phy->dev;
+ struct mt76_phy *mphy_ext = dev->mt76.phy2;
+ u32 hif1_ofs = MT_WFDMA1_PCIE1_BASE - MT_WFDMA1_BASE;
+ int i;
+@@ -1489,18 +1488,20 @@ mt7915_dma_reset(struct mt7915_phy *phy)
+ (MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+ MT_WFDMA1_GLO_CFG_RX_DMA_EN));
+ }
++
+ usleep_range(1000, 2000);
+
+- mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_WA], true);
+ for (i = 0; i < __MT_TXQ_MAX; i++) {
+- mt76_queue_tx_cleanup(dev, phy->mt76->q_tx[i], true);
++ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
+ if (mphy_ext)
+ mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
+ }
+
+- mt76_for_each_q_rx(&dev->mt76, i) {
++ for (i = 0; i < __MT_MCUQ_MAX; i++)
++ mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
++
++ mt76_for_each_q_rx(&dev->mt76, i)
+ mt76_queue_rx_reset(dev, i);
+- }
+
+ /* re-init prefetch settings after reset */
+ mt7915_dma_prefetch(dev);
+@@ -1584,7 +1585,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ idr_init(&dev->token);
+
+ if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
+- mt7915_dma_reset(&dev->phy);
++ mt7915_dma_reset(dev);
+
+ mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_INIT);
+ mt7915_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE);
+--
+2.30.2
+
--- /dev/null
+From 950b4aa27b091cc4a2a95798cdab11863bb550f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 02:14:36 +0100
+Subject: mt76: mt7915: fix aggr len debugfs node
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 9fb9d755fae20b5ad62ef8b4e9289e5baea2c6fc ]
+
+Similar to mt7921, fix 802.11 aggr len debugfs reporting for mt7915 driver.
+
+Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index 77dcd71e49a5..2f706620686e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -124,7 +124,7 @@ mt7915_ampdu_stat_read_phy(struct mt7915_phy *phy,
+ range[i] = mt76_rr(dev, MT_MIB_ARNG(ext_phy, i));
+
+ for (i = 0; i < ARRAY_SIZE(bound); i++)
+- bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i) + 1;
++ bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i % 4) + 1;
+
+ seq_printf(file, "\nPhy %d\n", ext_phy);
+
+--
+2.30.2
+
--- /dev/null
+From 2396a24b58f80b8554425ed3b53c28e26a3db853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 13:34:57 +0800
+Subject: mt76: mt7915: fix memleak when mt7915_unregister_device()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit e9d32af478cfc3744a45245c0b126738af4b3ac4 ]
+
+mt7915_tx_token_put() should get call before mt76_free_pending_txwi().
+
+Fixes: f285dfb98562 ("mt76: mt7915: reset token when mac_reset happens")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index ad4e5b95158b..894016fdcf07 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -675,9 +675,8 @@ void mt7915_unregister_device(struct mt7915_dev *dev)
+ mt7915_unregister_ext_phy(dev);
+ mt76_unregister_device(&dev->mt76);
+ mt7915_mcu_exit(dev);
+- mt7915_dma_cleanup(dev);
+-
+ mt7915_tx_token_put(dev);
++ mt7915_dma_cleanup(dev);
+
+ mt76_free_device(&dev->mt76);
+ }
+--
+2.30.2
+
--- /dev/null
+From 4a6084ba14dd09e53183fa7831f8a8f73a65a5c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 22:00:36 +0800
+Subject: mt76: mt7915: fix mib stats counter reporting to mac80211
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 2b35050a321865859fd2f12a3c18ed7be27858c9 ]
+
+In order to properly report MIB counters to mac80211, resets stats in
+mt7915_get_stats routine() and hold mt76 mutex accessing MIB counters.
+Sum up MIB counters in mt7915_mac_update_mib_stats routine.
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mac.c | 35 +++++++------------
+ .../net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++
+ .../wireless/mediatek/mt76/mt7915/mt7915.h | 10 +++---
+ 3 files changed, 24 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index b79d614aaad9..555274a2f436 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -1633,39 +1633,30 @@ mt7915_mac_update_mib_stats(struct mt7915_phy *phy)
+ bool ext_phy = phy != &dev->phy;
+ int i, aggr0, aggr1;
+
+- memset(mib, 0, sizeof(*mib));
+-
+- mib->fcs_err_cnt = mt76_get_field(dev, MT_MIB_SDR3(ext_phy),
+- MT_MIB_SDR3_FCS_ERR_MASK);
++ mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(ext_phy),
++ MT_MIB_SDR3_FCS_ERR_MASK);
+
+ aggr0 = ext_phy ? ARRAY_SIZE(dev->mt76.aggr_stats) / 2 : 0;
+ for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
+- u32 val, val2;
++ u32 val;
+
+ val = mt76_rr(dev, MT_MIB_MB_SDR1(ext_phy, i));
+-
+- val2 = FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val);
+- if (val2 > mib->ack_fail_cnt)
+- mib->ack_fail_cnt = val2;
+-
+- val2 = FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val);
+- if (val2 > mib->ba_miss_cnt)
+- mib->ba_miss_cnt = val2;
++ mib->ba_miss_cnt += FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val);
++ mib->ack_fail_cnt +=
++ FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val);
+
+ val = mt76_rr(dev, MT_MIB_MB_SDR0(ext_phy, i));
+- val2 = FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val);
+- if (val2 > mib->rts_retries_cnt) {
+- mib->rts_cnt = FIELD_GET(MT_MIB_RTS_COUNT_MASK, val);
+- mib->rts_retries_cnt = val2;
+- }
++ mib->rts_cnt += FIELD_GET(MT_MIB_RTS_COUNT_MASK, val);
++ mib->rts_retries_cnt +=
++ FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val);
+
+ val = mt76_rr(dev, MT_TX_AGG_CNT(ext_phy, i));
+- val2 = mt76_rr(dev, MT_TX_AGG_CNT2(ext_phy, i));
+-
+ dev->mt76.aggr_stats[aggr0++] += val & 0xffff;
+ dev->mt76.aggr_stats[aggr0++] += val >> 16;
+- dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff;
+- dev->mt76.aggr_stats[aggr1++] += val2 >> 16;
++
++ val = mt76_rr(dev, MT_TX_AGG_CNT2(ext_phy, i));
++ dev->mt76.aggr_stats[aggr1++] += val & 0xffff;
++ dev->mt76.aggr_stats[aggr1++] += val >> 16;
+ }
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index d4969b2e1ffb..8c1bf397fd25 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -717,13 +717,19 @@ mt7915_get_stats(struct ieee80211_hw *hw,
+ struct ieee80211_low_level_stats *stats)
+ {
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mib_stats *mib = &phy->mib;
+
++ mutex_lock(&dev->mt76.mutex);
+ stats->dot11RTSSuccessCount = mib->rts_cnt;
+ stats->dot11RTSFailureCount = mib->rts_retries_cnt;
+ stats->dot11FCSErrorCount = mib->fcs_err_cnt;
+ stats->dot11ACKFailureCount = mib->ack_fail_cnt;
+
++ memset(mib, 0, sizeof(*mib));
++
++ mutex_unlock(&dev->mt76.mutex);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+index 5c7eefdf2013..1160d1bf8a7c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+@@ -108,11 +108,11 @@ struct mt7915_vif {
+ };
+
+ struct mib_stats {
+- u16 ack_fail_cnt;
+- u16 fcs_err_cnt;
+- u16 rts_cnt;
+- u16 rts_retries_cnt;
+- u16 ba_miss_cnt;
++ u32 ack_fail_cnt;
++ u32 fcs_err_cnt;
++ u32 rts_cnt;
++ u32 rts_retries_cnt;
++ u32 ba_miss_cnt;
+ };
+
+ struct mt7915_hif {
+--
+2.30.2
+
--- /dev/null
+From 92e26d8af9c34bbb2eadb43d41daf89e134ddba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:37:59 +0800
+Subject: mt76: mt7915: fix rxrate reporting
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 7883906d22c1e73f1f316bd84fc4a7ff8edd12aa ]
+
+Avoid directly updating sinfo->rxrate from firmware since rate_info might
+be overwritten by wrong results even mt7915_mcu_get_rx_rate() fails check.
+
+Add more error handlings accordingly.
+
+Fixes: 11553d88d0b9 ("mt76: mt7915: query station rx rate from firmware")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/main.c | 5 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 47 ++++++++++---------
+ 2 files changed, 30 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index 8c1bf397fd25..98f4b49642a8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -839,9 +839,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ struct mt7915_sta_stats *stats = &msta->stats;
++ struct rate_info rxrate = {};
+
+- if (mt7915_mcu_get_rx_rate(phy, vif, sta, &sinfo->rxrate) == 0)
++ if (!mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
++ sinfo->rxrate = rxrate;
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
++ }
+
+ if (!stats->tx_rate.legacy && !stats->tx_rate.flags)
+ return;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 195929242b72..ca3e7a9bbcb6 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -3501,9 +3501,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ struct ieee80211_supported_band *sband;
+ struct mt7915_mcu_phy_rx_info *res;
+ struct sk_buff *skb;
+- u16 flags = 0;
+ int ret;
+- int i;
++ bool cck = false;
+
+ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
+ &req, sizeof(req), true, &skb);
+@@ -3517,48 +3516,53 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+
+ switch (res->mode) {
+ case MT_PHY_TYPE_CCK:
++ cck = true;
++ fallthrough;
+ case MT_PHY_TYPE_OFDM:
+ if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
+ sband = &mphy->sband_5g.sband;
+ else
+ sband = &mphy->sband_2g.sband;
+
+- for (i = 0; i < sband->n_bitrates; i++) {
+- if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
+- continue;
+-
+- rate->legacy = sband->bitrates[i].bitrate;
+- break;
+- }
++ rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
++ rate->legacy = sband->bitrates[rate->mcs].bitrate;
+ break;
+ case MT_PHY_TYPE_HT:
+ case MT_PHY_TYPE_HT_GF:
+- if (rate->mcs > 31)
+- return -EINVAL;
+-
+- flags |= RATE_INFO_FLAGS_MCS;
++ if (rate->mcs > 31) {
++ ret = -EINVAL;
++ goto out;
++ }
+
++ rate->flags = RATE_INFO_FLAGS_MCS;
+ if (res->gi)
+- flags |= RATE_INFO_FLAGS_SHORT_GI;
++ rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
+ break;
+ case MT_PHY_TYPE_VHT:
+- flags |= RATE_INFO_FLAGS_VHT_MCS;
++ if (rate->mcs > 9) {
++ ret = -EINVAL;
++ goto out;
++ }
+
++ rate->flags = RATE_INFO_FLAGS_VHT_MCS;
+ if (res->gi)
+- flags |= RATE_INFO_FLAGS_SHORT_GI;
++ rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
+ break;
+ case MT_PHY_TYPE_HE_SU:
+ case MT_PHY_TYPE_HE_EXT_SU:
+ case MT_PHY_TYPE_HE_TB:
+ case MT_PHY_TYPE_HE_MU:
++ if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
++ ret = -EINVAL;
++ goto out;
++ }
+ rate->he_gi = res->gi;
+-
+- flags |= RATE_INFO_FLAGS_HE_MCS;
++ rate->flags = RATE_INFO_FLAGS_HE_MCS;
+ break;
+ default:
+- break;
++ ret = -EINVAL;
++ goto out;
+ }
+- rate->flags = flags;
+
+ switch (res->bw) {
+ case IEEE80211_STA_RX_BW_160:
+@@ -3575,7 +3579,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ break;
+ }
+
++out:
+ dev_kfree_skb(skb);
+
+- return 0;
++ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From f7b049cc3a263282c411b5379fd881c6a158d1e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Feb 2021 18:44:10 +0100
+Subject: mt76: mt7915: fix tx skb dma unmap
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 7dcf3c04f0aca746517a77433b33d40868ca4749 ]
+
+The first pointer in the txp needs to be unmapped as well, otherwise it will
+leak DMA mapping entries
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index e5a258958ac9..b79d614aaad9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -1091,7 +1091,7 @@ void mt7915_txp_skb_unmap(struct mt76_dev *dev,
+ int i;
+
+ txp = mt7915_txwi_to_txp(dev, t);
+- for (i = 1; i < txp->nbuf; i++)
++ for (i = 0; i < txp->nbuf; i++)
+ dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]),
+ le16_to_cpu(txp->len[i]), DMA_TO_DEVICE);
+ }
+--
+2.30.2
+
--- /dev/null
+From 9763e4ca9aeddd00768147ad3abdfaf99045e1b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:38:00 +0800
+Subject: mt76: mt7915: fix txrate reporting
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit f43b941fd61003659a3f0e039595e5e525917aa8 ]
+
+Properly check rate_info to fix unexpected reporting.
+
+[ 1215.161863] Call trace:
+[ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211]
+[ 1215.170139] ieee80211s_update_metric+0x80/0xc0 [mac80211]
+[ 1215.175624] ieee80211_tx_status_ext+0x508/0x838 [mac80211]
+[ 1215.181190] mt7915_mcu_get_rx_rate+0x28c/0x8d0 [mt7915e]
+[ 1215.186580] mt7915_mac_tx_free+0x324/0x7c0 [mt7915e]
+[ 1215.191623] mt7915_queue_rx_skb+0xa8/0xd0 [mt7915e]
+[ 1215.196582] mt76_dma_cleanup+0x7b0/0x11d0 [mt76]
+[ 1215.201276] __napi_poll+0x38/0xf8
+[ 1215.204668] napi_workfn+0x40/0x80
+[ 1215.208062] process_one_work+0x1fc/0x390
+[ 1215.212062] worker_thread+0x48/0x4d0
+[ 1215.215715] kthread+0x120/0x128
+[ 1215.218935] ret_from_fork+0x10/0x1c
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Fixes: e4c5ead632ff ("mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate")
+Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 38 ++++++++++++-------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index ca3e7a9bbcb6..443cb09ae7cb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -351,54 +351,62 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
+ dev->hw_pattern++;
+ }
+
+-static void
++static int
+ mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
+ struct rate_info *rate, u16 r)
+ {
+ struct ieee80211_supported_band *sband;
+ u16 ru_idx = le16_to_cpu(ra->ru_idx);
+- u16 flags = 0;
++ bool cck = false;
+
+ rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
+ rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
+
+ switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
+ case MT_PHY_TYPE_CCK:
++ cck = true;
++ fallthrough;
+ case MT_PHY_TYPE_OFDM:
+ if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
+ sband = &mphy->sband_5g.sband;
+ else
+ sband = &mphy->sband_2g.sband;
+
++ rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);
+ rate->legacy = sband->bitrates[rate->mcs].bitrate;
+ break;
+ case MT_PHY_TYPE_HT:
+ case MT_PHY_TYPE_HT_GF:
+ rate->mcs += (rate->nss - 1) * 8;
+- flags |= RATE_INFO_FLAGS_MCS;
++ if (rate->mcs > 31)
++ return -EINVAL;
+
++ rate->flags = RATE_INFO_FLAGS_MCS;
+ if (ra->gi)
+- flags |= RATE_INFO_FLAGS_SHORT_GI;
++ rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
+ break;
+ case MT_PHY_TYPE_VHT:
+- flags |= RATE_INFO_FLAGS_VHT_MCS;
++ if (rate->mcs > 9)
++ return -EINVAL;
+
++ rate->flags = RATE_INFO_FLAGS_VHT_MCS;
+ if (ra->gi)
+- flags |= RATE_INFO_FLAGS_SHORT_GI;
++ rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
+ break;
+ case MT_PHY_TYPE_HE_SU:
+ case MT_PHY_TYPE_HE_EXT_SU:
+ case MT_PHY_TYPE_HE_TB:
+ case MT_PHY_TYPE_HE_MU:
++ if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)
++ return -EINVAL;
++
+ rate->he_gi = ra->gi;
+ rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
+-
+- flags |= RATE_INFO_FLAGS_HE_MCS;
++ rate->flags = RATE_INFO_FLAGS_HE_MCS;
+ break;
+ default:
+- break;
++ return -EINVAL;
+ }
+- rate->flags = flags;
+
+ if (ru_idx) {
+ switch (ru_idx) {
+@@ -435,6 +443,8 @@ mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
+ break;
+ }
+ }
++
++ return 0;
+ }
+
+ static void
+@@ -465,12 +475,12 @@ mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
+ mphy = dev->mt76.phy2;
+
+ /* current rate */
+- mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
+- stats->tx_rate = rate;
++ if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))
++ stats->tx_rate = rate;
+
+ /* probing rate */
+- mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
+- stats->prob_rate = prob_rate;
++ if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))
++ stats->prob_rate = prob_rate;
+
+ if (attempts) {
+ u16 success = le16_to_cpu(ra->success);
+--
+2.30.2
+
--- /dev/null
+From c69f922fe3dbb6347d2c7e28d0e7613df85fb699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Apr 2021 14:26:39 +0200
+Subject: mt76: mt7921: always wake the device in mt7921_remove_interface
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 859c85fd19715349ce01539459095fd5fc7e483a ]
+
+Make sure the mcu is not in sleep mode before sending mcu messages in
+mt7921_remove_interface routine.
+
+Fixes: 1d8efc741df80 ("mt76: mt7921: introduce Runtime PM support")
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Co-developed-by: Leon Yen <leon.yen@mediatek.com>
+Signed-off-by: Leon Yen <leon.yen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 3566059e5704..166c9c0eb5fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -348,6 +348,7 @@ static void mt7921_remove_interface(struct ieee80211_hw *hw,
+ if (vif == phy->monitor_vif)
+ phy->monitor_vif = NULL;
+
++ mt7921_mutex_acquire(dev);
+ mt76_connac_free_pending_tx_skbs(&dev->pm, &msta->wcid);
+
+ if (dev->pm.enable) {
+@@ -360,7 +361,6 @@ static void mt7921_remove_interface(struct ieee80211_hw *hw,
+
+ rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+
+- mt7921_mutex_acquire(dev);
+ dev->mt76.vif_mask &= ~BIT(mvif->mt76.idx);
+ phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
+ mt7921_mutex_release(dev);
+--
+2.30.2
+
--- /dev/null
+From 3796a2187c0a4951d3d5b1283d012bafb849372e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 02:12:09 +0100
+Subject: mt76: mt7921: fix aggr length histogram
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 461e3b7f45766f38eeb24ca7354ff01d993b5b47 ]
+
+Fix register definitions for 802.11 aggr length histogram estimation.
+
+Fixes: 474a9f21e2e2 ("mt76: mt7921: add debugfs support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c | 5 ++---
+ drivers/net/wireless/mediatek/mt76/mt7921/regs.h | 6 +++---
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+index 0dc8e25e18e4..6aa11ca6fc81 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+@@ -44,14 +44,13 @@ mt7921_ampdu_stat_read_phy(struct mt7921_phy *phy,
+ range[i] = mt76_rr(dev, MT_MIB_ARNG(0, i));
+
+ for (i = 0; i < ARRAY_SIZE(bound); i++)
+- bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i) + 1;
++ bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i % 4) + 1;
+
+ seq_printf(file, "\nPhy0\n");
+
+ seq_printf(file, "Length: %8d | ", bound[0]);
+ for (i = 0; i < ARRAY_SIZE(bound) - 1; i++)
+- seq_printf(file, "%3d -%3d | ",
+- bound[i] + 1, bound[i + 1]);
++ seq_printf(file, "%3d %3d | ", bound[i] + 1, bound[i + 1]);
+
+ seq_puts(file, "\nCount: ");
+ for (i = 0; i < ARRAY_SIZE(bound); i++)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+index 6dad7f6ab09d..11d5aa44ae7b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+@@ -128,9 +128,9 @@
+ #define MT_MIB_MB_SDR2(_band, n) MT_WF_MIB(_band, 0x108 + ((n) << 4))
+ #define MT_MIB_FRAME_RETRIES_COUNT_MASK GENMASK(15, 0)
+
+-#define MT_TX_AGG_CNT(_band, n) MT_WF_MIB(_band, 0x0a8 + ((n) << 2))
+-#define MT_TX_AGG_CNT2(_band, n) MT_WF_MIB(_band, 0x164 + ((n) << 2))
+-#define MT_MIB_ARNG(_band, n) MT_WF_MIB(_band, 0x4b8 + ((n) << 2))
++#define MT_TX_AGG_CNT(_band, n) MT_WF_MIB(_band, 0x7dc + ((n) << 2))
++#define MT_TX_AGG_CNT2(_band, n) MT_WF_MIB(_band, 0x7ec + ((n) << 2))
++#define MT_MIB_ARNG(_band, n) MT_WF_MIB(_band, 0x0b0 + ((n) << 2))
+ #define MT_MIB_ARNCR_RANGE(val, n) (((val) >> ((n) << 3)) & GENMASK(7, 0))
+
+ #define MT_WTBLON_TOP_BASE 0x34000
+--
+2.30.2
+
--- /dev/null
+From b8ba8dcf620c45142af234aef27e5d2fbc7e23f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 11:34:34 +0800
+Subject: mt76: mt7921: fix inappropriate WoW setup with the missing ARP
+ informaiton
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 9c9d83213424679b087267600d53a35acfa0201f ]
+
+Fix the Wake-on-WoWLAN failure should rely on ARP Information is being
+updated in time to the firmware.
+
+Fixes: ffa1bf97425b ("mt76: mt7921: introduce PM support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/main.c | 3 ++
+ .../net/wireless/mediatek/mt76/mt7921/mcu.c | 44 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7921/mt7921.h | 3 ++
+ 3 files changed, 50 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 166c9c0eb5fd..cd9fd0e24e3e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -587,6 +587,9 @@ static void mt7921_bss_info_changed(struct ieee80211_hw *hw,
+ if (changed & BSS_CHANGED_PS)
+ mt7921_mcu_uni_bss_ps(dev, vif);
+
++ if (changed & BSS_CHANGED_ARP_FILTER)
++ mt7921_mcu_update_arp_filter(hw, vif, info);
++
+ mt7921_mutex_release(dev);
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index b5cc72e7e81c..62afbad77596 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -1304,3 +1304,47 @@ mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
+ }
+ }
++
++int mt7921_mcu_update_arp_filter(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_bss_conf *info)
++{
++ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++ struct mt7921_dev *dev = mt7921_hw_dev(hw);
++ struct sk_buff *skb;
++ int i, len = min_t(int, info->arp_addr_cnt,
++ IEEE80211_BSS_ARP_ADDR_LIST_LEN);
++ struct {
++ struct {
++ u8 bss_idx;
++ u8 pad[3];
++ } __packed hdr;
++ struct mt76_connac_arpns_tlv arp;
++ } req_hdr = {
++ .hdr = {
++ .bss_idx = mvif->mt76.idx,
++ },
++ .arp = {
++ .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
++ .len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
++ .ips_num = len,
++ .mode = 2, /* update */
++ .option = 1,
++ },
++ };
++
++ skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
++ sizeof(req_hdr) + len * sizeof(__be32));
++ if (!skb)
++ return -ENOMEM;
++
++ skb_put_data(skb, &req_hdr, sizeof(req_hdr));
++ for (i = 0; i < len; i++) {
++ u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
++
++ memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
++ }
++
++ return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
++ true);
++}
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+index 2979d06ee0ad..25a1a6acb6ba 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+@@ -339,4 +339,7 @@ int mt7921_mac_set_beacon_filter(struct mt7921_phy *phy,
+ bool enable);
+ void mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif);
+ void mt7921_coredump_work(struct work_struct *work);
++int mt7921_mcu_update_arp_filter(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_bss_conf *info);
+ #endif
+--
+2.30.2
+
--- /dev/null
+From 0731640507423166a3a86d4951cbd452a3ecfb4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 11:34:36 +0800
+Subject: mt76: mt7921: fix kernel crash when the firmware fails to download
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit e230f0c44f011f3270680a506b19b7e84c5e8923 ]
+
+Fix kernel crash when the firmware is missing or fails to download.
+
+[ 9.444758] kernel BUG at drivers/pci/msi.c:375!
+[ 9.449363] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+[ 9.501033] pstate: a0400009 (NzCv daif +PAN -UAO)
+[ 9.505814] pc : free_msi_irqs+0x180/0x184
+[ 9.509897] lr : free_msi_irqs+0x40/0x184
+[ 9.513893] sp : ffffffc015193870
+[ 9.517194] x29: ffffffc015193870 x28: 00000000f0e94fa2
+[ 9.522492] x27: 0000000000000acd x26: 000000000000009a
+[ 9.527790] x25: ffffffc0152cee58 x24: ffffffdbb383e0d8
+[ 9.533087] x23: ffffffdbb38628d0 x22: 0000000000040200
+[ 9.538384] x21: ffffff8cf7de7318 x20: ffffff8cd65a2480
+[ 9.543681] x19: ffffff8cf7de7000 x18: 0000000000000000
+[ 9.548979] x17: ffffff8cf9ca03b4 x16: ffffffdc13ad9a34
+[ 9.554277] x15: 0000000000000000 x14: 0000000000080800
+[ 9.559575] x13: ffffff8cd65a2980 x12: 0000000000000000
+[ 9.564873] x11: ffffff8cfa45d820 x10: ffffff8cfa45d6d0
+[ 9.570171] x9 : 0000000000000040 x8 : ffffff8ccef1b780
+[ 9.575469] x7 : aaaaaaaaaaaaaaaa x6 : 0000000000000000
+[ 9.580766] x5 : ffffffdc13824900 x4 : ffffff8ccefe0000
+[ 9.586063] x3 : 0000000000000000 x2 : 0000000000000000
+[ 9.591362] x1 : 0000000000000125 x0 : ffffff8ccefe0000
+[ 9.596660] Call trace:
+[ 9.599095] free_msi_irqs+0x180/0x184
+[ 9.602831] pci_disable_msi+0x100/0x130
+[ 9.606740] pci_free_irq_vectors+0x24/0x30
+[ 9.610915] mt7921_pci_probe+0xbc/0x250 [mt7921e]
+[ 9.615693] pci_device_probe+0xd4/0x14c
+[ 9.619604] really_probe+0x134/0x2ec
+[ 9.623252] driver_probe_device+0x64/0xfc
+[ 9.627335] device_driver_attach+0x4c/0x6c
+[ 9.631506] __driver_attach+0xac/0xc0
+[ 9.635243] bus_for_each_dev+0x8c/0xd4
+[ 9.639066] driver_attach+0x2c/0x38
+[ 9.642628] bus_add_driver+0xfc/0x1d0
+[ 9.646365] driver_register+0x64/0xf8
+[ 9.650101] __pci_register_driver+0x6c/0x7c
+[ 9.654360] init_module+0x28/0xfdc [mt7921e]
+[ 9.658704] do_one_initcall+0x13c/0x2d0
+[ 9.662615] do_init_module+0x58/0x1e8
+[ 9.666351] load_module+0xd80/0xeb4
+[ 9.669912] __arm64_sys_finit_module+0xa8/0xe0
+[ 9.674430] el0_svc_common+0xa4/0x16c
+[ 9.678168] el0_svc_compat_handler+0x2c/0x40
+[ 9.682511] el0_svc_compat+0x8/0x10
+[ 9.686076] Code: a94257f6 f9400bf7 a8c47bfd d65f03c0 (d4210000)
+[ 9.692155] ---[ end trace 7621f966afbf0a29 ]---
+[ 9.697385] Kernel panic - not syncing: Fatal exception
+[ 9.702599] SMP: stopping secondary CPUs
+[ 9.706549] Kernel Offset: 0x1c03600000 from 0xffffffc010000000
+[ 9.712456] PHYS_OFFSET: 0xfffffff440000000
+[ 9.716625] CPU features: 0x080026,2a80aa18
+[ 9.720795] Memory Limit: none
+
+Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support")
+Reported-by: Claire Chang <tientzu@google.com>
+Co-developed-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index 0262bd8b1626..8e756871a056 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -146,10 +146,12 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+
+ ret = mt7921_register_device(dev);
+ if (ret)
+- goto err_free_dev;
++ goto err_free_irq;
+
+ return 0;
+
++err_free_irq:
++ devm_free_irq(&pdev->dev, pdev->irq, dev);
+ err_free_dev:
+ mt76_free_device(&dev->mt76);
+ err_free_pci_vec:
+--
+2.30.2
+
--- /dev/null
+From fff494b9345ff5b73b27ea2e3733eec980afda76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:28:45 +0100
+Subject: mt76: mt7921: fix memory leak in mt7921_coredump_work
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 782b3e86ea970e899f8e723db9f64708a15ca30e ]
+
+Fix possible memory leak in mt7921_coredump_work.
+
+Fixes: 1c099ab44727c ("mt76: mt7921: add MCU support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index 3f9097481a5e..d51ec8a550d8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -1503,8 +1503,10 @@ void mt7921_coredump_work(struct work_struct *work)
+ break;
+
+ skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
+- if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ)
+- break;
++ if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
++ dev_kfree_skb(skb);
++ continue;
++ }
+
+ memcpy(data, skb->data, skb->len);
+ data += skb->len;
+--
+2.30.2
+
--- /dev/null
+From 3867a0dc2fe05c1563acecf1ad4382389a0d5add Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 23:58:05 +0800
+Subject: mt76: mt7921: fix possible invalid register access
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit fe3fccde8870764ba3e60610774bd7bc9f8faeff ]
+
+Disable the interrupt and synchronze for the pending irq handlers to ensure
+the irq tasklet is not being scheduled after the suspend to avoid the
+possible invalid register access acts when the host pcie controller is
+suspended.
+
+[17932.910534] mt7921e 0000:01:00.0: pci_pm_suspend+0x0/0x22c returned 0 after 21375 usecs
+[17932.910590] pcieport 0000:00:00.0: calling pci_pm_suspend+0x0/0x22c @ 18565, parent: pci0000:00
+[17932.910602] pcieport 0000:00:00.0: pci_pm_suspend+0x0/0x22c returned 0 after 8 usecs
+[17932.910671] mtk-pcie 11230000.pcie: calling platform_pm_suspend+0x0/0x60 @ 22783, parent: soc
+[17932.910674] mtk-pcie 11230000.pcie: platform_pm_suspend+0x0/0x60 returned 0 after 0 usecs
+
+...
+
+17933.615352] x1 : 00000000000d4200 x0 : ffffff8269ca2300
+[17933.620666] Call trace:
+[17933.623127] mt76_mmio_rr+0x28/0xf0 [mt76]
+[17933.627234] mt7921_rr+0x38/0x44 [mt7921e]
+[17933.631339] mt7921_irq_tasklet+0x54/0x1d8 [mt7921e]
+[17933.636309] tasklet_action_common+0x12c/0x16c
+[17933.640754] tasklet_action+0x24/0x2c
+[17933.644418] __do_softirq+0x16c/0x344
+[17933.648082] irq_exit+0xa8/0xac
+[17933.651224] scheduler_ipi+0xd4/0x148
+[17933.654890] handle_IPI+0x164/0x2d4
+[17933.658379] gic_handle_irq+0x140/0x178
+[17933.662216] el1_irq+0xb8/0x180
+[17933.665361] cpuidle_enter_state+0xf8/0x204
+[17933.669544] cpuidle_enter+0x38/0x4c
+[17933.673122] do_idle+0x1a4/0x2a8
+[17933.676352] cpu_startup_entry+0x24/0x28
+[17933.680276] rest_init+0xd4/0xe0
+[17933.683508] arch_call_rest_init+0x10/0x18
+[17933.687606] start_kernel+0x340/0x3b4
+[17933.691279] Code: aa0003f5 d503201f f953eaa8 8b344108 (b9400113)
+[17933.697373] ---[ end trace a24b8e26ffbda3c5 ]---
+[17933.767846] Kernel panic - not syncing: Fatal exception in interrupt
+
+Fixes: ffa1bf97425b ("mt76: mt7921: introduce PM support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index 8e756871a056..80f6f29892a4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -195,7 +195,6 @@ static int mt7921_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+ mt76_for_each_q_rx(mdev, i) {
+ napi_disable(&mdev->napi[i]);
+ }
+- tasklet_kill(&dev->irq_tasklet);
+
+ pci_enable_wake(pdev, pci_choose_state(pdev, state), true);
+
+@@ -210,6 +209,9 @@ static int mt7921_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+
+ /* disable interrupt */
+ mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0);
++ mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
++ synchronize_irq(pdev->irq);
++ tasklet_kill(&dev->irq_tasklet);
+
+ err = mt7921_mcu_fw_pmctrl(dev);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From 76c4dc668f8dbd2aecd25ae9dd61dafabab4f762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 19:17:49 +0100
+Subject: mt76: mt7921: fix stats register definitions
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit f76e9019913bffee0e49b096068e6f6b12f9b0e0 ]
+
+Fix register definitions for mac80211 stats reporting.
+Move mib counter reset to mt7921_get_stats routine.
+
+Fixes: 163f4d22c118d ("mt76: mt7921: add MAC support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/mac.c | 31 ++++++-------------
+ .../net/wireless/mediatek/mt76/mt7921/main.c | 6 ++++
+ .../wireless/mediatek/mt76/mt7921/mt7921.h | 10 +++---
+ .../net/wireless/mediatek/mt76/mt7921/regs.h | 15 ++++++---
+ 4 files changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index b4388a290753..a6d2a25b3495 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -1318,31 +1318,20 @@ mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
+ struct mib_stats *mib = &phy->mib;
+ int i, aggr0 = 0, aggr1;
+
+- memset(mib, 0, sizeof(*mib));
+-
+- mib->fcs_err_cnt = mt76_get_field(dev, MT_MIB_SDR3(0),
+- MT_MIB_SDR3_FCS_ERR_MASK);
++ mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
++ MT_MIB_SDR3_FCS_ERR_MASK);
++ mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
++ MT_MIB_ACK_FAIL_COUNT_MASK);
++ mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
++ MT_MIB_BA_FAIL_COUNT_MASK);
++ mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
++ MT_MIB_RTS_COUNT_MASK);
++ mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
++ MT_MIB_RTS_FAIL_COUNT_MASK);
+
+ for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
+ u32 val, val2;
+
+- val = mt76_rr(dev, MT_MIB_MB_SDR1(0, i));
+-
+- val2 = FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val);
+- if (val2 > mib->ack_fail_cnt)
+- mib->ack_fail_cnt = val2;
+-
+- val2 = FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val);
+- if (val2 > mib->ba_miss_cnt)
+- mib->ba_miss_cnt = val2;
+-
+- val = mt76_rr(dev, MT_MIB_MB_SDR0(0, i));
+- val2 = FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val);
+- if (val2 > mib->rts_retries_cnt) {
+- mib->rts_cnt = FIELD_GET(MT_MIB_RTS_COUNT_MASK, val);
+- mib->rts_retries_cnt = val2;
+- }
+-
+ val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
+ val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 729f6c42cdde..3566059e5704 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -814,11 +814,17 @@ mt7921_get_stats(struct ieee80211_hw *hw,
+ struct mt7921_phy *phy = mt7921_hw_phy(hw);
+ struct mib_stats *mib = &phy->mib;
+
++ mt7921_mutex_acquire(phy->dev);
++
+ stats->dot11RTSSuccessCount = mib->rts_cnt;
+ stats->dot11RTSFailureCount = mib->rts_retries_cnt;
+ stats->dot11FCSErrorCount = mib->fcs_err_cnt;
+ stats->dot11ACKFailureCount = mib->ack_fail_cnt;
+
++ memset(mib, 0, sizeof(*mib));
++
++ mt7921_mutex_release(phy->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+index 46e6aeec35ae..2979d06ee0ad 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+@@ -102,11 +102,11 @@ struct mt7921_vif {
+ };
+
+ struct mib_stats {
+- u16 ack_fail_cnt;
+- u16 fcs_err_cnt;
+- u16 rts_cnt;
+- u16 rts_retries_cnt;
+- u16 ba_miss_cnt;
++ u32 ack_fail_cnt;
++ u32 fcs_err_cnt;
++ u32 rts_cnt;
++ u32 rts_retries_cnt;
++ u32 ba_miss_cnt;
+ };
+
+ struct mt7921_phy {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+index 11d5aa44ae7b..2dd2e628b776 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+@@ -96,8 +96,8 @@
+ #define MT_WF_MIB_BASE(_band) ((_band) ? 0xa4800 : 0x24800)
+ #define MT_WF_MIB(_band, ofs) (MT_WF_MIB_BASE(_band) + (ofs))
+
+-#define MT_MIB_SDR3(_band) MT_WF_MIB(_band, 0x014)
+-#define MT_MIB_SDR3_FCS_ERR_MASK GENMASK(15, 0)
++#define MT_MIB_SDR3(_band) MT_WF_MIB(_band, 0x698)
++#define MT_MIB_SDR3_FCS_ERR_MASK GENMASK(31, 16)
+
+ #define MT_MIB_SDR9(_band) MT_WF_MIB(_band, 0x02c)
+ #define MT_MIB_SDR9_BUSY_MASK GENMASK(23, 0)
+@@ -121,9 +121,14 @@
+ #define MT_MIB_RTS_RETRIES_COUNT_MASK GENMASK(31, 16)
+ #define MT_MIB_RTS_COUNT_MASK GENMASK(15, 0)
+
+-#define MT_MIB_MB_SDR1(_band, n) MT_WF_MIB(_band, 0x104 + ((n) << 4))
+-#define MT_MIB_BA_MISS_COUNT_MASK GENMASK(15, 0)
+-#define MT_MIB_ACK_FAIL_COUNT_MASK GENMASK(31, 16)
++#define MT_MIB_MB_BSDR0(_band) MT_WF_MIB(_band, 0x688)
++#define MT_MIB_RTS_COUNT_MASK GENMASK(15, 0)
++#define MT_MIB_MB_BSDR1(_band) MT_WF_MIB(_band, 0x690)
++#define MT_MIB_RTS_FAIL_COUNT_MASK GENMASK(15, 0)
++#define MT_MIB_MB_BSDR2(_band) MT_WF_MIB(_band, 0x518)
++#define MT_MIB_BA_FAIL_COUNT_MASK GENMASK(15, 0)
++#define MT_MIB_MB_BSDR3(_band) MT_WF_MIB(_band, 0x520)
++#define MT_MIB_ACK_FAIL_COUNT_MASK GENMASK(15, 0)
+
+ #define MT_MIB_MB_SDR2(_band, n) MT_WF_MIB(_band, 0x108 + ((n) << 4))
+ #define MT_MIB_FRAME_RETRIES_COUNT_MASK GENMASK(15, 0)
+--
+2.30.2
+
--- /dev/null
+From 2a19cf7096c719c39396c3a76118271738c6f63a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:28:44 +0100
+Subject: mt76: mt7921: fix suspend/resume sequence
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 5e30931494b4940ba74fa5796ca0b6d7e4c84e88 ]
+
+Any pcie access should happen in pci D0 state and we should give ownership
+back to the device at the end of the suspend procedure.
+
+Fixes: 1d8efc741df80 ("mt76: mt7921: introduce Runtime PM support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index 5570b4a50531..c747022f7642 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -209,12 +209,12 @@ static int mt7921_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+ /* disable interrupt */
+ mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0);
+
+- pci_save_state(pdev);
+- err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
++ err = mt7921_mcu_fw_pmctrl(dev);
+ if (err)
+ goto restore;
+
+- err = mt7921_mcu_drv_pmctrl(dev);
++ pci_save_state(pdev);
++ err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
+ if (err)
+ goto restore;
+
+@@ -237,16 +237,16 @@ static int mt7921_pci_resume(struct pci_dev *pdev)
+ struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+ int i, err;
+
+- err = mt7921_mcu_fw_pmctrl(dev);
+- if (err < 0)
+- return err;
+-
+ err = pci_set_power_state(pdev, PCI_D0);
+ if (err)
+ return err;
+
+ pci_restore_state(pdev);
+
++ err = mt7921_mcu_drv_pmctrl(dev);
++ if (err < 0)
++ return err;
++
+ /* enable interrupt */
+ mt7921_l1_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
+ mt7921_irq_enable(dev, MT_INT_RX_DONE_ALL | MT_INT_TX_DONE_ALL |
+--
+2.30.2
+
--- /dev/null
+From 3a1df78f8a0d4ff8293a3ddd0b7247bd4d11a3a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 16:23:26 +0800
+Subject: mt76: mt7921: fix the base of PCIe interrupt
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 23c1d2dc9ed5be1d0df7987335f5646e3826a461 ]
+
+Should use 0x10000 as the base to operate PCIe interrupt according
+to the vendor reference driver.
+
+Fixes: ffa1bf97425b ("mt76: mt7921: introduce PM support")
+Co-developed-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Tested-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 4 ++--
+ drivers/net/wireless/mediatek/mt76/mt7921/regs.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index c747022f7642..0262bd8b1626 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -137,7 +137,7 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+
+ mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0);
+
+- mt7921_l1_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
++ mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
+
+ ret = devm_request_irq(mdev->dev, pdev->irq, mt7921_irq_handler,
+ IRQF_SHARED, KBUILD_MODNAME, dev);
+@@ -248,7 +248,7 @@ static int mt7921_pci_resume(struct pci_dev *pdev)
+ return err;
+
+ /* enable interrupt */
+- mt7921_l1_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
++ mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
+ mt7921_irq_enable(dev, MT_INT_RX_DONE_ALL | MT_INT_TX_DONE_ALL |
+ MT_INT_MCU_CMD);
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+index 2dd2e628b776..e7bb918446ee 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+@@ -389,7 +389,7 @@
+ #define MT_HW_CHIPID 0x70010200
+ #define MT_HW_REV 0x70010204
+
+-#define MT_PCIE_MAC_BASE 0x74030000
++#define MT_PCIE_MAC_BASE 0x10000
+ #define MT_PCIE_MAC(ofs) (MT_PCIE_MAC_BASE + (ofs))
+ #define MT_PCIE_MAC_INT_ENABLE MT_PCIE_MAC(0x188)
+
+--
+2.30.2
+
--- /dev/null
+From 09fa56338426181b3f69b30b6661a57f0c7061fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 16:23:27 +0800
+Subject: mt76: mt7921: fix the base of the dynamic remap
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 53a8fb4afdc877f8f2d5e1e15cc5ad66155987a6 ]
+
+We should change the base for the dynamic remap into another one, because
+the current base (0xe0000) have been the one used to operate the device
+ownership.
+
+Fixes: 163f4d22c118 ("mt76: mt7921: add MAC support")
+Co-developed-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/regs.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+index e7bb918446ee..73878d3e2495 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+@@ -362,11 +362,11 @@
+ #define MT_INFRA_CFG_BASE 0xfe000
+ #define MT_INFRA(ofs) (MT_INFRA_CFG_BASE + (ofs))
+
+-#define MT_HIF_REMAP_L1 MT_INFRA(0x260)
++#define MT_HIF_REMAP_L1 MT_INFRA(0x24c)
+ #define MT_HIF_REMAP_L1_MASK GENMASK(15, 0)
+ #define MT_HIF_REMAP_L1_OFFSET GENMASK(15, 0)
+ #define MT_HIF_REMAP_L1_BASE GENMASK(31, 16)
+-#define MT_HIF_REMAP_BASE_L1 0xe0000
++#define MT_HIF_REMAP_BASE_L1 0x40000
+
+ #define MT_SWDEF_BASE 0x41f200
+ #define MT_SWDEF(ofs) (MT_SWDEF_BASE + (ofs))
+--
+2.30.2
+
--- /dev/null
+From 5d6d0d08174dc8db4ee9c315aff4438f55ddd70d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 11:34:35 +0800
+Subject: mt76: mt7921: fix the dwell time control
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 9db419f0cb39a63fb2f645a846cae17b81cd5c96 ]
+
+dwell time for the scan is not configurable according to the current
+firmware submitted into linux-firmware.git, so leave the dwell time 0 to
+indicate the dwell time always determined by the firmware.
+
+Fixes: 399090ef9605 ("mt76: mt76_connac: move hw_scan and sched_scan routine in mt76_connac_mcu module")
+Suggested-by: Soul Huang <Soul.Huang@mediatek.com>
+Co-developed-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: YN Chen <YN.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 8e9e42b77692..76a61e8b7fb9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -1309,7 +1309,7 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ {
+ struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+ struct cfg80211_scan_request *sreq = &scan_req->req;
+- int n_ssids = 0, err, i, duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
++ int n_ssids = 0, err, i, duration;
+ int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
+ struct ieee80211_channel **scan_list = sreq->channels;
+ struct mt76_dev *mdev = phy->dev;
+@@ -1346,6 +1346,7 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ req->ssid_type_ext = n_ssids ? BIT(0) : 0;
+ req->ssids_num = n_ssids;
+
++ duration = is_mt7921(phy->dev) ? 0 : MT76_CONNAC_SCAN_CHANNEL_TIME;
+ /* increase channel time for passive scan */
+ if (!sreq->n_ssids)
+ duration *= 2;
+--
+2.30.2
+
--- /dev/null
+From 6976e5fa4e319b7c3219d4f0495b5e8c3fbaf9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:28:48 +0100
+Subject: mt76: mt7921: fixup rx bitrate statistics
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 0940605a2a70803fc3362eeccba4c31adf4e70e7 ]
+
+Since the related rx bitrate fields have been moved to group3 in Rxv,
+fix rx bitrate statistics in mt7921_mac_fill_rx routine.
+
+Fixes: 163f4d22c118d ("mt76: mt7921: add MAC support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/mac.c | 155 +++++++++---------
+ .../net/wireless/mediatek/mt76/mt7921/mac.h | 10 +-
+ 2 files changed, 86 insertions(+), 79 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index d51ec8a550d8..b4388a290753 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -400,7 +400,9 @@ int mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
+
+ /* RXD Group 3 - P-RXV */
+ if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
+- u32 v0, v1, v2;
++ u8 stbc, gi;
++ u32 v0, v1;
++ bool cck;
+
+ rxv = rxd;
+ rxd += 2;
+@@ -409,7 +411,6 @@ int mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
+
+ v0 = le32_to_cpu(rxv[0]);
+ v1 = le32_to_cpu(rxv[1]);
+- v2 = le32_to_cpu(rxv[2]);
+
+ if (v0 & MT_PRXV_HT_AD_CODE)
+ status->enc_flags |= RX_ENC_FLAG_LDPC;
+@@ -429,87 +430,87 @@ int mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
+ status->chain_signal[i]);
+ }
+
+- /* RXD Group 5 - C-RXV */
+- if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
+- u8 stbc = FIELD_GET(MT_CRXV_HT_STBC, v2);
+- u8 gi = FIELD_GET(MT_CRXV_HT_SHORT_GI, v2);
+- bool cck = false;
++ stbc = FIELD_GET(MT_PRXV_STBC, v0);
++ gi = FIELD_GET(MT_PRXV_SGI, v0);
++ cck = false;
+
+- rxd += 18;
+- if ((u8 *)rxd - skb->data >= skb->len)
+- return -EINVAL;
++ idx = i = FIELD_GET(MT_PRXV_TX_RATE, v0);
++ mode = FIELD_GET(MT_PRXV_TX_MODE, v0);
+
+- idx = i = FIELD_GET(MT_PRXV_TX_RATE, v0);
+- mode = FIELD_GET(MT_CRXV_TX_MODE, v2);
+-
+- switch (mode) {
+- case MT_PHY_TYPE_CCK:
+- cck = true;
+- fallthrough;
+- case MT_PHY_TYPE_OFDM:
+- i = mt76_get_rate(&dev->mt76, sband, i, cck);
+- break;
+- case MT_PHY_TYPE_HT_GF:
+- case MT_PHY_TYPE_HT:
+- status->encoding = RX_ENC_HT;
+- if (i > 31)
+- return -EINVAL;
+- break;
+- case MT_PHY_TYPE_VHT:
+- status->nss =
+- FIELD_GET(MT_PRXV_NSTS, v0) + 1;
+- status->encoding = RX_ENC_VHT;
+- if (i > 9)
+- return -EINVAL;
+- break;
+- case MT_PHY_TYPE_HE_MU:
+- status->flag |= RX_FLAG_RADIOTAP_HE_MU;
+- fallthrough;
+- case MT_PHY_TYPE_HE_SU:
+- case MT_PHY_TYPE_HE_EXT_SU:
+- case MT_PHY_TYPE_HE_TB:
+- status->nss =
+- FIELD_GET(MT_PRXV_NSTS, v0) + 1;
+- status->encoding = RX_ENC_HE;
+- status->flag |= RX_FLAG_RADIOTAP_HE;
+- i &= GENMASK(3, 0);
+-
+- if (gi <= NL80211_RATE_INFO_HE_GI_3_2)
+- status->he_gi = gi;
+-
+- status->he_dcm = !!(idx & MT_PRXV_TX_DCM);
+- break;
+- default:
++ switch (mode) {
++ case MT_PHY_TYPE_CCK:
++ cck = true;
++ fallthrough;
++ case MT_PHY_TYPE_OFDM:
++ i = mt76_get_rate(&dev->mt76, sband, i, cck);
++ break;
++ case MT_PHY_TYPE_HT_GF:
++ case MT_PHY_TYPE_HT:
++ status->encoding = RX_ENC_HT;
++ if (i > 31)
+ return -EINVAL;
+- }
+- status->rate_idx = i;
+-
+- switch (FIELD_GET(MT_CRXV_FRAME_MODE, v2)) {
+- case IEEE80211_STA_RX_BW_20:
+- break;
+- case IEEE80211_STA_RX_BW_40:
+- if (mode & MT_PHY_TYPE_HE_EXT_SU &&
+- (idx & MT_PRXV_TX_ER_SU_106T)) {
+- status->bw = RATE_INFO_BW_HE_RU;
+- status->he_ru =
+- NL80211_RATE_INFO_HE_RU_ALLOC_106;
+- } else {
+- status->bw = RATE_INFO_BW_40;
+- }
+- break;
+- case IEEE80211_STA_RX_BW_80:
+- status->bw = RATE_INFO_BW_80;
+- break;
+- case IEEE80211_STA_RX_BW_160:
+- status->bw = RATE_INFO_BW_160;
+- break;
+- default:
++ break;
++ case MT_PHY_TYPE_VHT:
++ status->nss =
++ FIELD_GET(MT_PRXV_NSTS, v0) + 1;
++ status->encoding = RX_ENC_VHT;
++ if (i > 9)
+ return -EINVAL;
++ break;
++ case MT_PHY_TYPE_HE_MU:
++ status->flag |= RX_FLAG_RADIOTAP_HE_MU;
++ fallthrough;
++ case MT_PHY_TYPE_HE_SU:
++ case MT_PHY_TYPE_HE_EXT_SU:
++ case MT_PHY_TYPE_HE_TB:
++ status->nss =
++ FIELD_GET(MT_PRXV_NSTS, v0) + 1;
++ status->encoding = RX_ENC_HE;
++ status->flag |= RX_FLAG_RADIOTAP_HE;
++ i &= GENMASK(3, 0);
++
++ if (gi <= NL80211_RATE_INFO_HE_GI_3_2)
++ status->he_gi = gi;
++
++ status->he_dcm = !!(idx & MT_PRXV_TX_DCM);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ status->rate_idx = i;
++
++ switch (FIELD_GET(MT_PRXV_FRAME_MODE, v0)) {
++ case IEEE80211_STA_RX_BW_20:
++ break;
++ case IEEE80211_STA_RX_BW_40:
++ if (mode & MT_PHY_TYPE_HE_EXT_SU &&
++ (idx & MT_PRXV_TX_ER_SU_106T)) {
++ status->bw = RATE_INFO_BW_HE_RU;
++ status->he_ru =
++ NL80211_RATE_INFO_HE_RU_ALLOC_106;
++ } else {
++ status->bw = RATE_INFO_BW_40;
+ }
++ break;
++ case IEEE80211_STA_RX_BW_80:
++ status->bw = RATE_INFO_BW_80;
++ break;
++ case IEEE80211_STA_RX_BW_160:
++ status->bw = RATE_INFO_BW_160;
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ status->enc_flags |= RX_ENC_FLAG_STBC_MASK * stbc;
++ if (mode < MT_PHY_TYPE_HE_SU && gi)
++ status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
+
+- status->enc_flags |= RX_ENC_FLAG_STBC_MASK * stbc;
+- if (mode < MT_PHY_TYPE_HE_SU && gi)
+- status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
++ if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
++ rxd += 18;
++ if ((u8 *)rxd - skb->data >= skb->len)
++ return -EINVAL;
+ }
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.h b/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
+index a0c1fa0f20e4..109c8849d106 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
+@@ -97,18 +97,24 @@ enum rx_pkt_type {
+ #define MT_RXD3_NORMAL_PF_MODE BIT(29)
+ #define MT_RXD3_NORMAL_PF_STS GENMASK(31, 30)
+
+-/* P-RXV */
++/* P-RXV DW0 */
+ #define MT_PRXV_TX_RATE GENMASK(6, 0)
+ #define MT_PRXV_TX_DCM BIT(4)
+ #define MT_PRXV_TX_ER_SU_106T BIT(5)
+ #define MT_PRXV_NSTS GENMASK(9, 7)
+ #define MT_PRXV_HT_AD_CODE BIT(11)
++#define MT_PRXV_FRAME_MODE GENMASK(14, 12)
++#define MT_PRXV_SGI GENMASK(16, 15)
++#define MT_PRXV_STBC GENMASK(23, 22)
++#define MT_PRXV_TX_MODE GENMASK(27, 24)
+ #define MT_PRXV_HE_RU_ALLOC_L GENMASK(31, 28)
+-#define MT_PRXV_HE_RU_ALLOC_H GENMASK(3, 0)
++
++/* P-RXV DW1 */
+ #define MT_PRXV_RCPI3 GENMASK(31, 24)
+ #define MT_PRXV_RCPI2 GENMASK(23, 16)
+ #define MT_PRXV_RCPI1 GENMASK(15, 8)
+ #define MT_PRXV_RCPI0 GENMASK(7, 0)
++#define MT_PRXV_HE_RU_ALLOC_H GENMASK(3, 0)
+
+ /* C-RXV */
+ #define MT_CRXV_HT_STBC GENMASK(1, 0)
+--
+2.30.2
+
--- /dev/null
+From ca24bae99b70a46bb3419f90c7f6d64b4f3bd834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 00:21:54 +0200
+Subject: mt76: mt7921: run mt7921_mcu_fw_log_2_host holding mt76 mutex
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 987c8fb4de437344f19a23d074c06faf67520a11 ]
+
+Wake the chip before configuring the mcu log level
+
+Fixes: 1d8efc741df8 ("mt76: mt7921: introduce Runtime PM support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+index 6aa11ca6fc81..87a7ea12f3b3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+@@ -9,10 +9,13 @@ mt7921_fw_debug_set(void *data, u64 val)
+ {
+ struct mt7921_dev *dev = data;
+
+- dev->fw_debug = (u8)val;
++ mt7921_mutex_acquire(dev);
+
++ dev->fw_debug = (u8)val;
+ mt7921_mcu_fw_log_2_host(dev, dev->fw_debug);
+
++ mt7921_mutex_release(dev);
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From fa8192c22556f09e648f638ccad4436b3b264050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 18:32:41 +0000
+Subject: mt7601u: fix always true expression
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ]
+
+Currently the expression ~nic_conf1 is always true because nic_conf1
+is a u16 and according to 6.5.3.3 of the C standard the ~ operator
+promotes the u16 to an integer before flipping all the bits. Thus
+the top 16 bits of the integer result are all set so the expression
+is always true. If the intention was to flip all the bits of nic_conf1
+then casting the integer result back to a u16 is a suitabel fix.
+
+Interestingly static analyzers seem to thing a bitwise ! should be
+used instead of ~ for this scenario, so I think the original intent
+of the expression may need some extra consideration.
+
+Addresses-Coverity: ("Logical vs. bitwise operator")
+Fixes: c869f77d6abb ("add mt7601u driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Jakub Kicinski <kubakici@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+index c868582c5d22..aa3b64902cf9 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+@@ -99,7 +99,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom)
+ {
+ u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1);
+
+- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
+ }
+
+ static void
+--
+2.30.2
+
--- /dev/null
+From 61a5ff71340257bb076b0a727b680d8c957f0c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 20:53:20 +0100
+Subject: mtd: don't lock when recursively deleting partitions
+
+From: David Bauer <mail@david-bauer.net>
+
+[ Upstream commit cb4543054c5c4fd33df960b41d7b483ebca8e786 ]
+
+When recursively deleting partitions, don't acquire the masters
+partition lock twice. Otherwise the process ends up in a deadlocked
+state.
+
+Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210217195320.893253-1-mail@david-bauer.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 12ca4f19cb14..665fd9020b76 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -331,7 +331,7 @@ static int __del_mtd_partitions(struct mtd_info *mtd)
+
+ list_for_each_entry_safe(child, next, &mtd->partitions, part.node) {
+ if (mtd_has_partitions(child))
+- del_mtd_partitions(child);
++ __del_mtd_partitions(child);
+
+ pr_info("Deleting %s MTD partition\n", child->name);
+ ret = del_mtd_device(child);
+--
+2.30.2
+
--- /dev/null
+From 0104e328cf9f86b18f9f0fabfb5526537f6eafaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 18:57:56 +0530
+Subject: mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 08608adb520e51403be7592c2214846fa440a23a ]
+
+There are chances that the parse_mtd_partitions() function will return
+-EPROBE_DEFER in mtd_device_parse_register(). This might happen when
+the dependency is not available for the parser. For instance, on SDX55
+the MTD_QCOMSMEM_PARTS parser depends on the QCOM_SMEM driver to parse
+the partitions defined in the shared memory region. With the current
+flow, the error returned from parse_mtd_partitions() will be discarded
+in favor of trying to add the fallback partition.
+
+This will prevent the driver to end up in probe deferred pool and the
+partitions won't be parsed even after the QCOM_SMEM driver is available.
+
+Fix this issue by bailing out of mtd_device_parse_register() when
+-EPROBE_DEFER error is returned from parse_mtd_partitions() function and
+propagate the error code to the driver core for probing later.
+
+Fixes: 5ac67ce36cfe ("mtd: move code adding (registering) partitions to the parse_mtd_partitions()")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
+index 2d6423d89a17..d97ddc65b5d4 100644
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -820,6 +820,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types,
+
+ /* Prefer parsed partitions over driver-provided fallback */
+ ret = parse_mtd_partitions(mtd, types, parser_data);
++ if (ret == -EPROBE_DEFER)
++ goto out;
++
+ if (ret > 0)
+ ret = 0;
+ else if (nr_parts)
+--
+2.30.2
+
--- /dev/null
+From a006605d67af01227043f295021c9c500853f822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 19:44:46 -0800
+Subject: mtd: maps: fix error return code of physmap_flash_remove()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 620b90d30c08684dc6ebee07c72755d997f9d1f6 ]
+
+When platform_get_drvdata() returns NULL to info, no error return code
+of physmap_flash_remove() is assigned.
+To fix this bug, err is assigned with -EINVAL in this case
+
+Fixes: 73566edf9b91 ("[MTD] Convert physmap to platform driver")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210308034446.3052-1-baijiaju1990@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/maps/physmap-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c
+index 001ed5deb622..4f63b8430c71 100644
+--- a/drivers/mtd/maps/physmap-core.c
++++ b/drivers/mtd/maps/physmap-core.c
+@@ -69,8 +69,10 @@ static int physmap_flash_remove(struct platform_device *dev)
+ int i, err = 0;
+
+ info = platform_get_drvdata(dev);
+- if (!info)
++ if (!info) {
++ err = -EINVAL;
+ goto out;
++ }
+
+ if (info->cmtd) {
+ err = mtd_device_unregister(info->cmtd);
+--
+2.30.2
+
--- /dev/null
+From 366b1f04b3f73768f463943d2face37654a5f743 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 09:46:34 +0100
+Subject: mtd: parsers: qcom: Fix error condition
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit c95310e1b33eae9767af9698aa976d5301f37203 ]
+
+qcom_smem_get() does not return NULL, and even if it did, the NULL
+condition is usually not an error but a success condition and should
+not trigger an error trace.
+
+Let's replace IS_ERR_OR_NULL() by IS_ERR().
+
+This fixes the following smatch warning:
+drivers/mtd/parsers/qcomsmempart.c:109 parse_qcomsmem_part() warn: passing zero to 'PTR_ERR'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210303084634.12796-1-miquel.raynal@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/qcomsmempart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
+index 808cb33d71f8..1c8a44d0d6e4 100644
+--- a/drivers/mtd/parsers/qcomsmempart.c
++++ b/drivers/mtd/parsers/qcomsmempart.c
+@@ -104,7 +104,7 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
+ * complete partition table
+ */
+ ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
+- if (IS_ERR_OR_NULL(ptable)) {
++ if (IS_ERR(ptable)) {
+ pr_err("Error reading partition table\n");
+ return PTR_ERR(ptable);
+ }
+--
+2.30.2
+
--- /dev/null
+From 805cd01b8fb552ea50224dddb7e464d33f248a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:48:16 +0200
+Subject: mtd: parsers: qcom: incompatible with spi-nor 4k sectors
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 8f62f59f83c3bc902af91c80732cfcd17e0d7069 ]
+
+Partition size and offset value are in block size units, which is the
+same as 'erasesize'. But when 4K sectors are enabled erasesize is set to
+4K. Bail out in that case.
+
+Fixes: 803eb124e1a64 ("mtd: parsers: Add Qcom SMEM parser")
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/0a2611f885b894274436ded3ca78bc0440fca74a.1614790096.git.baruch@tkos.co.il
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/qcomsmempart.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
+index 1c8a44d0d6e4..d9083308f6ba 100644
+--- a/drivers/mtd/parsers/qcomsmempart.c
++++ b/drivers/mtd/parsers/qcomsmempart.c
+@@ -65,6 +65,13 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
+ int ret, i, numparts;
+ char *name, *c;
+
++ if (IS_ENABLED(CONFIG_MTD_SPI_NOR_USE_4K_SECTORS)
++ && mtd->type == MTD_NORFLASH) {
++ pr_err("%s: SMEM partition parser is incompatible with 4K sectors\n",
++ mtd->name);
++ return -EINVAL;
++ }
++
+ pr_debug("Parsing partition table info from SMEM\n");
+ ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
+ if (IS_ERR(ptable)) {
+--
+2.30.2
+
--- /dev/null
+From cf657c85020faa8dcdd12e18c2869f48c7a67e27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 09:02:10 +0100
+Subject: mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit f5200c14242fb8fa4a9b93f7fd4064d237e58785 ]
+
+Hamming ECC doesn't cover the OOB data, so reading or writing OOB shall
+always be done without ECC enabled.
+This is a problem when adding JFFS2 cleanmarkers to erased blocks. If JFFS2
+clenmarkers are added to the OOB with ECC enabled, OOB bytes will be changed
+from ff ff ff to 00 00 00, reporting incorrect ECC errors.
+
+Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210224080210.23686-1-noltari@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 659eaa6f0980..5ff4291380c5 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2688,6 +2688,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip)
+
+ ret = brcmstb_choose_ecc_layout(host);
+
++ /* If OOB is written with ECC enabled it will cause ECC errors */
++ if (is_hamming_ecc(host->ctrl, &host->hwcfg)) {
++ chip->ecc.write_oob = brcmnand_write_oob_raw;
++ chip->ecc.read_oob = brcmnand_read_oob_raw;
++ }
++
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 6610e41a6d01f3cb57f15304f3bfab562ec76c14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 18:58:49 +0300
+Subject: mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e7a97528e3c787802d8c643d6ab2f428511bb047 ]
+
+If dma_request_channel() fails then the probe fails and it should
+return a negative error code, but currently it returns success.
+
+fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/YCqaOZ83OvPOzLwh@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsmc_nand.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
+index 0101c0fab50a..a24e2f57fa68 100644
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -1077,11 +1077,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
+ host->read_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->read_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get read dma channel\n");
++ ret = -ENODEV;
+ goto disable_clk;
+ }
+ host->write_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->write_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get write dma channel\n");
++ ret = -ENODEV;
+ goto release_dma_read_chan;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From ac39d14796ca7c2e23254e94e2a3f07141cee4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 23:09:05 -0700
+Subject: mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ]
+
+If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
+this->raw_buffer, gpmi_free_dma_buffer() will be called to free
+this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
+and valid ptr.
+
+Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
+is called again to free this->auxiliary_virt in err_out. This causes
+a double free.
+
+As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
+error path, so it should return err directly instead of releasing the dma
+buffer again.
+
+Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index 3fa8c22d3f36..4d08e4ab5c1b 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -2449,7 +2449,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
+ this->bch_geometry.auxiliary_size = 128;
+ ret = gpmi_alloc_dma_buffer(this);
+ if (ret)
+- goto err_out;
++ return ret;
+
+ nand_controller_init(&this->base);
+ this->base.ops = &gpmi_nand_controller_ops;
+--
+2.30.2
+
--- /dev/null
+From 446e468c2a0d4401773e22213f2e08ca22c1def7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 18:57:57 +0530
+Subject: mtd: rawnand: qcom: Return actual error code instead of -ENODEV
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 55fbb9ba4f06cb6aff32daca1e1910173c13ec51 ]
+
+In qcom_probe_nand_devices() function, the error code returned by
+qcom_nand_host_init_and_register() is converted to -ENODEV in the case
+of failure. This poses issue if -EPROBE_DEFER is returned when the
+dependency is not available for a component like parser.
+
+So let's restructure the error handling logic a bit and return the
+actual error code in case of qcom_nand_host_init_and_register() failure.
+
+Fixes: c76b78d8ec05 ("mtd: nand: Qualcomm NAND controller driver")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index fd4c318b520f..87c23bb320bf 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2898,7 +2898,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ struct device *dev = nandc->dev;
+ struct device_node *dn = dev->of_node, *child;
+ struct qcom_nand_host *host;
+- int ret;
++ int ret = -ENODEV;
+
+ for_each_available_child_of_node(dn, child) {
+ host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+@@ -2916,10 +2916,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ list_add_tail(&host->node, &nandc->host_list);
+ }
+
+- if (list_empty(&nandc->host_list))
+- return -ENODEV;
+-
+- return 0;
++ return ret;
+ }
+
+ /* parse custom DT properties here */
+--
+2.30.2
+
--- /dev/null
+From 4380eba3cf1abb3a0abbe8b1ffc6f051381454eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 16:57:35 +0100
+Subject: mtd: require write permissions for locking and badblock ioctls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ]
+
+MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require
+write permission. Depending on the hardware MEMLOCK might even be
+write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK
+is always write-once.
+
+MEMSETBADBLOCK modifies the bad block table.
+
+Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdchar.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 323035d4f2d0..688de663cabf 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -651,16 +651,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ case MEMGETINFO:
+ case MEMREADOOB:
+ case MEMREADOOB64:
+- case MEMLOCK:
+- case MEMUNLOCK:
+ case MEMISLOCKED:
+ case MEMGETOOBSEL:
+ case MEMGETBADBLOCK:
+- case MEMSETBADBLOCK:
+ case OTPSELECT:
+ case OTPGETREGIONCOUNT:
+ case OTPGETREGIONINFO:
+- case OTPLOCK:
+ case ECCGETLAYOUT:
+ case ECCGETSTATS:
+ case MTDFILEMODE:
+@@ -671,9 +667,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ /* "dangerous" commands */
+ case MEMERASE:
+ case MEMERASE64:
++ case MEMLOCK:
++ case MEMUNLOCK:
++ case MEMSETBADBLOCK:
+ case MEMWRITEOOB:
+ case MEMWRITEOOB64:
+ case MEMWRITE:
++ case OTPLOCK:
+ if (!(file->f_mode & FMODE_WRITE))
+ return -EPERM;
+ break;
+--
+2.30.2
+
--- /dev/null
+From c74e1a306d92748f153d23ce992454d207956507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 11:26:27 -0700
+Subject: mwl8k: Fix a double Free in mwl8k_probe_hw
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]
+
+In mwl8k_probe_hw, hw->priv->txq is freed at the first time by
+dma_free_coherent() in the call chain:
+if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).
+
+Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed
+at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().
+
+My patch set txq->txd to NULL after the first free to avoid the
+double free.
+
+Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwl8k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index c9f8c056aa51..84b32a5f01ee 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -1473,6 +1473,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
+ if (txq->skb == NULL) {
+ dma_free_coherent(&priv->pdev->dev, size, txq->txd,
+ txq->txd_dma);
++ txq->txd = NULL;
+ return -ENOMEM;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f03db76c253399a8cd846d19cfa3694c6a89f505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Apr 2021 17:27:35 +0200
+Subject: net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Lüssing <linus.luessing@c0d3.blue>
+
+[ Upstream commit 99014088156cd78867d19514a0bc771c4b86b93b ]
+
+The IPv6 Multicast Router Advertisements parsing has the following two
+issues:
+
+For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD
+messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes,
+assuming MLDv2 Reports with at least one multicast address entry).
+When ipv6_mc_check_mld_msg() tries to parse an Multicast Router
+Advertisement its MLD length check will fail - and it will wrongly
+return -EINVAL, even if we have a valid MRD Advertisement. With the
+returned -EINVAL the bridge code will assume a broken packet and will
+wrongly discard it, potentially leading to multicast packet loss towards
+multicast routers.
+
+The second issue is the MRD header parsing in
+br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header
+immediately after the IPv6 header (IPv6 next header type). However
+according to RFC4286, section 2 all MRD messages contain a Router Alert
+option (just like MLD). So instead there is an IPv6 Hop-by-Hop option
+for the Router Alert between the IPv6 and ICMPv6 header, again leading
+to the bridge wrongly discarding Multicast Router Advertisements.
+
+To fix these two issues, introduce a new return value -ENODATA to
+ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop
+option which is not an MLD but potentially an MRD packet. This also
+simplifies further parsing in the bridge code, as ipv6_mc_check_mld()
+already fully checks the ICMPv6 header and hop-by-hop option.
+
+These issues were found and fixed with the help of the mrdisc tool
+(https://github.com/troglobit/mrdisc).
+
+Fixes: 4b3087c7e37f ("bridge: Snoop Multicast Router Advertisements")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/addrconf.h | 1 -
+ net/bridge/br_multicast.c | 33 ++++++++-------------------------
+ net/ipv6/mcast_snoop.c | 12 +++++++-----
+ 3 files changed, 15 insertions(+), 31 deletions(-)
+
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index 18f783dcd55f..78ea3e332688 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -233,7 +233,6 @@ void ipv6_mc_unmap(struct inet6_dev *idev);
+ void ipv6_mc_remap(struct inet6_dev *idev);
+ void ipv6_mc_init_dev(struct inet6_dev *idev);
+ void ipv6_mc_destroy_dev(struct inet6_dev *idev);
+-int ipv6_mc_check_icmpv6(struct sk_buff *skb);
+ int ipv6_mc_check_mld(struct sk_buff *skb);
+ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp);
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 9d265447d654..229309d7b4ff 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -3152,25 +3152,14 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
+ }
+
+ #if IS_ENABLED(CONFIG_IPV6)
+-static int br_ip6_multicast_mrd_rcv(struct net_bridge *br,
+- struct net_bridge_port *port,
+- struct sk_buff *skb)
++static void br_ip6_multicast_mrd_rcv(struct net_bridge *br,
++ struct net_bridge_port *port,
++ struct sk_buff *skb)
+ {
+- int ret;
+-
+- if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
+- return -ENOMSG;
+-
+- ret = ipv6_mc_check_icmpv6(skb);
+- if (ret < 0)
+- return ret;
+-
+ if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
+- return -ENOMSG;
++ return;
+
+ br_multicast_mark_router(br, port);
+-
+- return 0;
+ }
+
+ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -3184,18 +3173,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+
+ err = ipv6_mc_check_mld(skb);
+
+- if (err == -ENOMSG) {
++ if (err == -ENOMSG || err == -ENODATA) {
+ if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
+ BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
+-
+- if (ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) {
+- err = br_ip6_multicast_mrd_rcv(br, port, skb);
+-
+- if (err < 0 && err != -ENOMSG) {
+- br_multicast_err_count(br, port, skb->protocol);
+- return err;
+- }
+- }
++ if (err == -ENODATA &&
++ ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
++ br_ip6_multicast_mrd_rcv(br, port, skb);
+
+ return 0;
+ } else if (err < 0) {
+diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c
+index d3d6b6a66e5f..04d5fcdfa6e0 100644
+--- a/net/ipv6/mcast_snoop.c
++++ b/net/ipv6/mcast_snoop.c
+@@ -109,7 +109,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
+ struct mld_msg *mld;
+
+ if (!ipv6_mc_may_pull(skb, len))
+- return -EINVAL;
++ return -ENODATA;
+
+ mld = (struct mld_msg *)skb_transport_header(skb);
+
+@@ -122,7 +122,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
+ case ICMPV6_MGM_QUERY:
+ return ipv6_mc_check_mld_query(skb);
+ default:
+- return -ENOMSG;
++ return -ENODATA;
+ }
+ }
+
+@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
+ return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
+ }
+
+-int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+ {
+ unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
+ unsigned int transport_len = ipv6_transport_len(skb);
+@@ -150,7 +150,6 @@ int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+
+ return 0;
+ }
+-EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
+
+ /**
+ * ipv6_mc_check_mld - checks whether this is a sane MLD packet
+@@ -161,7 +160,10 @@ EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
+ *
+ * -EINVAL: A broken packet was detected, i.e. it violates some internet
+ * standard
+- * -ENOMSG: IP header validation succeeded but it is not an MLD packet.
++ * -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet
++ * with a hop-by-hop option.
++ * -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded
++ * but it is not an MLD packet.
+ * -ENOMEM: A memory allocation failure happened.
+ *
+ * Caller needs to set the skb network header and free any returned skb if it
+--
+2.30.2
+
--- /dev/null
+From 313c6dfeb31031238784ce11ad1d9d8605fdb8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 18:16:14 +0100
+Subject: net: davinci_emac: Fix incorrect masking of tx and rx error channel
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]
+
+The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels)
+are incorrect and always lead to a zero result. The mask values are
+currently the incorrect post-right shifted values, fix this by setting
+them to the currect values.
+
+(I double checked these against the TMS320TCI6482 data sheet, section
+5.30, page 127 to ensure I had the correct mask values for the TXERRCH
+and RXERRCH fields in the MACSTATUS register).
+
+Addresses-Coverity: ("Operands don't affect result")
+Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index c7031e1960d4..03055c96f076 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -169,11 +169,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";
+ /* EMAC mac_status register */
+ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)
+ #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20)
+-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)
+ #define EMAC_MACSTATUS_TXERRCH_SHIFT (16)
+ #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)
+ #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12)
+-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)
+ #define EMAC_MACSTATUS_RXERRCH_SHIFT (8)
+
+ /* EMAC RX register masks */
+--
+2.30.2
+
--- /dev/null
+From 1b7a51a335c1b53e734c285af402d4274ac2b65f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 09:01:42 +0100
+Subject: net: dsa: bcm_sf2: add function finding RGMII register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 55cfeb396965c3906a84d09a9c487d065e37773b ]
+
+Simple macro like REG_RGMII_CNTRL_P() is insufficient as:
+1. It doesn't validate port argument
+2. It doesn't support chipsets with non-lineral RGMII regs layout
+
+Missing port validation could result in getting register offset from out
+of array. Random memory -> random offset -> random reads/writes. It
+affected e.g. BCM4908 for REG_RGMII_CNTRL_P(7).
+
+Fixes: a78e86ed586d ("net: dsa: bcm_sf2: Prepare for different register layouts")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 49 +++++++++++++++++++++++++++++-----
+ drivers/net/dsa/bcm_sf2_regs.h | 2 --
+ 2 files changed, 42 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index ba5d546d06aa..cd64b7f471b5 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -32,6 +32,31 @@
+ #include "b53/b53_priv.h"
+ #include "b53/b53_regs.h"
+
++static u16 bcm_sf2_reg_rgmii_cntrl(struct bcm_sf2_priv *priv, int port)
++{
++ switch (priv->type) {
++ case BCM4908_DEVICE_ID:
++ /* TODO */
++ break;
++ default:
++ switch (port) {
++ case 0:
++ return REG_RGMII_0_CNTRL;
++ case 1:
++ return REG_RGMII_1_CNTRL;
++ case 2:
++ return REG_RGMII_2_CNTRL;
++ default:
++ break;
++ }
++ }
++
++ WARN_ONCE(1, "Unsupported port %d\n", port);
++
++ /* RO fallback reg */
++ return REG_SWITCH_STATUS;
++}
++
+ /* Return the number of active ports, not counting the IMP (CPU) port */
+ static unsigned int bcm_sf2_num_active_ports(struct dsa_switch *ds)
+ {
+@@ -647,6 +672,7 @@ static void bcm_sf2_sw_mac_config(struct dsa_switch *ds, int port,
+ {
+ struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+ u32 id_mode_dis = 0, port_mode;
++ u32 reg_rgmii_ctrl;
+ u32 reg;
+
+ if (port == core_readl(priv, CORE_IMP0_PRT_ID))
+@@ -670,10 +696,12 @@ static void bcm_sf2_sw_mac_config(struct dsa_switch *ds, int port,
+ return;
+ }
+
++ reg_rgmii_ctrl = bcm_sf2_reg_rgmii_cntrl(priv, port);
++
+ /* Clear id_mode_dis bit, and the existing port mode, let
+ * RGMII_MODE_EN bet set by mac_link_{up,down}
+ */
+- reg = reg_readl(priv, REG_RGMII_CNTRL_P(port));
++ reg = reg_readl(priv, reg_rgmii_ctrl);
+ reg &= ~ID_MODE_DIS;
+ reg &= ~(PORT_MODE_MASK << PORT_MODE_SHIFT);
+
+@@ -681,13 +709,14 @@ static void bcm_sf2_sw_mac_config(struct dsa_switch *ds, int port,
+ if (id_mode_dis)
+ reg |= ID_MODE_DIS;
+
+- reg_writel(priv, reg, REG_RGMII_CNTRL_P(port));
++ reg_writel(priv, reg, reg_rgmii_ctrl);
+ }
+
+ static void bcm_sf2_sw_mac_link_set(struct dsa_switch *ds, int port,
+ phy_interface_t interface, bool link)
+ {
+ struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
++ u32 reg_rgmii_ctrl;
+ u32 reg;
+
+ if (!phy_interface_mode_is_rgmii(interface) &&
+@@ -695,13 +724,15 @@ static void bcm_sf2_sw_mac_link_set(struct dsa_switch *ds, int port,
+ interface != PHY_INTERFACE_MODE_REVMII)
+ return;
+
++ reg_rgmii_ctrl = bcm_sf2_reg_rgmii_cntrl(priv, port);
++
+ /* If the link is down, just disable the interface to conserve power */
+- reg = reg_readl(priv, REG_RGMII_CNTRL_P(port));
++ reg = reg_readl(priv, reg_rgmii_ctrl);
+ if (link)
+ reg |= RGMII_MODE_EN;
+ else
+ reg &= ~RGMII_MODE_EN;
+- reg_writel(priv, reg, REG_RGMII_CNTRL_P(port));
++ reg_writel(priv, reg, reg_rgmii_ctrl);
+ }
+
+ static void bcm_sf2_sw_mac_link_down(struct dsa_switch *ds, int port,
+@@ -735,11 +766,15 @@ static void bcm_sf2_sw_mac_link_up(struct dsa_switch *ds, int port,
+ {
+ struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+ struct ethtool_eee *p = &priv->dev->ports[port].eee;
+- u32 reg, offset;
+
+ bcm_sf2_sw_mac_link_set(ds, port, interface, true);
+
+ if (port != core_readl(priv, CORE_IMP0_PRT_ID)) {
++ u32 reg_rgmii_ctrl;
++ u32 reg, offset;
++
++ reg_rgmii_ctrl = bcm_sf2_reg_rgmii_cntrl(priv, port);
++
+ if (priv->type == BCM4908_DEVICE_ID ||
+ priv->type == BCM7445_DEVICE_ID)
+ offset = CORE_STS_OVERRIDE_GMIIP_PORT(port);
+@@ -750,7 +785,7 @@ static void bcm_sf2_sw_mac_link_up(struct dsa_switch *ds, int port,
+ interface == PHY_INTERFACE_MODE_RGMII_TXID ||
+ interface == PHY_INTERFACE_MODE_MII ||
+ interface == PHY_INTERFACE_MODE_REVMII) {
+- reg = reg_readl(priv, REG_RGMII_CNTRL_P(port));
++ reg = reg_readl(priv, reg_rgmii_ctrl);
+ reg &= ~(RX_PAUSE_EN | TX_PAUSE_EN);
+
+ if (tx_pause)
+@@ -758,7 +793,7 @@ static void bcm_sf2_sw_mac_link_up(struct dsa_switch *ds, int port,
+ if (rx_pause)
+ reg |= RX_PAUSE_EN;
+
+- reg_writel(priv, reg, REG_RGMII_CNTRL_P(port));
++ reg_writel(priv, reg, reg_rgmii_ctrl);
+ }
+
+ reg = SW_OVERRIDE | LINK_STS;
+diff --git a/drivers/net/dsa/bcm_sf2_regs.h b/drivers/net/dsa/bcm_sf2_regs.h
+index 1d2d55c9f8aa..c7783cb45845 100644
+--- a/drivers/net/dsa/bcm_sf2_regs.h
++++ b/drivers/net/dsa/bcm_sf2_regs.h
+@@ -48,8 +48,6 @@ enum bcm_sf2_reg_offs {
+ #define PHY_PHYAD_SHIFT 8
+ #define PHY_PHYAD_MASK 0x1F
+
+-#define REG_RGMII_CNTRL_P(x) (REG_RGMII_0_CNTRL + (x))
+-
+ /* Relative to REG_RGMII_CNTRL */
+ #define RGMII_MODE_EN (1 << 0)
+ #define ID_MODE_DIS (1 << 1)
+--
+2.30.2
+
--- /dev/null
+From c6862d786220c35d59e6a0084d89f05fe0f9ee34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 09:01:43 +0100
+Subject: net: dsa: bcm_sf2: fix BCM4908 RGMII reg(s)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 6859d91549341c2ad769d482de58129f080c0f04 ]
+
+BCM4908 has only 1 RGMII reg for controlling port 7.
+
+Fixes: 73b7a6047971 ("net: dsa: bcm_sf2: support BCM4908's integrated switch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 11 +++++++----
+ drivers/net/dsa/bcm_sf2_regs.h | 1 +
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index cd64b7f471b5..9c86cacc4a72 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -36,7 +36,12 @@ static u16 bcm_sf2_reg_rgmii_cntrl(struct bcm_sf2_priv *priv, int port)
+ {
+ switch (priv->type) {
+ case BCM4908_DEVICE_ID:
+- /* TODO */
++ switch (port) {
++ case 7:
++ return REG_RGMII_11_CNTRL;
++ default:
++ break;
++ }
+ break;
+ default:
+ switch (port) {
+@@ -1179,9 +1184,7 @@ static const u16 bcm_sf2_4908_reg_offsets[] = {
+ [REG_PHY_REVISION] = 0x14,
+ [REG_SPHY_CNTRL] = 0x24,
+ [REG_CROSSBAR] = 0xc8,
+- [REG_RGMII_0_CNTRL] = 0xe0,
+- [REG_RGMII_1_CNTRL] = 0xec,
+- [REG_RGMII_2_CNTRL] = 0xf8,
++ [REG_RGMII_11_CNTRL] = 0x014c,
+ [REG_LED_0_CNTRL] = 0x40,
+ [REG_LED_1_CNTRL] = 0x4c,
+ [REG_LED_2_CNTRL] = 0x58,
+diff --git a/drivers/net/dsa/bcm_sf2_regs.h b/drivers/net/dsa/bcm_sf2_regs.h
+index c7783cb45845..9e141d1a0b07 100644
+--- a/drivers/net/dsa/bcm_sf2_regs.h
++++ b/drivers/net/dsa/bcm_sf2_regs.h
+@@ -21,6 +21,7 @@ enum bcm_sf2_reg_offs {
+ REG_RGMII_0_CNTRL,
+ REG_RGMII_1_CNTRL,
+ REG_RGMII_2_CNTRL,
++ REG_RGMII_11_CNTRL,
+ REG_LED_0_CNTRL,
+ REG_LED_1_CNTRL,
+ REG_LED_2_CNTRL,
+--
+2.30.2
+
--- /dev/null
+From b749d7d970a0545d4e4f8d7dc2d63dabb6774921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 18:17:34 +0200
+Subject: net: dsa: mv88e6xxx: Fix 6095/6097/6185 ports in non-SERDES CMODE
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 6066234aa33850e9e35e7be82d92b9e9091e774b ]
+
+The .serdes_get_lane op used the magic value 0xff to indicate a valid
+SERDES lane and 0 signaled that a non-SERDES mode was set on the port.
+
+Unfortunately, "0" is also a valid lane ID, so even when these ports
+where configured to e.g. RGMII the driver would set them up as SERDES
+ports.
+
+- Replace 0xff with 0 to indicate a valid lane ID. The number is on
+ the one hand just as arbitrary, but it is at least the first valid one
+ and therefore less of a surprise.
+
+- Follow the other .serdes_get_lane implementations and return -ENODEV
+ in the case where no SERDES is assigned to the port.
+
+Fixes: f5be107c3338 ("net: dsa: mv88e6xxx: Support serdes ports on MV88E6097/6095/6185")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/serdes.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
+index 3195936dc5be..2ce04fef698d 100644
+--- a/drivers/net/dsa/mv88e6xxx/serdes.c
++++ b/drivers/net/dsa/mv88e6xxx/serdes.c
+@@ -443,15 +443,15 @@ int mv88e6185_serdes_power(struct mv88e6xxx_chip *chip, int port, u8 lane,
+ u8 mv88e6185_serdes_get_lane(struct mv88e6xxx_chip *chip, int port)
+ {
+ /* There are no configurable serdes lanes on this switch chip but we
+- * need to return non-zero so that callers of
++ * need to return a non-negative lane number so that callers of
+ * mv88e6xxx_serdes_get_lane() know this is a serdes port.
+ */
+ switch (chip->ports[port].cmode) {
+ case MV88E6185_PORT_STS_CMODE_SERDES:
+ case MV88E6185_PORT_STS_CMODE_1000BASE_X:
+- return 0xff;
+- default:
+ return 0;
++ default:
++ return -ENODEV;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 940ed40fbd66c1afc2341ca4c0b009698d3d6487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 14:04:53 +0200
+Subject: net: dsa: mv88e6xxx: Fix off-by-one in VTU devlink region size
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 281140a0a2ce4febf2c0ce5d29d0e7d961a826b1 ]
+
+In the unlikely event of the VTU being loaded to the brim with 4k
+entries, the last one was placed in the buffer, but the size reported
+to devlink was off-by-one. Make sure that the final entry is available
+to the caller.
+
+Fixes: ca4d632aef03 ("net: dsa: mv88e6xxx: Export VTU as devlink region")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/devlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/devlink.c b/drivers/net/dsa/mv88e6xxx/devlink.c
+index 21953d6d484c..ada7a38d4d31 100644
+--- a/drivers/net/dsa/mv88e6xxx/devlink.c
++++ b/drivers/net/dsa/mv88e6xxx/devlink.c
+@@ -678,7 +678,7 @@ static int mv88e6xxx_setup_devlink_regions_global(struct dsa_switch *ds,
+ sizeof(struct mv88e6xxx_devlink_atu_entry);
+ break;
+ case MV88E6XXX_REGION_VTU:
+- size = mv88e6xxx_max_vid(chip) *
++ size = (mv88e6xxx_max_vid(chip) + 1) *
+ sizeof(struct mv88e6xxx_devlink_vtu_entry);
+ break;
+ }
+--
+2.30.2
+
--- /dev/null
+From 40cdf7741e581b688764328d2f9de57efd0e6625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 09:06:25 -0700
+Subject: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ]
+
+In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
+If some error happens in emac_tx_fill_tpd(), the skb will be freed via
+dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
+But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
+
+As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len,
+thus my patch assigns skb->len to 'len' before the possible free and
+use 'len' instead of skb->len later.
+
+Fixes: b9b17debc69d2 ("net: emac: emac gigabit ethernet controller driver")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+index 117188e3c7de..87b8c032195d 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+@@ -1437,6 +1437,7 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt,
+ {
+ struct emac_tpd tpd;
+ u32 prod_idx;
++ int len;
+
+ memset(&tpd, 0, sizeof(tpd));
+
+@@ -1456,9 +1457,10 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt,
+ if (skb_network_offset(skb) != ETH_HLEN)
+ TPD_TYP_SET(&tpd, 1);
+
++ len = skb->len;
+ emac_tx_fill_tpd(adpt, tx_q, skb, &tpd);
+
+- netdev_sent_queue(adpt->netdev, skb->len);
++ netdev_sent_queue(adpt->netdev, len);
+
+ /* Make sure the are enough free descriptors to hold one
+ * maximum-sized SKB. We need one desc for each fragment,
+--
+2.30.2
+
--- /dev/null
+From 4b887f39e6bd30d2f570a342f3d932dda98326c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 15:35:11 +0200
+Subject: net: enetc: fix link error again
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 74c97ea3b61e4ce149444f904ee8d4fc7073505b ]
+
+A link time bug that I had fixed before has come back now that
+another sub-module was added to the enetc driver:
+
+ERROR: modpost: "enetc_ierb_register_pf" [drivers/net/ethernet/freescale/enetc/fsl-enetc.ko] undefined!
+
+The problem is that the enetc Makefile is not actually used for
+the ierb module if that is the only built-in driver in there
+and everything else is a loadable module.
+
+Fix it by always entering the directory this time, regardless
+of which symbols are configured. This should reliably fix the
+problem and prevent it from coming back another time.
+
+Fixes: 112463ddbe82 ("net: dsa: felix: fix link error")
+Fixes: e7d48e5fbf30 ("net: enetc: add a mini driver for the Integrated Endpoint Register Block")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/Makefile | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/Makefile b/drivers/net/ethernet/freescale/Makefile
+index 67c436400352..de7b31842233 100644
+--- a/drivers/net/ethernet/freescale/Makefile
++++ b/drivers/net/ethernet/freescale/Makefile
+@@ -24,6 +24,4 @@ obj-$(CONFIG_FSL_DPAA_ETH) += dpaa/
+
+ obj-$(CONFIG_FSL_DPAA2_ETH) += dpaa2/
+
+-obj-$(CONFIG_FSL_ENETC) += enetc/
+-obj-$(CONFIG_FSL_ENETC_MDIO) += enetc/
+-obj-$(CONFIG_FSL_ENETC_VF) += enetc/
++obj-y += enetc/
+--
+2.30.2
+
--- /dev/null
+From 8369b729a6ab9feadef3010c65214cedb33bed29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Apr 2021 20:28:53 +0200
+Subject: net: ethernet: ixp4xx: Set the DMA masks explicitly
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 8d892d60941b00c86d2029c8a99db24ab4979673 ]
+
+The former fix only papered over the actual problem: the
+ethernet core expects the netdev .dev member to have the
+proper DMA masks set, or there will be BUG_ON() triggered
+in kernel/dma/mapping.c.
+
+Fix this by simply copying dma_mask and dma_mask_coherent
+from the parent device.
+
+Fixes: e45d0fad4a5f ("net: ethernet: ixp4xx: Use parent dev for DMA pool")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xscale/ixp4xx_eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+index 0152f1e70783..9defaa21a1a9 100644
+--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
++++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+@@ -1085,7 +1085,7 @@ static int init_queues(struct port *port)
+ int i;
+
+ if (!ports_open) {
+- dma_pool = dma_pool_create(DRV_NAME, port->netdev->dev.parent,
++ dma_pool = dma_pool_create(DRV_NAME, &port->netdev->dev,
+ POOL_ALLOC_SIZE, 32, 0);
+ if (!dma_pool)
+ return -ENOMEM;
+@@ -1435,6 +1435,9 @@ static int ixp4xx_eth_probe(struct platform_device *pdev)
+ ndev->netdev_ops = &ixp4xx_netdev_ops;
+ ndev->ethtool_ops = &ixp4xx_ethtool_ops;
+ ndev->tx_queue_len = 100;
++ /* Inherit the DMA masks from the platform device */
++ ndev->dev.dma_mask = dev->dma_mask;
++ ndev->dev.coherent_dma_mask = dev->coherent_dma_mask;
+
+ netif_napi_add(ndev, &port->napi, eth_poll, NAPI_WEIGHT);
+
+--
+2.30.2
+
--- /dev/null
+From 24750e12bcb4c229a4858d9e400dc84b303e91e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 00:49:45 +0100
+Subject: net: geneve: modify IP header check in geneve6_xmit_skb and
+ geneve_xmit_skb
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ]
+
+Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb
+to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes
+two kernel selftest failures introduced by the commit introducing the
+checks:
+IPv4 over geneve6: PMTU exceptions
+IPv4 over geneve6: PMTU exceptions - nexthop objects
+
+It does this by correctly accounting for the fact that IPv4 packets may
+transit over geneve IPv6 tunnels (and vice versa), and still fixes the
+uninit-value bug fixed by the original commit.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: 6628ddfec758 ("net: geneve: check skb is large enough for IPv4/IPv6 header")
+Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Acked-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 42f31c681846..61cd3dd4deab 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -891,7 +891,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+@@ -988,7 +988,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+--
+2.30.2
+
--- /dev/null
+From 9f976d0b3c5910ab371b9abc6a7ceec160bf5178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Apr 2021 18:28:25 +0100
+Subject: net: hns3: Limiting the scope of vector_ring_chain variable
+
+From: Salil Mehta <salil.mehta@huawei.com>
+
+[ Upstream commit d392ecd1bc29ae15b0e284d5f732c2d36f244271 ]
+
+Limiting the scope of the variable vector_ring_chain to the block where it
+is used.
+
+Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index bf4302a5cf95..65752f363f43 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3704,7 +3704,6 @@ static void hns3_nic_set_cpumask(struct hns3_nic_priv *priv)
+
+ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ {
+- struct hnae3_ring_chain_node vector_ring_chain;
+ struct hnae3_handle *h = priv->ae_handle;
+ struct hns3_enet_tqp_vector *tqp_vector;
+ int ret;
+@@ -3736,6 +3735,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ }
+
+ for (i = 0; i < priv->vector_num; i++) {
++ struct hnae3_ring_chain_node vector_ring_chain;
++
+ tqp_vector = &priv->tqp_vector[i];
+
+ tqp_vector->rx_group.total_bytes = 0;
+--
+2.30.2
+
--- /dev/null
+From 5a9bfd61d20187b3356a7ba8b078e7e002855cba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 23:23:09 -0800
+Subject: net: lapbether: Prevent racing when checking whether the netif is
+ running
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ]
+
+There are two "netif_running" checks in this driver. One is in
+"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make
+sure that the LAPB APIs called in these functions are called before
+"lapb_unregister" is called by the "ndo_stop" function.
+
+However, these "netif_running" checks are unreliable, because it's
+possible that immediately after "netif_running" returns true, "ndo_stop"
+is called (which causes "lapb_unregister" to be called).
+
+This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can
+reliably check and ensure the netif is running while doing their work.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index c3372498f4f1..8fda0446ff71 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -51,6 +51,8 @@ struct lapbethdev {
+ struct list_head node;
+ struct net_device *ethdev; /* link to ethernet device */
+ struct net_device *axdev; /* lapbeth device (lapb#) */
++ bool up;
++ spinlock_t up_lock; /* Protects "up" */
+ };
+
+ static LIST_HEAD(lapbeth_devices);
+@@ -101,8 +103,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ rcu_read_lock();
+ lapbeth = lapbeth_get_x25_dev(dev);
+ if (!lapbeth)
+- goto drop_unlock;
+- if (!netif_running(lapbeth->axdev))
++ goto drop_unlock_rcu;
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop_unlock;
+
+ len = skb->data[0] + skb->data[1] * 256;
+@@ -117,11 +120,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ goto drop_unlock;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ rcu_read_unlock();
+ return 0;
+ drop_unlock:
+ kfree_skb(skb);
+ goto out;
++drop_unlock_rcu:
++ rcu_read_unlock();
+ drop:
+ kfree_skb(skb);
+ return 0;
+@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
+ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+- /*
+- * Just to be *really* sure not to send anything if the interface
+- * is down, the ethernet device may have gone.
+- */
+- if (!netif_running(dev))
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop;
+
+ /* There should be a pseudo header of 1 byte added by upper layers.
+@@ -194,6 +198,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ goto drop;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ return NETDEV_TX_OK;
+ drop:
+ kfree_skb(skb);
+@@ -285,6 +290,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {
+ */
+ static int lapbeth_open(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+ if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) {
+@@ -292,13 +298,22 @@ static int lapbeth_open(struct net_device *dev)
+ return -ENODEV;
+ }
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = true;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ return 0;
+ }
+
+ static int lapbeth_close(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = false;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ if ((err = lapb_unregister(dev)) != LAPB_OK)
+ pr_err("lapb_unregister error: %d\n", err);
+
+@@ -356,6 +371,9 @@ static int lapbeth_new_device(struct net_device *dev)
+ dev_hold(dev);
+ lapbeth->ethdev = dev;
+
++ lapbeth->up = false;
++ spin_lock_init(&lapbeth->up_lock);
++
+ rc = -EIO;
+ if (register_netdevice(ndev))
+ goto fail;
+--
+2.30.2
+
--- /dev/null
+From 85dfd984ce25d7bf21284a6ed7e63c3abe55c59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 16:31:51 +0300
+Subject: net: marvell: prestera: fix port event handling on init
+
+From: Vadym Kochan <vkochan@marvell.com>
+
+[ Upstream commit 333980481b99edb24ebd5d1a53af70a15d9146de ]
+
+For some reason there might be a crash during ports creation if port
+events are handling at the same time because fw may send initial
+port event with down state.
+
+The crash points to cancel_delayed_work() which is called when port went
+is down. Currently I did not find out the real cause of the issue, so
+fixed it by cancel port stats work only if previous port's state was up
+& runnig.
+
+The following is the crash which can be triggered:
+
+[ 28.311104] Unable to handle kernel paging request at virtual address
+000071775f776600
+[ 28.319097] Mem abort info:
+[ 28.321914] ESR = 0x96000004
+[ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 28.330350] SET = 0, FnV = 0
+[ 28.333430] EA = 0, S1PTW = 0
+[ 28.336597] Data abort info:
+[ 28.339499] ISV = 0, ISS = 0x00000004
+[ 28.343362] CM = 0, WnR = 0
+[ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000
+[ 28.352842] [000071775f776600] pgd=0000000000000000,
+p4d=0000000000000000
+[ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 28.365310] Modules linked in: prestera_pci(+) prestera
+uio_pdrv_genirq
+[ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted
+5.11.0-rc4 #1
+[ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT)
+[ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn
+[prestera_pci]
+[ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)
+[ 28.397468] pc : get_work_pool+0x48/0x60
+[ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0
+[ 28.406018] sp : ffff80001391bc60
+[ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000
+[ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88
+[ 28.420089] x25: 0000000000000000 x24: ffff000106119760
+[ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000
+[ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0
+[ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0
+[ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88
+[ 28.446898] x15: 0000000000000001 x14: 00000000000002ba
+[ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4
+[ 28.457622] x11: 0000000000000030 x10: 000000000000000c
+[ 28.462985] x9 : 000000000000000c x8 : 0000000000000030
+[ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758
+[ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60
+[ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060
+[ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8
+[ 28.489791] Call trace:
+[ 28.492259] get_work_pool+0x48/0x60
+[ 28.495874] cancel_delayed_work+0x38/0xb0
+[ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera]
+[ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera]
+[ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci]
+[ 28.516660] process_one_work+0x1e8/0x360
+[ 28.520710] worker_thread+0x44/0x480
+[ 28.524412] kthread+0x154/0x160
+[ 28.527670] ret_from_fork+0x10/0x38
+[ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020)
+[ 28.537429] ---[ end trace 5eced933df3a080b ]---
+
+Fixes: 501ef3066c89 ("net: marvell: prestera: Add driver for Prestera family ASIC devices")
+Signed-off-by: Vadym Kochan <vkochan@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c
+index 25dd903a3e92..d849b0f65de2 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c
+@@ -431,7 +431,8 @@ static void prestera_port_handle_event(struct prestera_switch *sw,
+ netif_carrier_on(port->dev);
+ if (!delayed_work_pending(caching_dw))
+ queue_delayed_work(prestera_wq, caching_dw, 0);
+- } else {
++ } else if (netif_running(port->dev) &&
++ netif_carrier_ok(port->dev)) {
+ netif_carrier_off(port->dev);
+ if (delayed_work_pending(caching_dw))
+ cancel_delayed_work(caching_dw);
+--
+2.30.2
+
--- /dev/null
+From fafb7be8d8b7dda0cfea090caee304bf41b949fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Feb 2021 22:41:41 +0200
+Subject: net/mlx5: DR, Add missing vhca_id consume from STEv1
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+[ Upstream commit cc82a2e6c8af956d894fa58a040dc0d532dd9978 ]
+
+The field source_eswitch_owner_vhca_id was not consumed
+in the same way as in STEv0. Added the missing set.
+
+Fixes: 10b694186410 ("net/mlx5: DR, Add HW STEv1 match logic")
+Signed-off-by: Alex Vesker <valex@mellanox.com>
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v1.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v1.c
+index 9143ec326ebf..f146c618a78e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v1.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v1.c
+@@ -1532,6 +1532,7 @@ static void dr_ste_v1_build_src_gvmi_qpn_bit_mask(struct mlx5dr_match_param *val
+
+ DR_STE_SET_ONES(src_gvmi_qp_v1, bit_mask, source_gvmi, misc_mask, source_port);
+ DR_STE_SET_ONES(src_gvmi_qp_v1, bit_mask, source_qp, misc_mask, source_sqn);
++ misc_mask->source_eswitch_owner_vhca_id = 0;
+ }
+
+ static int dr_ste_v1_build_src_gvmi_qpn_tag(struct mlx5dr_match_param *value,
+--
+2.30.2
+
--- /dev/null
+From 79cdd26cbbafccda8c676c7be6ebb63ad245eafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 17:53:46 +0100
+Subject: net/mlx5: Fix bit-wise and with zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 82c3ba31c370b6001cbf90689e98da1fb6f26aef ]
+
+The bit-wise and of the action field with MLX5_ACCEL_ESP_ACTION_DECRYPT
+is incorrect as MLX5_ACCEL_ESP_ACTION_DECRYPT is zero and not intended
+to be a bit-flag. Fix this by using the == operator as was originally
+intended.
+
+Addresses-Coverity: ("Logically dead code")
+Fixes: 7dfee4b1d79e ("net/mlx5: IPsec, Refactor SA handle creation and destruction")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+index 22bee4990232..bb61f52d782d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -850,7 +850,7 @@ mlx5_fpga_ipsec_release_sa_ctx(struct mlx5_fpga_ipsec_sa_ctx *sa_ctx)
+ return;
+ }
+
+- if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action &
++ if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action ==
+ MLX5_ACCEL_ESP_ACTION_DECRYPT)
+ ida_simple_remove(&fipsec->halloc, sa_ctx->sa_handle);
+
+--
+2.30.2
+
--- /dev/null
+From 59d34da40ec17d1814bcd94693eb83af01089b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Apr 2021 09:22:58 -0700
+Subject: net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]
+
+In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp).
+If nfc_tm_data_received() failed, the callee will free the resp via
+kfree_skb() and return error. But in the exit branch, the resp
+will be freed again.
+
+My patch sets resp to NULL if nfc_tm_data_received() failed, to
+avoid the double free.
+
+Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/digital_dep.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
+index 5971fb6f51cc..dc21b4141b0a 100644
+--- a/net/nfc/digital_dep.c
++++ b/net/nfc/digital_dep.c
+@@ -1273,6 +1273,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
+ }
+
+ rc = nfc_tm_data_received(ddev->nfc_dev, resp);
++ if (rc)
++ resp = NULL;
+
+ exit:
+ kfree_skb(ddev->chaining_skb);
+--
+2.30.2
+
--- /dev/null
+From 49d57eaa1800fe8aeced82b9a9305aa4ff7e5e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 12:36:44 -0700
+Subject: net/packet: remove data races in fanout operations
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 94f633ea8ade8418634d152ad0931133338226f6 ]
+
+af_packet fanout uses RCU rules to ensure f->arr elements
+are not dismantled before RCU grace period.
+
+However, it lacks rcu accessors to make sure KCSAN and other tools
+wont detect data races. Stupid compilers could also play games.
+
+Fixes: dc99f600698d ("packet: Add fanout support.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 15 +++++++++------
+ net/packet/internal.h | 2 +-
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e24b2841c643..9611e41c7b8b 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1359,7 +1359,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
+ struct packet_sock *po, *po_next, *po_skip = NULL;
+ unsigned int i, j, room = ROOM_NONE;
+
+- po = pkt_sk(f->arr[idx]);
++ po = pkt_sk(rcu_dereference(f->arr[idx]));
+
+ if (try_self) {
+ room = packet_rcv_has_room(po, skb);
+@@ -1371,7 +1371,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
+
+ i = j = min_t(int, po->rollover->sock, num - 1);
+ do {
+- po_next = pkt_sk(f->arr[i]);
++ po_next = pkt_sk(rcu_dereference(f->arr[i]));
+ if (po_next != po_skip && !READ_ONCE(po_next->pressure) &&
+ packet_rcv_has_room(po_next, skb) == ROOM_NORMAL) {
+ if (i != j)
+@@ -1466,7 +1466,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ if (fanout_has_flag(f, PACKET_FANOUT_FLAG_ROLLOVER))
+ idx = fanout_demux_rollover(f, skb, idx, true, num);
+
+- po = pkt_sk(f->arr[idx]);
++ po = pkt_sk(rcu_dereference(f->arr[idx]));
+ return po->prot_hook.func(skb, dev, &po->prot_hook, orig_dev);
+ }
+
+@@ -1480,7 +1480,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po)
+ struct packet_fanout *f = po->fanout;
+
+ spin_lock(&f->lock);
+- f->arr[f->num_members] = sk;
++ rcu_assign_pointer(f->arr[f->num_members], sk);
+ smp_wmb();
+ f->num_members++;
+ if (f->num_members == 1)
+@@ -1495,11 +1495,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
+
+ spin_lock(&f->lock);
+ for (i = 0; i < f->num_members; i++) {
+- if (f->arr[i] == sk)
++ if (rcu_dereference_protected(f->arr[i],
++ lockdep_is_held(&f->lock)) == sk)
+ break;
+ }
+ BUG_ON(i >= f->num_members);
+- f->arr[i] = f->arr[f->num_members - 1];
++ rcu_assign_pointer(f->arr[i],
++ rcu_dereference_protected(f->arr[f->num_members - 1],
++ lockdep_is_held(&f->lock)));
+ f->num_members--;
+ if (f->num_members == 0)
+ __dev_remove_pack(&f->prot_hook);
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 5f61e59ebbff..48af35b1aed2 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -94,7 +94,7 @@ struct packet_fanout {
+ spinlock_t lock;
+ refcount_t sk_ref;
+ struct packet_type prot_hook ____cacheline_aligned_in_smp;
+- struct sock *arr[];
++ struct sock __rcu *arr[];
+ };
+
+ struct packet_rollover {
+--
+2.30.2
+
--- /dev/null
+From 4389cf7e8ef75f250251c0f65ad6ef1ac158e539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 07:50:47 +0200
+Subject: net: phy: intel-xway: enable integrated led functions
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 357a07c26697a770d39d28b6b111f978deb4017d ]
+
+The Intel xway phys offer the possibility to deactivate the integrated
+LED function and to control the LEDs manually.
+If this was set by the bootloader, it must be ensured that the
+integrated LED function is enabled for all LEDs when loading the driver.
+
+Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+the LEDs were enabled by a soft-reset of the PHY (using
+genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default
+value (which is applied during a soft reset) instead of adding back
+the soft reset. This brings back the default LED configuration while
+still preventing an excessive amount of soft resets.
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/net/phy/intel-xway.c b/drivers/net/phy/intel-xway.c
+index 6eac50d4b42f..d453ec016168 100644
+--- a/drivers/net/phy/intel-xway.c
++++ b/drivers/net/phy/intel-xway.c
+@@ -11,6 +11,18 @@
+
+ #define XWAY_MDIO_IMASK 0x19 /* interrupt mask */
+ #define XWAY_MDIO_ISTAT 0x1A /* interrupt status */
++#define XWAY_MDIO_LED 0x1B /* led control */
++
++/* bit 15:12 are reserved */
++#define XWAY_MDIO_LED_LED3_EN BIT(11) /* Enable the integrated function of LED3 */
++#define XWAY_MDIO_LED_LED2_EN BIT(10) /* Enable the integrated function of LED2 */
++#define XWAY_MDIO_LED_LED1_EN BIT(9) /* Enable the integrated function of LED1 */
++#define XWAY_MDIO_LED_LED0_EN BIT(8) /* Enable the integrated function of LED0 */
++/* bit 7:4 are reserved */
++#define XWAY_MDIO_LED_LED3_DA BIT(3) /* Direct Access to LED3 */
++#define XWAY_MDIO_LED_LED2_DA BIT(2) /* Direct Access to LED2 */
++#define XWAY_MDIO_LED_LED1_DA BIT(1) /* Direct Access to LED1 */
++#define XWAY_MDIO_LED_LED0_DA BIT(0) /* Direct Access to LED0 */
+
+ #define XWAY_MDIO_INIT_WOL BIT(15) /* Wake-On-LAN */
+ #define XWAY_MDIO_INIT_MSRE BIT(14)
+@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev)
+ /* Clear all pending interrupts */
+ phy_read(phydev, XWAY_MDIO_ISTAT);
+
++ /* Ensure that integrated led function is enabled for all leds */
++ err = phy_write(phydev, XWAY_MDIO_LED,
++ XWAY_MDIO_LED_LED0_EN |
++ XWAY_MDIO_LED_LED1_EN |
++ XWAY_MDIO_LED_LED2_EN |
++ XWAY_MDIO_LED_LED3_EN);
++ if (err)
++ return err;
++
+ phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH,
+ XWAY_MMD_LEDCH_NACS_NONE |
+ XWAY_MMD_LEDCH_SBF_F02HZ |
+--
+2.30.2
+
--- /dev/null
+From b691e176f3be13645ae699aa44f2ef46f62381d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 11:45:36 +0200
+Subject: net: phy: lan87xx: fix access to wrong register of LAN87xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andre Edich <andre.edich@microchip.com>
+
+[ Upstream commit fdb5cc6ab3b6a1c0122d3644a63ef9dc7a610d35 ]
+
+The function lan87xx_config_aneg_ext was introduced to configure
+LAN95xxA but as well writes to undocumented register of LAN87xx.
+This fix prevents that access.
+
+The function lan87xx_config_aneg_ext gets more suitable for the new
+behavior name.
+
+Reported-by: Måns Rullgård <mans@mansr.com>
+Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support")
+Signed-off-by: Andre Edich <andre.edich@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/smsc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
+index ddb78fb4d6dc..d8cac02a79b9 100644
+--- a/drivers/net/phy/smsc.c
++++ b/drivers/net/phy/smsc.c
+@@ -185,10 +185,13 @@ static int lan87xx_config_aneg(struct phy_device *phydev)
+ return genphy_config_aneg(phydev);
+ }
+
+-static int lan87xx_config_aneg_ext(struct phy_device *phydev)
++static int lan95xx_config_aneg_ext(struct phy_device *phydev)
+ {
+ int rc;
+
++ if (phydev->phy_id != 0x0007c0f0) /* not (LAN9500A or LAN9505A) */
++ return lan87xx_config_aneg(phydev);
++
+ /* Extend Manual AutoMDIX timer */
+ rc = phy_read(phydev, PHY_EDPD_CONFIG);
+ if (rc < 0)
+@@ -441,7 +444,7 @@ static struct phy_driver smsc_phy_driver[] = {
+ .read_status = lan87xx_read_status,
+ .config_init = smsc_phy_config_init,
+ .soft_reset = smsc_phy_reset,
+- .config_aneg = lan87xx_config_aneg_ext,
++ .config_aneg = lan95xx_config_aneg_ext,
+
+ /* IRQ related */
+ .config_intr = smsc_phy_config_intr,
+--
+2.30.2
+
--- /dev/null
+From fce09b749c3aab62fe4f47e41b2ed27359157e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 13:46:43 +0300
+Subject: net: phy: marvell: fix m88e1011_set_downshift
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit 990875b299b8612aeb85cb2e2751796f1add65ff ]
+
+Changing downshift params without software reset has no effect,
+so call genphy_soft_reset() after change downshift params.
+
+As the datasheet says:
+Changes to these bits are disruptive to the normal operation therefore,
+any changes to these registers must be followed by software reset
+to take effect.
+
+Fixes: 911af5e149bb ("net: phy: marvell: fix downshift function naming")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 8018ddf7f316..723f25f6138d 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1025,22 +1025,28 @@ static int m88e1011_get_downshift(struct phy_device *phydev, u8 *data)
+
+ static int m88e1011_set_downshift(struct phy_device *phydev, u8 cnt)
+ {
+- int val;
++ int val, err;
+
+ if (cnt > MII_M1011_PHY_SCR_DOWNSHIFT_MAX)
+ return -E2BIG;
+
+- if (!cnt)
+- return phy_clear_bits(phydev, MII_M1011_PHY_SCR,
+- MII_M1011_PHY_SCR_DOWNSHIFT_EN);
++ if (!cnt) {
++ err = phy_clear_bits(phydev, MII_M1011_PHY_SCR,
++ MII_M1011_PHY_SCR_DOWNSHIFT_EN);
++ } else {
++ val = MII_M1011_PHY_SCR_DOWNSHIFT_EN;
++ val |= FIELD_PREP(MII_M1011_PHY_SCR_DOWNSHIFT_MASK, cnt - 1);
+
+- val = MII_M1011_PHY_SCR_DOWNSHIFT_EN;
+- val |= FIELD_PREP(MII_M1011_PHY_SCR_DOWNSHIFT_MASK, cnt - 1);
++ err = phy_modify(phydev, MII_M1011_PHY_SCR,
++ MII_M1011_PHY_SCR_DOWNSHIFT_EN |
++ MII_M1011_PHY_SCR_DOWNSHIFT_MASK,
++ val);
++ }
+
+- return phy_modify(phydev, MII_M1011_PHY_SCR,
+- MII_M1011_PHY_SCR_DOWNSHIFT_EN |
+- MII_M1011_PHY_SCR_DOWNSHIFT_MASK,
+- val);
++ if (err < 0)
++ return err;
++
++ return genphy_soft_reset(phydev);
+ }
+
+ static int m88e1011_get_tunable(struct phy_device *phydev,
+--
+2.30.2
+
--- /dev/null
+From 1e20c5a2b71ed1e906e85867773e8cd1c601367c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 13:46:44 +0300
+Subject: net: phy: marvell: fix m88e1111_set_downshift
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit e7679c55a7249f1315256cfc672d53e84072e223 ]
+
+Changing downshift params without software reset has no effect,
+so call genphy_soft_reset() after change downshift params.
+
+As the datasheet says:
+Changes to these bits are disruptive to the normal operation therefore,
+any changes to these registers must be followed by software reset
+to take effect.
+
+Fixes: 5c6bc5199b5d ("net: phy: marvell: add downshift support for M88E1111")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 723f25f6138d..f86c9ddc609e 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -967,22 +967,28 @@ static int m88e1111_get_downshift(struct phy_device *phydev, u8 *data)
+
+ static int m88e1111_set_downshift(struct phy_device *phydev, u8 cnt)
+ {
+- int val;
++ int val, err;
+
+ if (cnt > MII_M1111_PHY_EXT_CR_DOWNSHIFT_MAX)
+ return -E2BIG;
+
+- if (!cnt)
+- return phy_clear_bits(phydev, MII_M1111_PHY_EXT_CR,
+- MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN);
++ if (!cnt) {
++ err = phy_clear_bits(phydev, MII_M1111_PHY_EXT_CR,
++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN);
++ } else {
++ val = MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN;
++ val |= FIELD_PREP(MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, cnt - 1);
+
+- val = MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN;
+- val |= FIELD_PREP(MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, cnt - 1);
++ err = phy_modify(phydev, MII_M1111_PHY_EXT_CR,
++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN |
++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK,
++ val);
++ }
+
+- return phy_modify(phydev, MII_M1111_PHY_EXT_CR,
+- MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN |
+- MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK,
+- val);
++ if (err < 0)
++ return err;
++
++ return genphy_soft_reset(phydev);
+ }
+
+ static int m88e1111_get_tunable(struct phy_device *phydev,
+--
+2.30.2
+
--- /dev/null
+From b7839c3870ae371b5b8a815d8b5f9c565b5091a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 13:52:46 +0900
+Subject: net: renesas: ravb: Fix a stuck issue when a lot of frames are
+ received
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 5718458b092bf6bf4482c5df32affba3c3259517 ]
+
+When a lot of frames were received in the short term, the driver
+caused a stuck of receiving until a new frame was received. For example,
+the following command from other device could cause this issue.
+
+ $ sudo ping -f -l 1000 -c 1000 <this driver's ipaddress>
+
+The previous code always cleared the interrupt flag of RX but checks
+the interrupt flags in ravb_poll(). So, ravb_poll() could not call
+ravb_rx() in the next time until a new RX frame was received if
+ravb_rx() returned true. To fix the issue, always calls ravb_rx()
+regardless the interrupt flags condition.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 35 ++++++++----------------
+ 1 file changed, 12 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index eb0c03bdb12d..cad57d58d764 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -911,31 +911,20 @@ static int ravb_poll(struct napi_struct *napi, int budget)
+ int q = napi - priv->napi;
+ int mask = BIT(q);
+ int quota = budget;
+- u32 ris0, tis;
+
+- for (;;) {
+- tis = ravb_read(ndev, TIS);
+- ris0 = ravb_read(ndev, RIS0);
+- if (!((ris0 & mask) || (tis & mask)))
+- break;
++ /* Processing RX Descriptor Ring */
++ /* Clear RX interrupt */
++ ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
++ if (ravb_rx(ndev, "a, q))
++ goto out;
+
+- /* Processing RX Descriptor Ring */
+- if (ris0 & mask) {
+- /* Clear RX interrupt */
+- ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
+- if (ravb_rx(ndev, "a, q))
+- goto out;
+- }
+- /* Processing TX Descriptor Ring */
+- if (tis & mask) {
+- spin_lock_irqsave(&priv->lock, flags);
+- /* Clear TX interrupt */
+- ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
+- ravb_tx_free(ndev, q, true);
+- netif_wake_subqueue(ndev, q);
+- spin_unlock_irqrestore(&priv->lock, flags);
+- }
+- }
++ /* Processing RX Descriptor Ring */
++ spin_lock_irqsave(&priv->lock, flags);
++ /* Clear TX interrupt */
++ ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
++ ravb_tx_free(ndev, q, true);
++ netif_wake_subqueue(ndev, q);
++ spin_unlock_irqrestore(&priv->lock, flags);
+
+ napi_complete(napi);
+
+--
+2.30.2
+
--- /dev/null
+From b8c2db00abdd9f95d79585eece26066c1fa11b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 17:45:51 +0200
+Subject: net/sched: act_ct: fix wild memory access when clearing fragments
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit f77bd544a6bbe69aa50d9ed09f13494cf36ff806 ]
+
+while testing re-assembly/re-fragmentation using act_ct, it's possible to
+observe a crash like the following one:
+
+ KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f]
+ CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424
+ Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017
+ RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0
+ Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48
+ RSP: 0018:ffff888c31449db8 EFLAGS: 00010203
+ RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960
+ RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e
+ RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350
+ R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000
+ R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160
+ FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <IRQ>
+ inet_frag_destroy+0xa9/0x150
+ call_timer_fn+0x2d/0x180
+ run_timer_softirq+0x4fe/0xe70
+ __do_softirq+0x197/0x5a0
+ irq_exit_rcu+0x1de/0x200
+ sysvec_apic_timer_interrupt+0x6b/0x80
+ </IRQ>
+
+when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb
+results in putting random data in FRAG_CB(), and this causes those "wild"
+memory accesses later, when the rbtree is purged. Never overwrite the skb
+cb in case tcf_ct_handle_fragments() returns -EINPROGRESS.
+
+Fixes: ae372cb1750f ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag")
+Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support")
+Reported-by: Shuang Li <shuali@redhat.com>
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ct.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index 16e888a9601d..48fdf7293dea 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -732,7 +732,8 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
+ #endif
+ }
+
+- *qdisc_skb_cb(skb) = cb;
++ if (err != -EINPROGRESS)
++ *qdisc_skb_cb(skb) = cb;
+ skb_clear_hash(skb);
+ skb->ignore_df = 1;
+ return err;
+@@ -967,7 +968,7 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);
+ if (err == -EINPROGRESS) {
+ retval = TC_ACT_STOLEN;
+- goto out;
++ goto out_clear;
+ }
+ if (err)
+ goto drop;
+@@ -1030,7 +1031,6 @@ do_nat:
+ out_push:
+ skb_push_rcsum(skb, nh_ofs);
+
+-out:
+ qdisc_skb_cb(skb)->post_ct = true;
+ out_clear:
+ tcf_action_update_bstats(&c->common, skb);
+--
+2.30.2
+
--- /dev/null
+From 594146fe7990edf6150c1fa6cbd843bf07b2f173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 17:11:49 +0800
+Subject: net: stmmac: fix TSO and TBS feature enabling during driver open
+
+From: Ong Boon Leong <boon.leong.ong@intel.com>
+
+[ Upstream commit 5e6038b88a5718910dd74b949946d9d9cee9a041 ]
+
+TSO and TBS cannot co-exist and current implementation requires two
+fixes:
+
+ 1) stmmac_open() does not need to call stmmac_enable_tbs() because
+ the MAC is reset in stmmac_init_dma_engine() anyway.
+ 2) Inside stmmac_hw_setup(), we should call stmmac_enable_tso() for
+ TX Q that is _not_ configured for TBS.
+
+Fixes: 579a25a854d4 ("net: stmmac: Initial support for TBS")
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 4749bd0af160..c6f24abf6432 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2757,8 +2757,15 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
+
+ /* Enable TSO */
+ if (priv->tso) {
+- for (chan = 0; chan < tx_cnt; chan++)
++ for (chan = 0; chan < tx_cnt; chan++) {
++ struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
++
++ /* TSO and TBS cannot co-exist */
++ if (tx_q->tbs & STMMAC_TBS_AVAIL)
++ continue;
++
+ stmmac_enable_tso(priv, priv->ioaddr, 1, chan);
++ }
+ }
+
+ /* Enable Split Header */
+@@ -2850,9 +2857,8 @@ static int stmmac_open(struct net_device *dev)
+ struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];
+ int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
+
++ /* Setup per-TXQ tbs flag before TX descriptor alloc */
+ tx_q->tbs |= tbs_en ? STMMAC_TBS_AVAIL : 0;
+- if (stmmac_enable_tbs(priv, priv->ioaddr, tbs_en, chan))
+- tx_q->tbs &= ~STMMAC_TBS_AVAIL;
+ }
+
+ ret = alloc_dma_desc_resources(priv);
+--
+2.30.2
+
--- /dev/null
+From 01eee228c587fa16825daaa001318c1ef22a4800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:07:26 +0100
+Subject: net: thunderx: Fix unintentional sign extension issue
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]
+
+The shifting of the u8 integers rq->caching by 26 bits to
+the left will be promoted to a 32 bit signed int and then
+sign-extended to a u64. In the event that rq->caching is
+greater than 0x1f then all then all the upper 32 bits of
+the u64 end up as also being set because of the int
+sign-extension. Fix this by casting the u8 values to a
+u64 before the 26 bit left shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+index f782e6af45e9..50bbe79fb93d 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
+ mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG;
+ mbx.rq.qs_num = qs->vnic_id;
+ mbx.rq.rq_num = qidx;
+- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) |
++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) |
+ (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) |
+ (rq->cont_qs_rbdr_idx << 8) |
+ (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx);
+--
+2.30.2
+
--- /dev/null
+From 15a5417fe26ac6072db8c1c5628916f43ca2dfc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 16:36:02 +0800
+Subject: net/tipc: fix missing destroy_workqueue() on error in
+ tipc_crypto_start()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit ac1db7acea67777be1ba86e36e058c479eab6508 ]
+
+Add the missing destroy_workqueue() before return from
+tipc_crypto_start() in the error handling case.
+
+Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index 97710ce36047..c89ce47c56cf 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -1492,6 +1492,8 @@ int tipc_crypto_start(struct tipc_crypto **crypto, struct net *net,
+ /* Allocate statistic structure */
+ c->stats = alloc_percpu_gfp(struct tipc_crypto_stats, GFP_ATOMIC);
+ if (!c->stats) {
++ if (c->wq)
++ destroy_workqueue(c->wq);
+ kfree_sensitive(c);
+ return -ENOMEM;
+ }
+--
+2.30.2
+
--- /dev/null
+From 3c7a155bfb51a046b60728af8ca61282bf0f7999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 16:15:59 +0200
+Subject: net, xdp: Update pkt_type if generic XDP changes unicast MAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Willi <martin@strongswan.org>
+
+[ Upstream commit 22b6034323fd736f260e00b9ea85c634abeb3446 ]
+
+If a generic XDP program changes the destination MAC address from/to
+multicast/broadcast, the skb->pkt_type is updated to properly handle
+the packet when passed up the stack. When changing the MAC from/to
+the NICs MAC, PACKET_HOST/OTHERHOST is not updated, though, making
+the behavior different from that of native XDP.
+
+Remember the PACKET_HOST/OTHERHOST state before calling the program
+in generic XDP, and update pkt_type accordingly if the destination
+MAC address has changed. As eth_type_trans() assumes a default
+pkt_type of PACKET_HOST, restore that before calling it.
+
+The use case for this is when a XDP program wants to push received
+packets up the stack by rewriting the MAC to the NICs MAC, for
+example by cluster nodes sharing MAC addresses.
+
+Fixes: 297249569932 ("net: fix generic XDP to handle if eth header was mangled")
+Signed-off-by: Martin Willi <martin@strongswan.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/bpf/20210419141559.8611-1-martin@strongswan.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 15fe36332fb8..70829c568645 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4672,10 +4672,10 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ void *orig_data, *orig_data_end, *hard_start;
+ struct netdev_rx_queue *rxqueue;
+ u32 metalen, act = XDP_DROP;
++ bool orig_bcast, orig_host;
+ u32 mac_len, frame_sz;
+ __be16 orig_eth_type;
+ struct ethhdr *eth;
+- bool orig_bcast;
+ int off;
+
+ /* Reinjected packets coming from act_mirred or similar should
+@@ -4722,6 +4722,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ orig_data_end = xdp->data_end;
+ orig_data = xdp->data;
+ eth = (struct ethhdr *)xdp->data;
++ orig_host = ether_addr_equal_64bits(eth->h_dest, skb->dev->dev_addr);
+ orig_bcast = is_multicast_ether_addr_64bits(eth->h_dest);
+ orig_eth_type = eth->h_proto;
+
+@@ -4749,8 +4750,11 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ /* check if XDP changed eth hdr such SKB needs update */
+ eth = (struct ethhdr *)xdp->data;
+ if ((orig_eth_type != eth->h_proto) ||
++ (orig_host != ether_addr_equal_64bits(eth->h_dest,
++ skb->dev->dev_addr)) ||
+ (orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) {
+ __skb_push(skb, ETH_HLEN);
++ skb->pkt_type = PACKET_HOST;
+ skb->protocol = eth_type_trans(skb, skb->dev);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 07c61b4feda6ef440571ec143e0f8dc4774b543b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 14:11:39 +0200
+Subject: netfilter: nft_payload: fix C-VLAN offload support
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 14c20643ef9457679cc6934d77adc24296505214 ]
+
+- add another struct flow_dissector_key_vlan for C-VLAN
+- update layer 3 dependency to allow to match on IPv4/IPv6
+
+Fixes: 89d8fd44abfb ("netfilter: nft_payload: add C-VLAN offload support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables_offload.h | 1 +
+ net/netfilter/nft_payload.c | 5 +++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
+index 1d34fe154fe0..b4d080061399 100644
+--- a/include/net/netfilter/nf_tables_offload.h
++++ b/include/net/netfilter/nf_tables_offload.h
+@@ -45,6 +45,7 @@ struct nft_flow_key {
+ struct flow_dissector_key_ports tp;
+ struct flow_dissector_key_ip ip;
+ struct flow_dissector_key_vlan vlan;
++ struct flow_dissector_key_vlan cvlan;
+ struct flow_dissector_key_eth_addrs eth_addrs;
+ struct flow_dissector_key_meta meta;
+ } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index cb1c8c231880..a990f37e0a60 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -241,7 +241,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
+ return -EOPNOTSUPP;
+
+- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,
++ NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan,
+ vlan_tci, sizeof(__be16), reg);
+ break;
+ case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
+@@ -249,8 +249,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
+ return -EOPNOTSUPP;
+
+- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,
++ NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan,
+ vlan_tpid, sizeof(__be16), reg);
++ nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
+ break;
+ default:
+ return -EOPNOTSUPP;
+--
+2.30.2
+
--- /dev/null
+From c3af6da7dc3664b712f5ee853a58df863cf5f86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 14:20:55 +0200
+Subject: netfilter: nftables_offload: special ethertype handling for VLAN
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 783003f3bb8a565326e89d18bbd948ad8ffc816a ]
+
+The nftables offload parser sets FLOW_DISSECTOR_KEY_BASIC .n_proto to the
+ethertype field in the ethertype frame. However:
+
+- FLOW_DISSECTOR_KEY_BASIC .n_proto field always stores either IPv4 or IPv6
+ ethertypes.
+- FLOW_DISSECTOR_KEY_VLAN .vlan_tpid stores either the 802.1q and 802.1ad
+ ethertypes. Same as for FLOW_DISSECTOR_KEY_CVLAN.
+
+This function adjusts the flow dissector to handle two scenarios:
+
+1) FLOW_DISSECTOR_KEY_VLAN .vlan_tpid is set to 802.1q or 802.1ad.
+ Then, transfer:
+ - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
+ - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the
+ FLOW_DISSECTOR_KEY_CVLAN .tpid
+ - the original FLOW_DISSECTOR_KEY_CVLAN .tpid to the .n_proto field.
+
+2) .n_proto is set to 802.1q or 802.1ad. Then, transfer:
+ - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
+ - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the .n_proto field.
+
+Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_offload.c | 44 +++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index 9ae14270c543..2b00f7f47693 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -45,6 +45,48 @@ void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
+ offsetof(struct nft_flow_key, control);
+ }
+
++struct nft_offload_ethertype {
++ __be16 value;
++ __be16 mask;
++};
++
++static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx,
++ struct nft_flow_rule *flow)
++{
++ struct nft_flow_match *match = &flow->match;
++ struct nft_offload_ethertype ethertype;
++
++ if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL) &&
++ match->key.basic.n_proto != htons(ETH_P_8021Q) &&
++ match->key.basic.n_proto != htons(ETH_P_8021AD))
++ return;
++
++ ethertype.value = match->key.basic.n_proto;
++ ethertype.mask = match->mask.basic.n_proto;
++
++ if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) &&
++ (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) ||
++ match->key.vlan.vlan_tpid == htons(ETH_P_8021AD))) {
++ match->key.basic.n_proto = match->key.cvlan.vlan_tpid;
++ match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid;
++ match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid;
++ match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid;
++ match->key.vlan.vlan_tpid = ethertype.value;
++ match->mask.vlan.vlan_tpid = ethertype.mask;
++ match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] =
++ offsetof(struct nft_flow_key, cvlan);
++ match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN);
++ } else {
++ match->key.basic.n_proto = match->key.vlan.vlan_tpid;
++ match->mask.basic.n_proto = match->mask.vlan.vlan_tpid;
++ match->key.vlan.vlan_tpid = ethertype.value;
++ match->mask.vlan.vlan_tpid = ethertype.mask;
++ match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN] =
++ offsetof(struct nft_flow_key, vlan);
++ match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_VLAN);
++ }
++}
++
+ struct nft_flow_rule *nft_flow_rule_create(struct net *net,
+ const struct nft_rule *rule)
+ {
+@@ -89,6 +131,8 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net,
+
+ expr = nft_expr_next(expr);
+ }
++ nft_flow_rule_transfer_vlan(ctx, flow);
++
+ flow->proto = ctx->dep.l3num;
+ kfree(ctx);
+
+--
+2.30.2
+
--- /dev/null
+From 64ed404f084cd5b594f08c11a019fbce4d68c9a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 14:20:15 +0200
+Subject: netfilter: nftables_offload: VLAN id needs host byteorder in flow
+ dissector
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit ff4d90a89d3d4d9814e0a2696509a7d495be4163 ]
+
+The flow dissector representation expects the VLAN id in host byteorder.
+Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp.
+
+Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables_offload.h | 11 +++++-
+ net/netfilter/nft_cmp.c | 41 +++++++++++++++++++++--
+ net/netfilter/nft_payload.c | 10 +++---
+ 3 files changed, 55 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
+index b4d080061399..434a6158852f 100644
+--- a/include/net/netfilter/nf_tables_offload.h
++++ b/include/net/netfilter/nf_tables_offload.h
+@@ -4,11 +4,16 @@
+ #include <net/flow_offload.h>
+ #include <net/netfilter/nf_tables.h>
+
++enum nft_offload_reg_flags {
++ NFT_OFFLOAD_F_NETWORK2HOST = (1 << 0),
++};
++
+ struct nft_offload_reg {
+ u32 key;
+ u32 len;
+ u32 base_offset;
+ u32 offset;
++ u32 flags;
+ struct nft_data data;
+ struct nft_data mask;
+ };
+@@ -72,13 +77,17 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rul
+ void nft_flow_rule_destroy(struct nft_flow_rule *flow);
+ int nft_flow_rule_offload_commit(struct net *net);
+
+-#define NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
++#define NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, __flags) \
+ (__reg)->base_offset = \
+ offsetof(struct nft_flow_key, __base); \
+ (__reg)->offset = \
+ offsetof(struct nft_flow_key, __base.__field); \
+ (__reg)->len = __len; \
+ (__reg)->key = __key; \
++ (__reg)->flags = __flags;
++
++#define NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
++ NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, 0)
+
+ #define NFT_OFFLOAD_MATCH_EXACT(__key, __base, __field, __len, __reg) \
+ NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index eb6a43a180bb..47b6d05f1ae6 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -114,19 +114,56 @@ nla_put_failure:
+ return -1;
+ }
+
++union nft_cmp_offload_data {
++ u16 val16;
++ u32 val32;
++ u64 val64;
++};
++
++static void nft_payload_n2h(union nft_cmp_offload_data *data,
++ const u8 *val, u32 len)
++{
++ switch (len) {
++ case 2:
++ data->val16 = ntohs(*((u16 *)val));
++ break;
++ case 4:
++ data->val32 = ntohl(*((u32 *)val));
++ break;
++ case 8:
++ data->val64 = be64_to_cpu(*((u64 *)val));
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++}
++
+ static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
+ struct nft_flow_rule *flow,
+ const struct nft_cmp_expr *priv)
+ {
+ struct nft_offload_reg *reg = &ctx->regs[priv->sreg];
++ union nft_cmp_offload_data _data, _datamask;
+ u8 *mask = (u8 *)&flow->match.mask;
+ u8 *key = (u8 *)&flow->match.key;
++ u8 *data, *datamask;
+
+ if (priv->op != NFT_CMP_EQ || priv->len > reg->len)
+ return -EOPNOTSUPP;
+
+- memcpy(key + reg->offset, &priv->data, reg->len);
+- memcpy(mask + reg->offset, ®->mask, reg->len);
++ if (reg->flags & NFT_OFFLOAD_F_NETWORK2HOST) {
++ nft_payload_n2h(&_data, (u8 *)&priv->data, reg->len);
++ nft_payload_n2h(&_datamask, (u8 *)®->mask, reg->len);
++ data = (u8 *)&_data;
++ datamask = (u8 *)&_datamask;
++ } else {
++ data = (u8 *)&priv->data;
++ datamask = (u8 *)®->mask;
++ }
++
++ memcpy(key + reg->offset, data, reg->len);
++ memcpy(mask + reg->offset, datamask, reg->len);
+
+ flow->match.dissector.used_keys |= BIT(reg->key);
+ flow->match.dissector.offset[reg->key] = reg->base_offset;
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index a990f37e0a60..501c5b24cc39 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -226,8 +226,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
+ return -EOPNOTSUPP;
+
+- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,
+- vlan_tci, sizeof(__be16), reg);
++ NFT_OFFLOAD_MATCH_FLAGS(FLOW_DISSECTOR_KEY_VLAN, vlan,
++ vlan_tci, sizeof(__be16), reg,
++ NFT_OFFLOAD_F_NETWORK2HOST);
+ break;
+ case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto):
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
+@@ -241,8 +242,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
+ return -EOPNOTSUPP;
+
+- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan,
+- vlan_tci, sizeof(__be16), reg);
++ NFT_OFFLOAD_MATCH_FLAGS(FLOW_DISSECTOR_KEY_CVLAN, cvlan,
++ vlan_tci, sizeof(__be16), reg,
++ NFT_OFFLOAD_F_NETWORK2HOST);
+ break;
+ case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
+ sizeof(struct vlan_hdr):
+--
+2.30.2
+
--- /dev/null
+From b54f42529ab78343c7ce8b202f00bae9548d8400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 14:44:42 +0300
+Subject: nfc: pn533: prevent potential memory corruption
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ]
+
+If the "type_a->nfcid_len" is too large then it would lead to memory
+corruption in pn533_target_found_type_a() when we do:
+
+ memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
+
+Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/pn533/pn533.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
+index f1469ac8ff42..3fe5b81eda2d 100644
+--- a/drivers/nfc/pn533/pn533.c
++++ b/drivers/nfc/pn533/pn533.c
+@@ -706,6 +706,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
+ if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
+ return false;
+
++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE)
++ return false;
++
+ return true;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f4a5f337fb931f9537334a2aaf43884220706eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 11:24:15 +0200
+Subject: nfp: devlink: initialize the devlink port attribute "lanes"
+
+From: Yinjun Zhang <yinjun.zhang@corigine.com>
+
+[ Upstream commit 90b669d65d99a3ee6965275269967cdee4da106e ]
+
+The number of lanes of devlink port should be correctly initialized
+when registering the port, so that the input check when running
+"devlink port split <port> count <N>" can pass.
+
+Fixes: a21cf0a8330b ("devlink: Add a new devlink port lanes attribute and pass to netlink")
+Signed-off-by: Yinjun Zhang <yinjun.zhang@corigine.com>
+Signed-off-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+index 713ee3041d49..bea978df7713 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+@@ -364,6 +364,7 @@ int nfp_devlink_port_register(struct nfp_app *app, struct nfp_port *port)
+
+ attrs.split = eth_port.is_split;
+ attrs.splittable = !attrs.split;
++ attrs.lanes = eth_port.port_lanes;
+ attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL;
+ attrs.phys.port_number = eth_port.label_port;
+ attrs.phys.split_subport_number = eth_port.label_subport;
+--
+2.30.2
+
--- /dev/null
+From 4ff5f57699ae26722b1fa56a0b3a6244e3364799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 15:03:59 -0400
+Subject: NFSv4.2: fix copy stateid copying for the async copy
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit e739b12042b6b079a397a3c234f96c09d1de0b40 ]
+
+This patch fixes Dan Carpenter's report that the static checker
+found a problem where memcpy() was copying into too small of a buffer.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: e0639dc5805a ("NFSD introduce async copy feature")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index dd9f38d072dd..e13c4c81fb89 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1538,8 +1538,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ if (!nfs4_init_copy_state(nn, copy))
+ goto out_err;
+ refcount_set(&async_copy->refcount, 1);
+- memcpy(©->cp_res.cb_stateid, ©->cp_stateid,
+- sizeof(copy->cp_stateid));
++ memcpy(©->cp_res.cb_stateid, ©->cp_stateid.stid,
++ sizeof(copy->cp_res.cb_stateid));
+ dup_copy_fields(copy, async_copy);
+ async_copy->copy_task = kthread_create(nfsd4_do_async_copy,
+ async_copy, "%s", "copy thread");
+--
+2.30.2
+
--- /dev/null
+From ccb50a47c7f8598611a268f3d74283f8cc35deef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:01:57 +0300
+Subject: node: fix device cleanups in error handling code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4ce535ec0084f0d712317cb99d383cad3288e713 ]
+
+We can't use kfree() to free device managed resources so the kfree(dev)
+is against the rules.
+
+It's easier to write this code if we open code the device_register() as
+a device_initialize() and device_add(). That way if dev_set_name() set
+name fails we can call put_device() and it will clean up correctly.
+
+Fixes: acc02a109b04 ("node: Add memory-side caching attributes")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YHA0JUra+F64+NpB@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index f449dbb2c746..2c36f61d30bc 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -268,21 +268,20 @@ static void node_init_cache_dev(struct node *node)
+ if (!dev)
+ return;
+
++ device_initialize(dev);
+ dev->parent = &node->dev;
+ dev->release = node_cache_release;
+ if (dev_set_name(dev, "memory_side_cache"))
+- goto free_dev;
++ goto put_device;
+
+- if (device_register(dev))
+- goto free_name;
++ if (device_add(dev))
++ goto put_device;
+
+ pm_runtime_no_callbacks(dev);
+ node->cache_dev = dev;
+ return;
+-free_name:
+- kfree_const(dev->kobj.name);
+-free_dev:
+- kfree(dev);
++put_device:
++ put_device(dev);
+ }
+
+ /**
+@@ -319,25 +318,24 @@ void node_add_cache(unsigned int nid, struct node_cache_attrs *cache_attrs)
+ return;
+
+ dev = &info->dev;
++ device_initialize(dev);
+ dev->parent = node->cache_dev;
+ dev->release = node_cacheinfo_release;
+ dev->groups = cache_groups;
+ if (dev_set_name(dev, "index%d", cache_attrs->level))
+- goto free_cache;
++ goto put_device;
+
+ info->cache_attrs = *cache_attrs;
+- if (device_register(dev)) {
++ if (device_add(dev)) {
+ dev_warn(&node->dev, "failed to add cache level:%d\n",
+ cache_attrs->level);
+- goto free_name;
++ goto put_device;
+ }
+ pm_runtime_no_callbacks(dev);
+ list_add_tail(&info->node, &node->cache_attrs);
+ return;
+-free_name:
+- kfree_const(dev->kobj.name);
+-free_cache:
+- kfree(info);
++put_device:
++ put_device(dev);
+ }
+
+ static void node_remove_caches(struct node *node)
+--
+2.30.2
+
--- /dev/null
+From 3667c6568c471c86c0781534466b601e0b4d9ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 20:12:55 +0200
+Subject: nvme-pci: don't simple map sgl when sgls are disabled
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit e51183be1fa96dc6d3cd11b3c25a0f595807315e ]
+
+According to the module parameter description for sgl_threshold,
+a value of 0 means that SGLs are disabled.
+
+If SGLs are disabled, we should respect that, even for the case
+where the request is made up of a single physical segment.
+
+Fixes: 297910571f08 ("nvme-pci: optimize mapping single segment requests using SGLs")
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 7249ae74f71f..c92a15c3fbc5 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -852,7 +852,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
+ return nvme_setup_prp_simple(dev, req,
+ &cmnd->rw, &bv);
+
+- if (iod->nvmeq->qid &&
++ if (iod->nvmeq->qid && sgl_threshold &&
+ dev->ctrl.sgls & ((1 << 0) | (1 << 1)))
+ return nvme_setup_sgl_simple(dev, req,
+ &cmnd->rw, &bv);
+--
+2.30.2
+
--- /dev/null
+From da0870f7e5338ae4465a509083ee60ec69ad910d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 16:29:01 +0100
+Subject: nvme: retrigger ANA log update if group descriptor isn't found
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit dd8f7fa908f66dd44abcd83cbb50410524b9f8ef ]
+
+If ANA is enabled but no ANA group descriptor is found when creating
+a new namespace the ANA log is most likely out of date, so trigger
+a re-read. The namespace will be tagged with the NS_ANA_PENDING flag
+to exclude it from path selection until the ANA log has been re-read.
+
+Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems")
+Reported-by: Martin George <marting@netapp.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index a1d476e1ac02..ec1e454848e5 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -668,6 +668,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ if (desc.state) {
+ /* found the group desc: update */
+ nvme_update_ns_ana_state(&desc, ns);
++ } else {
++ /* group desc not found: trigger a re-read */
++ set_bit(NVME_NS_ANA_PENDING, &ns->flags);
++ queue_work(nvme_wq, &ns->ctrl->ana_work);
+ }
+ } else {
+ ns->ana_state = NVME_ANA_OPTIMIZED;
+--
+2.30.2
+
--- /dev/null
+From 2b4d6dd5e19c42b4877add7b07fa7f9d50c24f4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 00:08:48 -0700
+Subject: nvme-tcp: block BH in sk state_change sk callback
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 8b73b45d54a14588f86792869bfb23098ea254cb ]
+
+The TCP stack can run from process context for a long time
+so we should disable BH here.
+
+Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index a0f00cb8f9f3..d7d7c81d0701 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -874,7 +874,7 @@ static void nvme_tcp_state_change(struct sock *sk)
+ {
+ struct nvme_tcp_queue *queue;
+
+- read_lock(&sk->sk_callback_lock);
++ read_lock_bh(&sk->sk_callback_lock);
+ queue = sk->sk_user_data;
+ if (!queue)
+ goto done;
+@@ -895,7 +895,7 @@ static void nvme_tcp_state_change(struct sock *sk)
+
+ queue->state_change(sk);
+ done:
+- read_unlock(&sk->sk_callback_lock);
++ read_unlock_bh(&sk->sk_callback_lock);
+ }
+
+ static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
+--
+2.30.2
+
--- /dev/null
+From a34f85fa85932033218fe36cbcc371582fa1d388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 12:12:39 +0100
+Subject: nvmem: rmem: fix undefined reference to memremap
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit cc1bc56fdc76a55bb8fae9a145a2e60bf22fb129 ]
+
+Fix below error reporte by kernel test robot
+rmem.c:(.text+0x14e): undefined reference to memremap
+s390x-linux-gnu-ld: rmem.c:(.text+0x1b6): undefined reference to memunmap
+
+Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem")
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210330111241.19401-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvmem/Kconfig b/drivers/nvmem/Kconfig
+index 75d2594c16e1..267a0d9e99ba 100644
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -272,6 +272,7 @@ config SPRD_EFUSE
+
+ config NVMEM_RMEM
+ tristate "Reserved Memory Based Driver Support"
++ depends on HAS_IOMEM
+ help
+ This driver maps reserved memory into an nvmem device. It might be
+ useful to expose information left by firmware in memory.
+--
+2.30.2
+
--- /dev/null
+From 8042807e22cea839af5aded9c89329e5099ef6e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 17:13:14 +0800
+Subject: nvmet-tcp: fix a segmentation fault during io parsing error
+
+From: Elad Grupi <elad.grupi@dell.com>
+
+[ Upstream commit bdaf13279192c60b2b1fc99badef53b494fec055 ]
+
+In case there is an io that contains inline data and it goes to
+parsing error flow, command response will free command and iov
+before clearing the data on the socket buffer.
+This will delay the command response until receive flow is completed.
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Signed-off-by: Elad Grupi <elad.grupi@dell.com>
+Signed-off-by: Hou Pu <houpu.main@gmail.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 39 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 218fd766dc74..d958b5da9b88 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -525,11 +525,36 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)
+ struct nvmet_tcp_cmd *cmd =
+ container_of(req, struct nvmet_tcp_cmd, req);
+ struct nvmet_tcp_queue *queue = cmd->queue;
++ struct nvme_sgl_desc *sgl;
++ u32 len;
++
++ if (unlikely(cmd == queue->cmd)) {
++ sgl = &cmd->req.cmd->common.dptr.sgl;
++ len = le32_to_cpu(sgl->length);
++
++ /*
++ * Wait for inline data before processing the response.
++ * Avoid using helpers, this might happen before
++ * nvmet_req_init is completed.
++ */
++ if (queue->rcv_state == NVMET_TCP_RECV_PDU &&
++ len && len < cmd->req.port->inline_data_size &&
++ nvme_is_write(cmd->req.cmd))
++ return;
++ }
+
+ llist_add(&cmd->lentry, &queue->resp_list);
+ queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &cmd->queue->io_work);
+ }
+
++static void nvmet_tcp_execute_request(struct nvmet_tcp_cmd *cmd)
++{
++ if (unlikely(cmd->flags & NVMET_TCP_F_INIT_FAILED))
++ nvmet_tcp_queue_response(&cmd->req);
++ else
++ cmd->req.execute(&cmd->req);
++}
++
+ static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd)
+ {
+ u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
+@@ -961,7 +986,7 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue)
+ le32_to_cpu(req->cmd->common.dptr.sgl.length));
+
+ nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
+- return -EAGAIN;
++ return 0;
+ }
+
+ ret = nvmet_tcp_map_data(queue->cmd);
+@@ -1104,10 +1129,8 @@ static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue)
+ return 0;
+ }
+
+- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) &&
+- cmd->rbytes_done == cmd->req.transfer_len) {
+- cmd->req.execute(&cmd->req);
+- }
++ if (cmd->rbytes_done == cmd->req.transfer_len)
++ nvmet_tcp_execute_request(cmd);
+
+ nvmet_prepare_receive_pdu(queue);
+ return 0;
+@@ -1144,9 +1167,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
+ goto out;
+ }
+
+- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) &&
+- cmd->rbytes_done == cmd->req.transfer_len)
+- cmd->req.execute(&cmd->req);
++ if (cmd->rbytes_done == cmd->req.transfer_len)
++ nvmet_tcp_execute_request(cmd);
++
+ ret = 0;
+ out:
+ nvmet_prepare_receive_pdu(queue);
+--
+2.30.2
+
--- /dev/null
+From 286d6258ca2cded15a63ed6ffb740ac1f4410432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 00:08:49 -0700
+Subject: nvmet-tcp: fix incorrect locking in state_change sk callback
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit b5332a9f3f3d884a1b646ce155e664cc558c1722 ]
+
+We are not changing anything in the TCP connection state so
+we should not take a write_lock but rather a read lock.
+
+This caused a deadlock when running nvmet-tcp and nvme-tcp
+on the same system, where state_change callbacks on the
+host and on the controller side have causal relationship
+and made lockdep report on this with blktests:
+
+================================
+WARNING: inconsistent lock state
+5.12.0-rc3 #1 Tainted: G I
+--------------------------------
+inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-R} usage.
+nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+{IN-SOFTIRQ-W} state was registered at:
+ __lock_acquire+0x79b/0x18d0
+ lock_acquire+0x1ca/0x480
+ _raw_write_lock_bh+0x39/0x80
+ nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp]
+ tcp_fin+0x2a8/0x780
+ tcp_data_queue+0xf94/0x1f20
+ tcp_rcv_established+0x6ba/0x1f00
+ tcp_v4_do_rcv+0x502/0x760
+ tcp_v4_rcv+0x257e/0x3430
+ ip_protocol_deliver_rcu+0x69/0x6a0
+ ip_local_deliver_finish+0x1e2/0x2f0
+ ip_local_deliver+0x1a2/0x420
+ ip_rcv+0x4fb/0x6b0
+ __netif_receive_skb_one_core+0x162/0x1b0
+ process_backlog+0x1ff/0x770
+ __napi_poll.constprop.0+0xa9/0x5c0
+ net_rx_action+0x7b3/0xb30
+ __do_softirq+0x1f0/0x940
+ do_softirq+0xa1/0xd0
+ __local_bh_enable_ip+0xd8/0x100
+ ip_finish_output2+0x6b7/0x18a0
+ __ip_queue_xmit+0x706/0x1aa0
+ __tcp_transmit_skb+0x2068/0x2e20
+ tcp_write_xmit+0xc9e/0x2bb0
+ __tcp_push_pending_frames+0x92/0x310
+ inet_shutdown+0x158/0x300
+ __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
+ nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
+ nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
+ nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
+ nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
+ kernfs_fop_write_iter+0x2c7/0x460
+ new_sync_write+0x36c/0x610
+ vfs_write+0x5c0/0x870
+ ksys_write+0xf9/0x1d0
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+irq event stamp: 10687
+hardirqs last enabled at (10687): [<ffffffff9ec376bd>] _raw_spin_unlock_irqrestore+0x2d/0x40
+hardirqs last disabled at (10686): [<ffffffff9ec374d8>] _raw_spin_lock_irqsave+0x68/0x90
+softirqs last enabled at (10684): [<ffffffff9f000608>] __do_softirq+0x608/0x940
+softirqs last disabled at (10649): [<ffffffff9cdedd31>] do_softirq+0xa1/0xd0
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(clock-AF_INET);
+ <Interrupt>
+ lock(clock-AF_INET);
+
+ *** DEADLOCK ***
+
+5 locks held by nvme/1324:
+ #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0
+ #1: ffff8886e435c090 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460
+ #2: ffff888104d90c38 (kn->active#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330
+ #3: ffff8884634538d0 (&queue->queue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp]
+ #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300
+
+stack backtrace:
+CPU: 26 PID: 1324 Comm: nvme Tainted: G I 5.12.0-rc3 #1
+Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020
+Call Trace:
+ dump_stack+0x93/0xc2
+ mark_lock_irq.cold+0x2c/0xb3
+ ? verify_lock_unused+0x390/0x390
+ ? stack_trace_consume_entry+0x160/0x160
+ ? lock_downgrade+0x100/0x100
+ ? save_trace+0x88/0x5e0
+ ? _raw_spin_unlock_irqrestore+0x2d/0x40
+ mark_lock+0x530/0x1470
+ ? mark_lock_irq+0x1d10/0x1d10
+ ? enqueue_timer+0x660/0x660
+ mark_usage+0x215/0x2a0
+ __lock_acquire+0x79b/0x18d0
+ ? tcp_schedule_loss_probe.part.0+0x38c/0x520
+ lock_acquire+0x1ca/0x480
+ ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ ? rcu_read_unlock+0x40/0x40
+ ? tcp_mtu_probe+0x1ae0/0x1ae0
+ ? kmalloc_reserve+0xa0/0xa0
+ ? sysfs_file_ops+0x170/0x170
+ _raw_read_lock+0x3d/0xa0
+ ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ ? sysfs_file_ops+0x170/0x170
+ inet_shutdown+0x189/0x300
+ __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
+ nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
+ nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
+ nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
+ nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
+ kernfs_fop_write_iter+0x2c7/0x460
+ new_sync_write+0x36c/0x610
+ ? new_sync_read+0x600/0x600
+ ? lock_acquire+0x1ca/0x480
+ ? rcu_read_unlock+0x40/0x40
+ ? lock_is_held_type+0x9a/0x110
+ vfs_write+0x5c0/0x870
+ ksys_write+0xf9/0x1d0
+ ? __ia32_sys_read+0xa0/0xa0
+ ? lockdep_hardirqs_on_prepare.part.0+0x198/0x340
+ ? syscall_enter_from_user_mode+0x27/0x70
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index d658c6e8263a..218fd766dc74 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1434,7 +1434,7 @@ static void nvmet_tcp_state_change(struct sock *sk)
+ {
+ struct nvmet_tcp_queue *queue;
+
+- write_lock_bh(&sk->sk_callback_lock);
++ read_lock_bh(&sk->sk_callback_lock);
+ queue = sk->sk_user_data;
+ if (!queue)
+ goto done;
+@@ -1452,7 +1452,7 @@ static void nvmet_tcp_state_change(struct sock *sk)
+ queue->idx, sk->sk_state);
+ }
+ done:
+- write_unlock_bh(&sk->sk_callback_lock);
++ read_unlock_bh(&sk->sk_callback_lock);
+ }
+
+ static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
+--
+2.30.2
+
--- /dev/null
+From ac8a26ba69fa889cd43be6673205015d8bfc106b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 19:21:39 +0100
+Subject: of: overlay: fix for_each_child.cocci warnings
+
+From: kernel test robot <lkp@intel.com>
+
+[ Upstream commit c4d74f0f978ed5ceee62cd3f6708081042e582a1 ]
+
+Function "for_each_child_of_node" should have of_node_put() before goto.
+
+Generated by: scripts/coccinelle/iterators/for_each_child.cocci
+
+Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script")
+CC: Sumera Priyadarsini <sylphrenadin@gmail.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Tested-by: Frank Rowand <frank.rowand@sony.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2103221918450.2918@hadrien
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/overlay.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 23effe5e50ec..2d132949572d 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -796,6 +796,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
+ if (!fragment->target) {
+ of_node_put(fragment->overlay);
+ ret = -EINVAL;
++ of_node_put(node);
+ goto err_free_fragments;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 8e75d52f4861607c41069a9dcc8f4c548878795f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Apr 2021 12:22:23 +0300
+Subject: ovl: invalidate readdir cache on changes to dir with origin
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 65cd913ec9d9d71529665924c81015b7ab7d9381 ]
+
+The test in ovl_dentry_version_inc() was out-dated and did not include
+the case where readdir cache is used on a non-merge dir that has origin
+xattr, indicating that it may contain leftover whiteouts.
+
+To make the code more robust, use the same helper ovl_dir_is_real()
+to determine if readdir cache should be used and if readdir cache should
+be invalidated.
+
+Fixes: b79e05aaa166 ("ovl: no direct iteration for dir with origin xattr")
+Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxht70nODhNHNwGFMSqDyOKLXOKrY0H6g849os4BQ7cokA@mail.gmail.com/
+Cc: Chris Murphy <lists@colorremedies.com>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/overlayfs.h | 30 +++++++++++++++++++++++++++---
+ fs/overlayfs/readdir.c | 12 ------------
+ fs/overlayfs/util.c | 31 +++++++++----------------------
+ 3 files changed, 36 insertions(+), 37 deletions(-)
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 95cff83786a5..2322f854533c 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -319,9 +319,6 @@ int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry,
+ enum ovl_xattr ox, const void *value, size_t size,
+ int xerr);
+ int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+-void ovl_set_flag(unsigned long flag, struct inode *inode);
+-void ovl_clear_flag(unsigned long flag, struct inode *inode);
+-bool ovl_test_flag(unsigned long flag, struct inode *inode);
+ bool ovl_inuse_trylock(struct dentry *dentry);
+ void ovl_inuse_unlock(struct dentry *dentry);
+ bool ovl_is_inuse(struct dentry *dentry);
+@@ -335,6 +332,21 @@ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry,
+ int padding);
+ int ovl_sync_status(struct ovl_fs *ofs);
+
++static inline void ovl_set_flag(unsigned long flag, struct inode *inode)
++{
++ set_bit(flag, &OVL_I(inode)->flags);
++}
++
++static inline void ovl_clear_flag(unsigned long flag, struct inode *inode)
++{
++ clear_bit(flag, &OVL_I(inode)->flags);
++}
++
++static inline bool ovl_test_flag(unsigned long flag, struct inode *inode)
++{
++ return test_bit(flag, &OVL_I(inode)->flags);
++}
++
+ static inline bool ovl_is_impuredir(struct super_block *sb,
+ struct dentry *dentry)
+ {
+@@ -439,6 +451,18 @@ int ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+ struct dentry *dentry, int level);
+ int ovl_indexdir_cleanup(struct ovl_fs *ofs);
+
++/*
++ * Can we iterate real dir directly?
++ *
++ * Non-merge dir may contain whiteouts from a time it was a merge upper, before
++ * lower dir was removed under it and possibly before it was rotated from upper
++ * to lower layer.
++ */
++static inline bool ovl_dir_is_real(struct dentry *dir)
++{
++ return !ovl_test_flag(OVL_WHITEOUTS, d_inode(dir));
++}
++
+ /* inode.c */
+ int ovl_set_nlink_upper(struct dentry *dentry);
+ int ovl_set_nlink_lower(struct dentry *dentry);
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index f404a78e6b60..cc1e80257064 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -319,18 +319,6 @@ static inline int ovl_dir_read(struct path *realpath,
+ return err;
+ }
+
+-/*
+- * Can we iterate real dir directly?
+- *
+- * Non-merge dir may contain whiteouts from a time it was a merge upper, before
+- * lower dir was removed under it and possibly before it was rotated from upper
+- * to lower layer.
+- */
+-static bool ovl_dir_is_real(struct dentry *dir)
+-{
+- return !ovl_test_flag(OVL_WHITEOUTS, d_inode(dir));
+-}
+-
+ static void ovl_dir_reset(struct file *file)
+ {
+ struct ovl_dir_file *od = file->private_data;
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index 7f5a01a11f97..404a0a32ddf6 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -422,18 +422,20 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry)
+ }
+ }
+
+-static void ovl_dentry_version_inc(struct dentry *dentry, bool impurity)
++static void ovl_dir_version_inc(struct dentry *dentry, bool impurity)
+ {
+ struct inode *inode = d_inode(dentry);
+
+ WARN_ON(!inode_is_locked(inode));
++ WARN_ON(!d_is_dir(dentry));
+ /*
+- * Version is used by readdir code to keep cache consistent. For merge
+- * dirs all changes need to be noted. For non-merge dirs, cache only
+- * contains impure (ones which have been copied up and have origins)
+- * entries, so only need to note changes to impure entries.
++ * Version is used by readdir code to keep cache consistent.
++ * For merge dirs (or dirs with origin) all changes need to be noted.
++ * For non-merge dirs, cache contains only impure entries (i.e. ones
++ * which have been copied up and have origins), so only need to note
++ * changes to impure entries.
+ */
+- if (OVL_TYPE_MERGE(ovl_path_type(dentry)) || impurity)
++ if (!ovl_dir_is_real(dentry) || impurity)
+ OVL_I(inode)->version++;
+ }
+
+@@ -442,7 +444,7 @@ void ovl_dir_modified(struct dentry *dentry, bool impurity)
+ /* Copy mtime/ctime */
+ ovl_copyattr(d_inode(ovl_dentry_upper(dentry)), d_inode(dentry));
+
+- ovl_dentry_version_inc(dentry, impurity);
++ ovl_dir_version_inc(dentry, impurity);
+ }
+
+ u64 ovl_dentry_version_get(struct dentry *dentry)
+@@ -638,21 +640,6 @@ int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry)
+ return err;
+ }
+
+-void ovl_set_flag(unsigned long flag, struct inode *inode)
+-{
+- set_bit(flag, &OVL_I(inode)->flags);
+-}
+-
+-void ovl_clear_flag(unsigned long flag, struct inode *inode)
+-{
+- clear_bit(flag, &OVL_I(inode)->flags);
+-}
+-
+-bool ovl_test_flag(unsigned long flag, struct inode *inode)
+-{
+- return test_bit(flag, &OVL_I(inode)->flags);
+-}
+-
+ /**
+ * Caller must hold a reference to inode to prevent it from being freed while
+ * it is marked inuse.
+--
+2.30.2
+
--- /dev/null
+From d00415201d57e5e4dbb26b4e270483073e8afeee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:45:15 +0100
+Subject: ovl: show "userxattr" in the mount data
+
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+
+[ Upstream commit 321b46b904816241044e177c1d6282ad20f17416 ]
+
+This was missed when adding the option.
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
+Fixes: 2d2f2d7322ff ("ovl: user xattr")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 8cf343335029..787ce7c38fba 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -380,6 +380,8 @@ static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
+ ofs->config.metacopy ? "on" : "off");
+ if (ofs->config.ovl_volatile)
+ seq_puts(m, ",volatile");
++ if (ofs->config.userxattr)
++ seq_puts(m, ",userxattr");
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From b4f3f07894c1070bc7fe99cd579e1c3c13dcbf6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 23:50:24 +0300
+Subject: pata_arasan_cf: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ]
+
+The driver's probe() method is written as if platform_get_irq() returns 0
+on error, while actually it returns a negative error code (with all the
+other values considered valid IRQs). Rewrite the driver's IRQ checking code
+to pass the positive IRQ #s to ata_host_activate(), propagate upstream
+-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors
+and IRQ0 (libata treats IRQ #0 as a polling mode anyway)...
+
+Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_arasan_cf.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
+index e9cf31f38450..63f39440a9b4 100644
+--- a/drivers/ata/pata_arasan_cf.c
++++ b/drivers/ata/pata_arasan_cf.c
+@@ -818,12 +818,19 @@ static int arasan_cf_probe(struct platform_device *pdev)
+ else
+ quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */
+
+- /* if irq is 0, support only PIO */
+- acdev->irq = platform_get_irq(pdev, 0);
+- if (acdev->irq)
++ /*
++ * If there's an error getting IRQ (or we do get IRQ0),
++ * support only PIO
++ */
++ ret = platform_get_irq(pdev, 0);
++ if (ret > 0) {
++ acdev->irq = ret;
+ irq_handler = arasan_cf_interrupt;
+- else
++ } else if (ret == -EPROBE_DEFER) {
++ return ret;
++ } else {
+ quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA;
++ }
+
+ acdev->pbase = res->start;
+ acdev->vbase = devm_ioremap(&pdev->dev, res->start,
+--
+2.30.2
+
--- /dev/null
+From 26b64c095eb42f4a31a9ae4d9dc80a65278fe0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 23:51:10 +0300
+Subject: pata_ipx4xx_cf: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ]
+
+The driver's probe() method is written as if platform_get_irq() returns 0
+on error, while actually it returns a negative error code (with all the
+other values considered valid IRQs). Rewrite the driver's IRQ checking
+code to pass the positive IRQ #s to ata_host_activate(), propagate errors
+upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code
+treats 0 as an indication that polling should be used anyway...
+
+Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_ixp4xx_cf.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
+index d1644a8ef9fa..abc0e87ca1a8 100644
+--- a/drivers/ata/pata_ixp4xx_cf.c
++++ b/drivers/ata/pata_ixp4xx_cf.c
+@@ -165,8 +165,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq)
++ if (irq > 0)
+ irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING);
++ else if (irq < 0)
++ return irq;
++ else
++ return -EINVAL;
+
+ /* Setup expansion bus chip selects */
+ *data->cs0_cfg = data->cs0_bits;
+--
+2.30.2
+
--- /dev/null
+From f822c16c5d28cda5361d96288737bef89ea069cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 17:11:12 -0700
+Subject: perf/amd/uncore: Fix sysfs type mismatch
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 5deac80d4571dffb51f452f0027979d72259a1b9 ]
+
+dev_attr_show() calls the __uncore_*_show() functions via an indirect
+call but their type does not currently match the type of the show()
+member in 'struct device_attribute', resulting in a Control Flow
+Integrity violation.
+
+$ cat /sys/devices/amd_l3/format/umask
+config:8-15
+
+$ dmesg | grep "CFI failure"
+[ 1258.174653] CFI failure (target: __uncore_umask_show...):
+
+Update the type in the DEFINE_UNCORE_FORMAT_ATTR macro to match
+'struct device_attribute' so that there is no more CFI violation.
+
+Fixes: 06f2c24584f3 ("perf/amd/uncore: Prepare to scale for more attributes that vary per family")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210415001112.3024673-2-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/uncore.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
+index 7f014d450bc2..582c0ffb5e98 100644
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -275,14 +275,14 @@ static struct attribute_group amd_uncore_attr_group = {
+ };
+
+ #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
++static ssize_t __uncore_##_var##_show(struct device *dev, \
++ struct device_attribute *attr, \
+ char *page) \
+ { \
+ BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+ return sprintf(page, _format "\n"); \
+ } \
+-static struct kobj_attribute format_attr_##_var = \
++static struct device_attribute format_attr_##_var = \
+ __ATTR(_name, 0444, __uncore_##_var##_show, NULL)
+
+ DEFINE_UNCORE_FORMAT_ATTR(event12, event, "config:0-7,32-35");
+--
+2.30.2
+
--- /dev/null
+From 98dbcb4751fc278c66fe1c39f46f651fec8788fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 21:27:23 +0300
+Subject: perf beauty: Fix fsconfig generator
+
+From: Vitaly Chikunov <vt@altlinux.org>
+
+[ Upstream commit 2e1daee14e67fbf9b27280b974e2c680a22cabea ]
+
+After gnulib update sed stopped matching `[[:space:]]*+' as before,
+causing the following compilation error:
+
+ In file included from builtin-trace.c:719:
+ trace/beauty/generated/fsconfig_arrays.c:2:3: error: expected expression before ']' token
+ 2 | [] = "",
+ | ^
+ trace/beauty/generated/fsconfig_arrays.c:2:3: error: array index in initializer not of integer type
+ trace/beauty/generated/fsconfig_arrays.c:2:3: note: (near initialization for 'fsconfig_cmds')
+
+Fix this by correcting the regular expression used in the generator.
+Also, clean up the script by removing redundant egrep, xargs, and printf
+invocations.
+
+Committer testing:
+
+Continues to work:
+
+ $ cat tools/perf/trace/beauty/fsconfig.sh
+ #!/bin/sh
+ # SPDX-License-Identifier: LGPL-2.1
+
+ if [ $# -ne 1 ] ; then
+ linux_header_dir=tools/include/uapi/linux
+ else
+ linux_header_dir=$1
+ fi
+
+ linux_mount=${linux_header_dir}/mount.h
+
+ printf "static const char *fsconfig_cmds[] = {\n"
+ ms='[[:space:]]*'
+ sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
+ ${linux_mount}
+ printf "};\n"
+ $ tools/perf/trace/beauty/fsconfig.sh
+ static const char *fsconfig_cmds[] = {
+ [0] = "SET_FLAG",
+ [1] = "SET_STRING",
+ [2] = "SET_BINARY",
+ [3] = "SET_PATH",
+ [4] = "SET_PATH_EMPTY",
+ [5] = "SET_FD",
+ [6] = "CMD_CREATE",
+ [7] = "CMD_RECONFIGURE",
+ };
+ $
+
+Fixes: d35293004a5e4 ("perf beauty: Add generator for fsconfig's 'cmd' arg values")
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: http://lore.kernel.org/lkml/20210414182723.1670663-1-vt@altlinux.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/trace/beauty/fsconfig.sh | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/trace/beauty/fsconfig.sh b/tools/perf/trace/beauty/fsconfig.sh
+index 83fb24df05c9..bc6ef7bb7a5f 100755
+--- a/tools/perf/trace/beauty/fsconfig.sh
++++ b/tools/perf/trace/beauty/fsconfig.sh
+@@ -10,8 +10,7 @@ fi
+ linux_mount=${linux_header_dir}/mount.h
+
+ printf "static const char *fsconfig_cmds[] = {\n"
+-regex='^[[:space:]]*+FSCONFIG_([[:alnum:]_]+)[[:space:]]*=[[:space:]]*([[:digit:]]+)[[:space:]]*,[[:space:]]*.*'
+-egrep $regex ${linux_mount} | \
+- sed -r "s/$regex/\2 \1/g" | \
+- xargs printf "\t[%s] = \"%s\",\n"
++ms='[[:space:]]*'
++sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
++ ${linux_mount}
+ printf "};\n"
+--
+2.30.2
+
--- /dev/null
+From 5a7727da45b3aa3f305f0512ec5e3dfe62b62779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 20:09:13 +0800
+Subject: perf jit: Let convert_timestamp() to be backwards-compatible
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit aa616f5a8a2d22a179d5502ebd85045af66fa656 ]
+
+Commit d110162cafc80dad ("perf tsc: Support cap_user_time_short for
+event TIME_CONV") supports the extended parameters for event TIME_CONV,
+but it broke the backwards compatibility, so any perf data file with old
+event format fails to convert timestamp.
+
+This patch introduces a helper event_contains() to check if an event
+contains a specific member or not. For the backwards-compatibility, if
+the event size confirms the extended parameters are supported in the
+event TIME_CONV, then copies these parameters.
+
+Committer notes:
+
+To make this compiler backwards compatible add this patch:
+
+ - struct perf_tsc_conversion tc = { 0 };
+ + struct perf_tsc_conversion tc = { .time_shift = 0, };
+
+Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steve MacLean <Steve.MacLean@Microsoft.com>
+Cc: Yonatan Goldschmidt <yonatan.goldschmidt@granulate.io>
+Link: https://lore.kernel.org/r/20210428120915.7123-3-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 2 ++
+ tools/perf/util/jitdump.c | 30 +++++++++++++++++++----------
+ 2 files changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index 48583e441d9b..4d0c02ba3f7d 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -8,6 +8,8 @@
+ #include <linux/bpf.h>
+ #include <sys/types.h> /* pid_t */
+
++#define event_contains(obj, mem) ((obj).header.size > offsetof(typeof(obj), mem))
++
+ struct perf_record_mmap {
+ struct perf_event_header header;
+ __u32 pid, tid;
+diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
+index 9760d8e7b386..917a9c707371 100644
+--- a/tools/perf/util/jitdump.c
++++ b/tools/perf/util/jitdump.c
+@@ -396,21 +396,31 @@ static pid_t jr_entry_tid(struct jit_buf_desc *jd, union jr_entry *jr)
+
+ static uint64_t convert_timestamp(struct jit_buf_desc *jd, uint64_t timestamp)
+ {
+- struct perf_tsc_conversion tc;
++ struct perf_tsc_conversion tc = { .time_shift = 0, };
++ struct perf_record_time_conv *time_conv = &jd->session->time_conv;
+
+ if (!jd->use_arch_timestamp)
+ return timestamp;
+
+- tc.time_shift = jd->session->time_conv.time_shift;
+- tc.time_mult = jd->session->time_conv.time_mult;
+- tc.time_zero = jd->session->time_conv.time_zero;
+- tc.time_cycles = jd->session->time_conv.time_cycles;
+- tc.time_mask = jd->session->time_conv.time_mask;
+- tc.cap_user_time_zero = jd->session->time_conv.cap_user_time_zero;
+- tc.cap_user_time_short = jd->session->time_conv.cap_user_time_short;
++ tc.time_shift = time_conv->time_shift;
++ tc.time_mult = time_conv->time_mult;
++ tc.time_zero = time_conv->time_zero;
+
+- if (!tc.cap_user_time_zero)
+- return 0;
++ /*
++ * The event TIME_CONV was extended for the fields from "time_cycles"
++ * when supported cap_user_time_short, for backward compatibility,
++ * checks the event size and assigns these extended fields if these
++ * fields are contained in the event.
++ */
++ if (event_contains(*time_conv, time_cycles)) {
++ tc.time_cycles = time_conv->time_cycles;
++ tc.time_mask = time_conv->time_mask;
++ tc.cap_user_time_zero = time_conv->cap_user_time_zero;
++ tc.cap_user_time_short = time_conv->cap_user_time_short;
++
++ if (!tc.cap_user_time_zero)
++ return 0;
++ }
+
+ return tsc_to_perf_time(timestamp, &tc);
+ }
+--
+2.30.2
+
--- /dev/null
+From 5aa32cfe6576bfc99f6e3ae752e95fe37cb41111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 20:09:14 +0800
+Subject: perf session: Add swap operation for event TIME_CONV
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit 050ffc449008eeeafc187dec337d9cf1518f89bc ]
+
+Since commit d110162cafc8 ("perf tsc: Support cap_user_time_short for
+event TIME_CONV"), the event PERF_RECORD_TIME_CONV has extended the data
+structure for clock parameters.
+
+To be backwards-compatible, this patch adds a dedicated swap operation
+for the event PERF_RECORD_TIME_CONV, based on checking if the event
+contains field "time_cycles", it can support both for the old and new
+event formats.
+
+Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steve MacLean <Steve.MacLean@Microsoft.com>
+Cc: Yonatan Goldschmidt <yonatan.goldschmidt@granulate.io>
+Link: https://lore.kernel.org/r/20210428120915.7123-4-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 859832a82496..e9d4e6f4bdf3 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -949,6 +949,19 @@ static void perf_event__stat_round_swap(union perf_event *event,
+ event->stat_round.time = bswap_64(event->stat_round.time);
+ }
+
++static void perf_event__time_conv_swap(union perf_event *event,
++ bool sample_id_all __maybe_unused)
++{
++ event->time_conv.time_shift = bswap_64(event->time_conv.time_shift);
++ event->time_conv.time_mult = bswap_64(event->time_conv.time_mult);
++ event->time_conv.time_zero = bswap_64(event->time_conv.time_zero);
++
++ if (event_contains(event->time_conv, time_cycles)) {
++ event->time_conv.time_cycles = bswap_64(event->time_conv.time_cycles);
++ event->time_conv.time_mask = bswap_64(event->time_conv.time_mask);
++ }
++}
++
+ typedef void (*perf_event__swap_op)(union perf_event *event,
+ bool sample_id_all);
+
+@@ -985,7 +998,7 @@ static perf_event__swap_op perf_event__swap_ops[] = {
+ [PERF_RECORD_STAT] = perf_event__stat_swap,
+ [PERF_RECORD_STAT_ROUND] = perf_event__stat_round_swap,
+ [PERF_RECORD_EVENT_UPDATE] = perf_event__event_update_swap,
+- [PERF_RECORD_TIME_CONV] = perf_event__all64_swap,
++ [PERF_RECORD_TIME_CONV] = perf_event__time_conv_swap,
+ [PERF_RECORD_HEADER_MAX] = NULL,
+ };
+
+--
+2.30.2
+
--- /dev/null
+From c791bb1f22686661c15a239500421ee974b15512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:17:51 -0300
+Subject: perf symbols: Fix dso__fprintf_symbols_by_name() to return the number
+ of printed chars
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 210e4c89ef61432040c6cd828fefa441f4887186 ]
+
+The 'ret' variable was initialized to zero but then it was not updated
+from the fprintf() return, fix it.
+
+Reported-by: Yang Li <yang.lee@linux.alibaba.com>
+cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+cc: Ingo Molnar <mingo@redhat.com>
+cc: Jiri Olsa <jolsa@redhat.com>
+cc: Mark Rutland <mark.rutland@arm.com>
+cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Fixes: 90f18e63fbd00513 ("perf symbols: List symbols in a dso in ascending name order")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol_fprintf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c
+index 35c936ce33ef..2664fb65e47a 100644
+--- a/tools/perf/util/symbol_fprintf.c
++++ b/tools/perf/util/symbol_fprintf.c
+@@ -68,7 +68,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso,
+
+ for (nd = rb_first_cached(&dso->symbol_names); nd; nd = rb_next(nd)) {
+ pos = rb_entry(nd, struct symbol_name_rb_node, rb_node);
+- fprintf(fp, "%s\n", pos->sym.name);
++ ret += fprintf(fp, "%s\n", pos->sym.name);
+ }
+
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From b6efe06f5f80f22d7b70c39fddd42d8db7488362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 20:09:12 +0800
+Subject: perf tools: Change fields type in perf_record_time_conv
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit e1d380ea8b00db4bb14d1f513000d4b62aa9d3f0 ]
+
+C standard claims "An object declared as type _Bool is large enough to
+store the values 0 and 1", bool type size can be 1 byte or larger than
+1 byte. Thus it's uncertian for bool type size with different
+compilers.
+
+This patch changes the bool type in structure perf_record_time_conv to
+__u8 type, and pads extra bytes for 8-byte alignment; this can give
+reliable structure size.
+
+Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV")
+Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steve MacLean <Steve.MacLean@Microsoft.com>
+Cc: Yonatan Goldschmidt <yonatan.goldschmidt@granulate.io>
+Link: https://lore.kernel.org/r/20210428120915.7123-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index d82054225fcc..48583e441d9b 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -346,8 +346,9 @@ struct perf_record_time_conv {
+ __u64 time_zero;
+ __u64 time_cycles;
+ __u64 time_mask;
+- bool cap_user_time_zero;
+- bool cap_user_time_short;
++ __u8 cap_user_time_zero;
++ __u8 cap_user_time_short;
++ __u8 reserved[6]; /* For alignment */
+ };
+
+ struct perf_record_header_feature {
+--
+2.30.2
+
--- /dev/null
+From f89a3908efc11d859f3f2e4d3c42a7518dd9aa9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 16:59:41 -0500
+Subject: perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
+
+[ Upstream commit 86c2bc3da769124e3e856b6e9457be3667c30919 ]
+
+Commit 08ed77e414ab2342 ("perf vendor events amd: Add recommended events")
+added the hits event "L2 Cache Hits from L2 HWPF" with the same metric
+expression as the accesses event "L2 Cache Accesses from L2 HWPF":
+
+$ perf list --details
+...
+ l2_cache_accesses_from_l2_hwpf
+ [L2 Cache Accesses from L2 HWPF]
+ [l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3]
+ l2_cache_hits_from_l2_hwpf
+ [L2 Cache Hits from L2 HWPF]
+ [l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3]
+...
+
+This was wrong and led to counting hits the same as accesses. Section
+2.1.15.2 "Performance Measurement" of "PPR for AMD Family 17h Model 31h
+B0 - 55803 Rev 0.54 - Sep 12, 2019", documents the hits event with
+EventCode 0x70 which is the same as l2_pf_hit_l2.
+
+Fix this, and massage the description for l2_pf_hit_l2 as the hits event
+is now the duplicate of l2_pf_hit_l2. AMD recommends using the recommended
+event over other events if the duplicate exists and maintain both for
+consistency. Hence, l2_cache_hits_from_l2_hwpf should override
+l2_pf_hit_l2.
+
+Before:
+
+ # perf stat -M l2_cache_accesses_from_l2_hwpf,l2_cache_hits_from_l2_hwpf sleep 1
+
+ Performance counter stats for 'sleep 1':
+
+ 1,436 l2_pf_miss_l2_l3 # 11114.00 l2_cache_accesses_from_l2_hwpf
+ # 11114.00 l2_cache_hits_from_l2_hwpf
+ 4,482 l2_pf_hit_l2
+ 5,196 l2_pf_miss_l2_hit_l3
+
+ 1.001765339 seconds time elapsed
+
+After:
+
+ # perf stat -M l2_cache_accesses_from_l2_hwpf sleep 1
+
+ Performance counter stats for 'sleep 1':
+
+ 1,477 l2_pf_miss_l2_l3 # 10442.00 l2_cache_accesses_from_l2_hwpf
+ 3,978 l2_pf_hit_l2
+ 4,987 l2_pf_miss_l2_hit_l3
+
+ 1.001491186 seconds time elapsed
+
+ # perf stat -e l2_cache_hits_from_l2_hwpf sleep 1
+
+ Performance counter stats for 'sleep 1':
+
+ 3,983 l2_cache_hits_from_l2_hwpf
+
+ 1.001329970 seconds time elapsed
+
+Note the difference in performance counter values for the accesses
+versus the hits after the fix, and the hits event now counting the same
+as l2_pf_hit_l2.
+
+Fixes: 08ed77e414ab ("perf vendor events amd: Add recommended events")
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206537
+Reviewed-by: Robert Richter <rrichter@amd.com>
+Signed-off-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@kernel.org> # On a 3900X
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@amd.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin Liška <mliska@suse.cz>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Vijay Thakkar <vijaythakkar@me.com>
+Cc: linux-perf-users@vger.kernel.org
+Link: https://lore.kernel.org/r/20210406215944.113332-2-Smita.KoralahalliChannabasappa@amd.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/x86/amdzen1/cache.json | 2 +-
+ tools/perf/pmu-events/arch/x86/amdzen1/recommended.json | 6 +++---
+ tools/perf/pmu-events/arch/x86/amdzen2/cache.json | 2 +-
+ tools/perf/pmu-events/arch/x86/amdzen2/recommended.json | 6 +++---
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen1/cache.json b/tools/perf/pmu-events/arch/x86/amdzen1/cache.json
+index 4ea7ec4f496e..008f1683e540 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen1/cache.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen1/cache.json
+@@ -275,7 +275,7 @@
+ {
+ "EventName": "l2_pf_hit_l2",
+ "EventCode": "0x70",
+- "BriefDescription": "L2 prefetch hit in L2.",
++ "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.",
+ "UMask": "0xff"
+ },
+ {
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json b/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json
+index 2cfe2d2f3bfd..3c954543d1ae 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json
+@@ -79,10 +79,10 @@
+ "UMask": "0x70"
+ },
+ {
+- "MetricName": "l2_cache_hits_from_l2_hwpf",
++ "EventName": "l2_cache_hits_from_l2_hwpf",
++ "EventCode": "0x70",
+ "BriefDescription": "L2 Cache Hits from L2 HWPF",
+- "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3",
+- "MetricGroup": "l2_cache"
++ "UMask": "0xff"
+ },
+ {
+ "EventName": "l3_accesses",
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen2/cache.json b/tools/perf/pmu-events/arch/x86/amdzen2/cache.json
+index f61b982f83ca..8ba84a48188d 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen2/cache.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen2/cache.json
+@@ -205,7 +205,7 @@
+ {
+ "EventName": "l2_pf_hit_l2",
+ "EventCode": "0x70",
+- "BriefDescription": "L2 prefetch hit in L2.",
++ "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.",
+ "UMask": "0xff"
+ },
+ {
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json b/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json
+index 2ef91e25e661..1c624cee9ef4 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json
+@@ -79,10 +79,10 @@
+ "UMask": "0x70"
+ },
+ {
+- "MetricName": "l2_cache_hits_from_l2_hwpf",
++ "EventName": "l2_cache_hits_from_l2_hwpf",
++ "EventCode": "0x70",
+ "BriefDescription": "L2 Cache Hits from L2 HWPF",
+- "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3",
+- "MetricGroup": "l2_cache"
++ "UMask": "0xff"
+ },
+ {
+ "EventName": "l3_accesses",
+--
+2.30.2
+
--- /dev/null
+From 8327180bdc7b199cf464fb3c8d8ae56d307dcade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 03:49:33 +0000
+Subject: phy: ingenic: Fix a typo in ingenic_usb_phy_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 446c200ee3e8f6faf189ef6f25a0f5bb294afae4 ]
+
+Fix the return value check typo which testing the wrong variable
+in ingenic_usb_phy_probe().
+
+Fixes: 31de313dfdcf ("PHY: Ingenic: Add USB PHY driver using generic PHY framework.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://lore.kernel.org/r/20210305034933.3240914-1-weiyongjun1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ingenic/phy-ingenic-usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ingenic/phy-ingenic-usb.c b/drivers/phy/ingenic/phy-ingenic-usb.c
+index ea127b177f46..28c28d816484 100644
+--- a/drivers/phy/ingenic/phy-ingenic-usb.c
++++ b/drivers/phy/ingenic/phy-ingenic-usb.c
+@@ -352,8 +352,8 @@ static int ingenic_usb_phy_probe(struct platform_device *pdev)
+ }
+
+ priv->phy = devm_phy_create(dev, NULL, &ingenic_usb_phy_ops);
+- if (IS_ERR(priv))
+- return PTR_ERR(priv);
++ if (IS_ERR(priv->phy))
++ return PTR_ERR(priv->phy);
+
+ phy_set_drvdata(priv->phy, priv);
+
+--
+2.30.2
+
--- /dev/null
+From e7adef4dc1312cfe53c28a46c0b0a060dd910a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 16:02:52 +0100
+Subject: phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y,
+ unconditionally
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6cb17707aad869de163d7bf42c253caf501be4e2 ]
+
+Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
+To fix this, restrict the automatic enabling of ARMADA375_USBCLUSTER_PHY
+to MACH_ARMADA_375, and ask the user in case of compile-testing.
+
+Fixes: eee47538ec1f2619 ("phy: add support for USB cluster on the Armada 375 SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210208150252.424706-1-geert+renesas@glider.be
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/marvell/Kconfig b/drivers/phy/marvell/Kconfig
+index 6c96f2bf5266..c8ee23fc3a83 100644
+--- a/drivers/phy/marvell/Kconfig
++++ b/drivers/phy/marvell/Kconfig
+@@ -3,8 +3,8 @@
+ # Phy drivers for Marvell platforms
+ #
+ config ARMADA375_USBCLUSTER_PHY
+- def_bool y
+- depends on MACH_ARMADA_375 || COMPILE_TEST
++ bool "Armada 375 USB cluster PHY support" if COMPILE_TEST
++ default y if MACH_ARMADA_375
+ depends on OF && HAS_IOMEM
+ select GENERIC_PHY
+
+--
+2.30.2
+
--- /dev/null
+From 09f8ffc3f3a152de8b128d3f9e1f6490da98b146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 03:49:31 +0000
+Subject: phy: ralink: phy-mt7621-pci: fix return value check in
+ mt7621_pci_phy_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit b976c987511e34a2e9b23545de912a121a9eded5 ]
+
+Fix the return value check which testing the wrong variable
+in mt7621_pci_phy_probe().
+
+Fixes: d87da32372a0 ("phy: ralink: Add PHY driver for MT7621 PCIe PHY")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20210305034931.3237558-1-weiyongjun1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ralink/phy-mt7621-pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ralink/phy-mt7621-pci.c b/drivers/phy/ralink/phy-mt7621-pci.c
+index 84ee2b5c2228..753cb5bab930 100644
+--- a/drivers/phy/ralink/phy-mt7621-pci.c
++++ b/drivers/phy/ralink/phy-mt7621-pci.c
+@@ -319,9 +319,9 @@ static int mt7621_pci_phy_probe(struct platform_device *pdev)
+ return PTR_ERR(phy->regmap);
+
+ phy->phy = devm_phy_create(dev, dev->of_node, &mt7621_pci_phy_ops);
+- if (IS_ERR(phy)) {
++ if (IS_ERR(phy->phy)) {
+ dev_err(dev, "failed to create phy\n");
+- return PTR_ERR(phy);
++ return PTR_ERR(phy->phy);
+ }
+
+ phy_set_drvdata(phy->phy, phy);
+--
+2.30.2
+
--- /dev/null
+From a6a2086b42af62edefdd2a30790f6ec86aebcc9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 11:54:12 +0100
+Subject: phy: ralink: phy-mt7621-pci: fix XTAL bitmask
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit 982313c38f2f3793b6435ff50997ae96a2274f5a ]
+
+When this was rewriten to get mainlined and start to
+use 'linux/bitfield.h' headers, XTAL_MASK was wrong.
+It must mask three bits but only two were used. Hence
+properly fix it to make things work.
+
+Fixes: d87da32372a0 ("phy: ralink: Add PHY driver for MT7621 PCIe PHY")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20210302105412.16221-1-sergio.paracuellos@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ralink/phy-mt7621-pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/ralink/phy-mt7621-pci.c b/drivers/phy/ralink/phy-mt7621-pci.c
+index 9a610b414b1f..84ee2b5c2228 100644
+--- a/drivers/phy/ralink/phy-mt7621-pci.c
++++ b/drivers/phy/ralink/phy-mt7621-pci.c
+@@ -62,7 +62,7 @@
+
+ #define RG_PE1_FRC_MSTCKDIV BIT(5)
+
+-#define XTAL_MASK GENMASK(7, 6)
++#define XTAL_MASK GENMASK(8, 6)
+
+ #define MAX_PHYS 2
+
+--
+2.30.2
+
--- /dev/null
+From 398da7c8db79b5339167d4050210b5345915649e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 17:38:36 +0530
+Subject: phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 7e52a39f1942b771213678c56002ce90a2f126d2 ]
+
+commit 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module
+present in TI J721E SoC") modeled both MUX clocks and DIVIDER clocks in
+wiz. However during cleanup, it removed only the MUX clock provider.
+Remove the DIVIDER clock provider here.
+
+Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Link: https://lore.kernel.org/r/20210310120840.16447-3-kishon@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-j721e-wiz.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
+index a75433b459dd..e28e25f98708 100644
+--- a/drivers/phy/ti/phy-j721e-wiz.c
++++ b/drivers/phy/ti/phy-j721e-wiz.c
+@@ -615,6 +615,12 @@ static void wiz_clock_cleanup(struct wiz *wiz, struct device_node *node)
+ of_clk_del_provider(clk_node);
+ of_node_put(clk_node);
+ }
++
++ for (i = 0; i < wiz->clk_div_sel_num; i++) {
++ clk_node = of_get_child_by_name(node, clk_div_sel[i].node_name);
++ of_clk_del_provider(clk_node);
++ of_node_put(clk_node);
++ }
+ }
+
+ static int wiz_clock_init(struct wiz *wiz, struct device_node *node)
+--
+2.30.2
+
--- /dev/null
+From 3e4bf73a47f2da36f4d93119a5b49ea596b60720 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 11:25:22 +0300
+Subject: pinctrl: at91-pio4: Fix slew rate disablement
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+[ Upstream commit cbde6c823bfaa553fb162257a5926ba15ebaaa43 ]
+
+The slew rate was enabled by default for each configuration of the
+pin. In case the pin had more than one configuration, even if
+we set the slew rate as disabled in the device tree, the next pin
+configuration would set again the slew rate enabled by default,
+overwriting the slew rate disablement.
+Instead of enabling the slew rate by default for each pin configuration,
+enable the slew rate by default just once per pin, regardless of the
+number of configurations. This way the slew rate disablement will also
+work for cases where pins have multiple configurations.
+
+Fixes: c709135e576b ("pinctrl: at91-pio4: add support for slew-rate")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20210409082522.625168-1-tudor.ambarus@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index e71ebccc479c..03c32b2c5d30 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -801,6 +801,10 @@ static int atmel_conf_pin_config_group_set(struct pinctrl_dev *pctldev,
+
+ conf = atmel_pin_config_read(pctldev, pin_id);
+
++ /* Keep slew rate enabled by default. */
++ if (atmel_pioctrl->slew_rate_support)
++ conf |= ATMEL_PIO_SR_MASK;
++
+ for (i = 0; i < num_configs; i++) {
+ unsigned int param = pinconf_to_config_param(configs[i]);
+ unsigned int arg = pinconf_to_config_argument(configs[i]);
+@@ -808,10 +812,6 @@ static int atmel_conf_pin_config_group_set(struct pinctrl_dev *pctldev,
+ dev_dbg(pctldev->dev, "%s: pin=%u, config=0x%lx\n",
+ __func__, pin_id, configs[i]);
+
+- /* Keep slew rate enabled by default. */
+- if (atmel_pioctrl->slew_rate_support)
+- conf |= ATMEL_PIO_SR_MASK;
+-
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+ conf &= (~ATMEL_PIO_PUEN_MASK);
+--
+2.30.2
+
--- /dev/null
+From 3f0dbc4973a2b433f5648d6774d3d912adfec5fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 17:21:33 +0200
+Subject: pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is
+ not zero
+
+From: Hanna Hawa <hhhawa@amazon.com>
+
+[ Upstream commit bd85125ea88513f637a62a72e8949c579c5c0a87 ]
+
+A System Error (SError, followed by kernel panic) was detected when
+trying to print the supported pins in a pinctrl device which supports
+multiple pins per register. This change fixes the pcs_pin_dbg_show() in
+pinctrl-single driver when bits_per_mux is not zero. In addition move
+offset calculation and pin offset in register to common function.
+
+Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules")
+Signed-off-by: Hanna Hawa <hhhawa@amazon.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Drew Fustini <drew@beagleboard.org>
+Link: https://lore.kernel.org/r/20210319152133.28705-4-hhhawa@amazon.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 55 ++++++++++++++++++++------------
+ 1 file changed, 35 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 8a7922459896..10890fde9a75 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -270,20 +270,44 @@ static void __maybe_unused pcs_writel(unsigned val, void __iomem *reg)
+ writel(val, reg);
+ }
+
++static unsigned int pcs_pin_reg_offset_get(struct pcs_device *pcs,
++ unsigned int pin)
++{
++ unsigned int mux_bytes = pcs->width / BITS_PER_BYTE;
++
++ if (pcs->bits_per_mux) {
++ unsigned int pin_offset_bytes;
++
++ pin_offset_bytes = (pcs->bits_per_pin * pin) / BITS_PER_BYTE;
++ return (pin_offset_bytes / mux_bytes) * mux_bytes;
++ }
++
++ return pin * mux_bytes;
++}
++
++static unsigned int pcs_pin_shift_reg_get(struct pcs_device *pcs,
++ unsigned int pin)
++{
++ return (pin % (pcs->width / pcs->bits_per_pin)) * pcs->bits_per_pin;
++}
++
+ static void pcs_pin_dbg_show(struct pinctrl_dev *pctldev,
+ struct seq_file *s,
+ unsigned pin)
+ {
+ struct pcs_device *pcs;
+- unsigned val, mux_bytes;
++ unsigned int val;
+ unsigned long offset;
+ size_t pa;
+
+ pcs = pinctrl_dev_get_drvdata(pctldev);
+
+- mux_bytes = pcs->width / BITS_PER_BYTE;
+- offset = pin * mux_bytes;
++ offset = pcs_pin_reg_offset_get(pcs, pin);
+ val = pcs->read(pcs->base + offset);
++
++ if (pcs->bits_per_mux)
++ val &= pcs->fmask << pcs_pin_shift_reg_get(pcs, pin);
++
+ pa = pcs->res->start + offset;
+
+ seq_printf(s, "%zx %08x %s ", pa, val, DRIVER_NAME);
+@@ -384,7 +408,6 @@ static int pcs_request_gpio(struct pinctrl_dev *pctldev,
+ struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
+ struct pcs_gpiofunc_range *frange = NULL;
+ struct list_head *pos, *tmp;
+- int mux_bytes = 0;
+ unsigned data;
+
+ /* If function mask is null, return directly. */
+@@ -392,29 +415,27 @@ static int pcs_request_gpio(struct pinctrl_dev *pctldev,
+ return -ENOTSUPP;
+
+ list_for_each_safe(pos, tmp, &pcs->gpiofuncs) {
++ u32 offset;
++
+ frange = list_entry(pos, struct pcs_gpiofunc_range, node);
+ if (pin >= frange->offset + frange->npins
+ || pin < frange->offset)
+ continue;
+- mux_bytes = pcs->width / BITS_PER_BYTE;
+
+- if (pcs->bits_per_mux) {
+- int byte_num, offset, pin_shift;
++ offset = pcs_pin_reg_offset_get(pcs, pin);
+
+- byte_num = (pcs->bits_per_pin * pin) / BITS_PER_BYTE;
+- offset = (byte_num / mux_bytes) * mux_bytes;
+- pin_shift = pin % (pcs->width / pcs->bits_per_pin) *
+- pcs->bits_per_pin;
++ if (pcs->bits_per_mux) {
++ int pin_shift = pcs_pin_shift_reg_get(pcs, pin);
+
+ data = pcs->read(pcs->base + offset);
+ data &= ~(pcs->fmask << pin_shift);
+ data |= frange->gpiofunc << pin_shift;
+ pcs->write(data, pcs->base + offset);
+ } else {
+- data = pcs->read(pcs->base + pin * mux_bytes);
++ data = pcs->read(pcs->base + offset);
+ data &= ~pcs->fmask;
+ data |= frange->gpiofunc;
+- pcs->write(data, pcs->base + pin * mux_bytes);
++ pcs->write(data, pcs->base + offset);
+ }
+ break;
+ }
+@@ -726,14 +747,8 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs)
+ for (i = 0; i < pcs->desc.npins; i++) {
+ unsigned offset;
+ int res;
+- int byte_num;
+
+- if (pcs->bits_per_mux) {
+- byte_num = (pcs->bits_per_pin * i) / BITS_PER_BYTE;
+- offset = (byte_num / mux_bytes) * mux_bytes;
+- } else {
+- offset = i * mux_bytes;
+- }
++ offset = pcs_pin_reg_offset_get(pcs, i);
+ res = pcs_add_pin(pcs, offset);
+ if (res < 0) {
+ dev_err(pcs->dev, "error adding pins: %i\n", res);
+--
+2.30.2
+
--- /dev/null
+From 5ee93e144c77950b28433ed83c1c935c4a290bd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 17:21:32 +0200
+Subject: pinctrl: pinctrl-single: remove unused parameter
+
+From: Hanna Hawa <hhhawa@amazon.com>
+
+[ Upstream commit 8fa2ea202b13b6da81e26c399ff1d87488398453 ]
+
+Remove unused parameter 'pin_pos' from pcs_add_pin().
+
+Signed-off-by: Hanna Hawa <hhhawa@amazon.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Drew Fustini <drew@beagleboard.org>
+Link: https://lore.kernel.org/r/20210319152133.28705-3-hhhawa@amazon.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 7771316dfffa..8a7922459896 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -656,10 +656,8 @@ static const struct pinconf_ops pcs_pinconf_ops = {
+ * pcs_add_pin() - add a pin to the static per controller pin array
+ * @pcs: pcs driver instance
+ * @offset: register offset from base
+- * @pin_pos: unused
+ */
+-static int pcs_add_pin(struct pcs_device *pcs, unsigned offset,
+- unsigned pin_pos)
++static int pcs_add_pin(struct pcs_device *pcs, unsigned int offset)
+ {
+ struct pcs_soc_data *pcs_soc = &pcs->socdata;
+ struct pinctrl_pin_desc *pin;
+@@ -729,16 +727,14 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs)
+ unsigned offset;
+ int res;
+ int byte_num;
+- int pin_pos = 0;
+
+ if (pcs->bits_per_mux) {
+ byte_num = (pcs->bits_per_pin * i) / BITS_PER_BYTE;
+ offset = (byte_num / mux_bytes) * mux_bytes;
+- pin_pos = i % num_pins_in_register;
+ } else {
+ offset = i * mux_bytes;
+ }
+- res = pcs_add_pin(pcs, offset, pin_pos);
++ res = pcs_add_pin(pcs, offset);
+ if (res < 0) {
+ dev_err(pcs->dev, "error adding pins: %i\n", res);
+ return res;
+--
+2.30.2
+
--- /dev/null
+From 733e452265cb524e03c8afb1dc7f5bbb57ff871a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 11:44:02 +0300
+Subject: platform/surface: aggregator: fix a bit test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 366f0a30c8a01e79255221539a52909cc4c7bd25 ]
+
+The "funcs" variable is a u64. If "func" is more than 31 then the
+BIT() shift will wrap instead of testing the high bits.
+
+Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/YH6UUhJhGk3mk13b@mwanda
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/aggregator/controller.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/surface/aggregator/controller.c b/drivers/platform/surface/aggregator/controller.c
+index 5bcb59ed579d..89761d3e1a47 100644
+--- a/drivers/platform/surface/aggregator/controller.c
++++ b/drivers/platform/surface/aggregator/controller.c
+@@ -1040,7 +1040,7 @@ static int ssam_dsm_load_u32(acpi_handle handle, u64 funcs, u64 func, u32 *ret)
+ union acpi_object *obj;
+ u64 val;
+
+- if (!(funcs & BIT(func)))
++ if (!(funcs & BIT_ULL(func)))
+ return 0; /* Not supported, leave *ret at its default value */
+
+ obj = acpi_evaluate_dsm_typed(handle, &SSAM_SSH_DSM_GUID,
+--
+2.30.2
+
--- /dev/null
+From 6f15f87e4ed166311e024dcdd6c8e95608ff55b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 13:16:07 +0100
+Subject: platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI
+ object parsing more robust
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 5e3f5973c8dfd2b80268f1825ed2f2ddf81d3267 ]
+
+Make init_bios_attributes() ACPI object parsing more robust:
+1. Always check that the type of the return ACPI object is package, rather
+ then only checking this for instance_id == 0
+2. Check that the package has the minimum amount of elements which will
+ be consumed by the populate_foo_data() for the attr_type
+
+Note/TODO: The populate_foo_data() functions should also be made more
+robust. The should check the type of each of the elements matches the
+type which they expect and in case of populate_enum_data()
+obj->package.count should be passed to it as an argument and it should
+re-check this itself since it consume a variable number of elements.
+
+Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
+Cc: Divya Bharathi <Divya_Bharathi@dell.com>
+Cc: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210321121607.35717-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86/dell/dell-wmi-sysman/sysman.c | 32 ++++++++++++++++---
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
+index 7410ccae650c..a90ae6ba4a73 100644
+--- a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
++++ b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
+@@ -399,6 +399,7 @@ static int init_bios_attributes(int attr_type, const char *guid)
+ union acpi_object *obj = NULL;
+ union acpi_object *elements;
+ struct kset *tmp_set;
++ int min_elements;
+
+ /* instance_id needs to be reset for each type GUID
+ * also, instance IDs are unique within GUID but not across
+@@ -409,14 +410,38 @@ static int init_bios_attributes(int attr_type, const char *guid)
+ retval = alloc_attributes_data(attr_type);
+ if (retval)
+ return retval;
++
++ switch (attr_type) {
++ case ENUM: min_elements = 8; break;
++ case INT: min_elements = 9; break;
++ case STR: min_elements = 8; break;
++ case PO: min_elements = 4; break;
++ default:
++ pr_err("Error: Unknown attr_type: %d\n", attr_type);
++ return -EINVAL;
++ }
++
+ /* need to use specific instance_id and guid combination to get right data */
+ obj = get_wmiobj_pointer(instance_id, guid);
+- if (!obj || obj->type != ACPI_TYPE_PACKAGE)
++ if (!obj)
+ return -ENODEV;
+- elements = obj->package.elements;
+
+ mutex_lock(&wmi_priv.mutex);
+- while (elements) {
++ while (obj) {
++ if (obj->type != ACPI_TYPE_PACKAGE) {
++ pr_err("Error: Expected ACPI-package type, got: %d\n", obj->type);
++ retval = -EIO;
++ goto err_attr_init;
++ }
++
++ if (obj->package.count < min_elements) {
++ pr_err("Error: ACPI-package does not have enough elements: %d < %d\n",
++ obj->package.count, min_elements);
++ goto nextobj;
++ }
++
++ elements = obj->package.elements;
++
+ /* sanity checking */
+ if (elements[ATTR_NAME].type != ACPI_TYPE_STRING) {
+ pr_debug("incorrect element type\n");
+@@ -481,7 +506,6 @@ nextobj:
+ kfree(obj);
+ instance_id++;
+ obj = get_wmiobj_pointer(instance_id, guid);
+- elements = obj ? obj->package.elements : NULL;
+ }
+
+ mutex_unlock(&wmi_priv.mutex);
+--
+2.30.2
+
--- /dev/null
+From 4ec15a582074ba0d9c8367f239ea712f60d91f2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 15:30:06 +0200
+Subject: platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards
+ with critclk_systems DMI table
+
+From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+
+[ Upstream commit d21e5abd3a005253eb033090aab2e43bce090d89 ]
+
+pmc_plt_clk* clocks are used for ethernet controllers, so need to stay
+turned on. This adds the affected board family to critclk_systems DMI
+table, so the clocks are marked as CLK_CRITICAL and not turned off.
+
+This replaces the previously listed boards with a match for the whole
+device family CBxx63. CBxx63 matches only baytrail devices.
+There are new affected boards that would otherwise need to be listed.
+There are unaffected boards in the family, but having the clocks
+turned on is not an issue.
+
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Link: https://lore.kernel.org/r/20210412133006.397679-1-linux-kernel-dev@beckhoff.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/pmc_atom.c | 28 ++--------------------------
+ 1 file changed, 2 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index ca684ed760d1..a9d2a4b98e57 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -393,34 +393,10 @@ static const struct dmi_system_id critclk_systems[] = {
+ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB3163",
++ .ident = "Beckhoff Baytrail",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB4063",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB4063"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6263",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6263"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6363",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6363"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"),
+ },
+ },
+ {
+--
+2.30.2
+
--- /dev/null
+From 8fbb8d6ae4880632e01a6d07eb8a911107035924 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 15:20:08 +0800
+Subject: PM / devfreq: Use more accurate returned new_freq as resume_freq
+
+From: Dong Aisheng <aisheng.dong@nxp.com>
+
+[ Upstream commit 62453f1ba5d5def9d58e140a50f3f168f028da38 ]
+
+Use the more accurate returned new_freq as resume_freq.
+It's the same as how devfreq->previous_freq was updated.
+
+Fixes: 83f8ca45afbf0 ("PM / devfreq: add support for suspend/resume of a devfreq device")
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index e4be0435c9ba..59ba59bea0f5 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -387,7 +387,7 @@ static int devfreq_set_target(struct devfreq *devfreq, unsigned long new_freq,
+ devfreq->previous_freq = new_freq;
+
+ if (devfreq->suspend_freq)
+- devfreq->resume_freq = cur_freq;
++ devfreq->resume_freq = new_freq;
+
+ return err;
+ }
+--
+2.30.2
+
--- /dev/null
+From 3fe6122ef6ee2eda4b94fadf4f1eec837db26604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 08:57:39 -0400
+Subject: PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820
+ integrity check
+
+From: Chris von Recklinghausen <crecklin@redhat.com>
+
+[ Upstream commit f5d1499ae2096d7ea301023c4cc54e427300eb0a ]
+
+Hibernation fails on a system in fips mode because md5 is used for the e820
+integrity check and is not available. Use crc32 instead.
+
+The check is intended to detect whether the E820 memory map provided
+by the firmware after cold boot unexpectedly differs from the one that
+was in use when the hibernation image was created. In this case, the
+hibernation image cannot be restored, as it may cover memory regions
+that are no longer available to the OS.
+
+A non-cryptographic checksum such as CRC-32 is sufficient to detect such
+inadvertent deviations.
+
+Fixes: 62a03defeabd ("PM / hibernate: Verify the consistent of e820 memory map by md5 digest")
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Tested-by: Dexuan Cui <decui@microsoft.com>
+Reviewed-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Chris von Recklinghausen <crecklin@redhat.com>
+[ rjw: Subject edit ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/e820.c | 4 +-
+ arch/x86/power/hibernate.c | 89 ++++++--------------------------------
+ 2 files changed, 16 insertions(+), 77 deletions(-)
+
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index 22aad412f965..629c4994f165 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -31,8 +31,8 @@
+ * - inform the user about the firmware's notion of memory layout
+ * via /sys/firmware/memmap
+ *
+- * - the hibernation code uses it to generate a kernel-independent MD5
+- * fingerprint of the physical memory layout of a system.
++ * - the hibernation code uses it to generate a kernel-independent CRC32
++ * checksum of the physical memory layout of a system.
+ *
+ * - 'e820_table_kexec': a slightly modified (by the kernel) firmware version
+ * passed to us by the bootloader - the major difference between
+diff --git a/arch/x86/power/hibernate.c b/arch/x86/power/hibernate.c
+index cd3914fc9f3d..e94e0050a583 100644
+--- a/arch/x86/power/hibernate.c
++++ b/arch/x86/power/hibernate.c
+@@ -13,8 +13,8 @@
+ #include <linux/kdebug.h>
+ #include <linux/cpu.h>
+ #include <linux/pgtable.h>
+-
+-#include <crypto/hash.h>
++#include <linux/types.h>
++#include <linux/crc32.h>
+
+ #include <asm/e820/api.h>
+ #include <asm/init.h>
+@@ -54,95 +54,33 @@ int pfn_is_nosave(unsigned long pfn)
+ return pfn >= nosave_begin_pfn && pfn < nosave_end_pfn;
+ }
+
+-
+-#define MD5_DIGEST_SIZE 16
+-
+ struct restore_data_record {
+ unsigned long jump_address;
+ unsigned long jump_address_phys;
+ unsigned long cr3;
+ unsigned long magic;
+- u8 e820_digest[MD5_DIGEST_SIZE];
++ unsigned long e820_checksum;
+ };
+
+-#if IS_BUILTIN(CONFIG_CRYPTO_MD5)
+ /**
+- * get_e820_md5 - calculate md5 according to given e820 table
++ * compute_e820_crc32 - calculate crc32 of a given e820 table
+ *
+ * @table: the e820 table to be calculated
+- * @buf: the md5 result to be stored to
++ *
++ * Return: the resulting checksum
+ */
+-static int get_e820_md5(struct e820_table *table, void *buf)
++static inline u32 compute_e820_crc32(struct e820_table *table)
+ {
+- struct crypto_shash *tfm;
+- struct shash_desc *desc;
+- int size;
+- int ret = 0;
+-
+- tfm = crypto_alloc_shash("md5", 0, 0);
+- if (IS_ERR(tfm))
+- return -ENOMEM;
+-
+- desc = kmalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
+- GFP_KERNEL);
+- if (!desc) {
+- ret = -ENOMEM;
+- goto free_tfm;
+- }
+-
+- desc->tfm = tfm;
+-
+- size = offsetof(struct e820_table, entries) +
++ int size = offsetof(struct e820_table, entries) +
+ sizeof(struct e820_entry) * table->nr_entries;
+
+- if (crypto_shash_digest(desc, (u8 *)table, size, buf))
+- ret = -EINVAL;
+-
+- kfree_sensitive(desc);
+-
+-free_tfm:
+- crypto_free_shash(tfm);
+- return ret;
+-}
+-
+-static int hibernation_e820_save(void *buf)
+-{
+- return get_e820_md5(e820_table_firmware, buf);
+-}
+-
+-static bool hibernation_e820_mismatch(void *buf)
+-{
+- int ret;
+- u8 result[MD5_DIGEST_SIZE];
+-
+- memset(result, 0, MD5_DIGEST_SIZE);
+- /* If there is no digest in suspend kernel, let it go. */
+- if (!memcmp(result, buf, MD5_DIGEST_SIZE))
+- return false;
+-
+- ret = get_e820_md5(e820_table_firmware, result);
+- if (ret)
+- return true;
+-
+- return memcmp(result, buf, MD5_DIGEST_SIZE) ? true : false;
+-}
+-#else
+-static int hibernation_e820_save(void *buf)
+-{
+- return 0;
+-}
+-
+-static bool hibernation_e820_mismatch(void *buf)
+-{
+- /* If md5 is not builtin for restore kernel, let it go. */
+- return false;
++ return ~crc32_le(~0, (unsigned char const *)table, size);
+ }
+-#endif
+
+ #ifdef CONFIG_X86_64
+-#define RESTORE_MAGIC 0x23456789ABCDEF01UL
++#define RESTORE_MAGIC 0x23456789ABCDEF02UL
+ #else
+-#define RESTORE_MAGIC 0x12345678UL
++#define RESTORE_MAGIC 0x12345679UL
+ #endif
+
+ /**
+@@ -179,7 +117,8 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
+ */
+ rdr->cr3 = restore_cr3 & ~CR3_PCID_MASK;
+
+- return hibernation_e820_save(rdr->e820_digest);
++ rdr->e820_checksum = compute_e820_crc32(e820_table_firmware);
++ return 0;
+ }
+
+ /**
+@@ -200,7 +139,7 @@ int arch_hibernation_header_restore(void *addr)
+ jump_address_phys = rdr->jump_address_phys;
+ restore_cr3 = rdr->cr3;
+
+- if (hibernation_e820_mismatch(rdr->e820_digest)) {
++ if (rdr->e820_checksum != compute_e820_crc32(e820_table_firmware)) {
+ pr_crit("Hibernate inconsistent memory map detected!\n");
+ return -ENODEV;
+ }
+--
+2.30.2
+
--- /dev/null
+From 73680f5ef7f6521c5ac07d3082fd621a5756f873 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 14:14:22 +0800
+Subject: PM: runtime: Replace inline function pm_runtime_callbacks_present()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 953c1fd96b1a70bcbbfb10973c2126eba8d891c7 ]
+
+Commit 9a7875461fd0 ("PM: runtime: Replace pm_runtime_callbacks_present()")
+forgot to change the inline version.
+
+Fixes: 9a7875461fd0 ("PM: runtime: Replace pm_runtime_callbacks_present()")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pm_runtime.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
+index b492ae00cc90..6c08a085367b 100644
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -265,7 +265,7 @@ static inline void pm_runtime_no_callbacks(struct device *dev) {}
+ static inline void pm_runtime_irq_safe(struct device *dev) {}
+ static inline bool pm_runtime_is_irq_safe(struct device *dev) { return false; }
+
+-static inline bool pm_runtime_callbacks_present(struct device *dev) { return false; }
++static inline bool pm_runtime_has_no_callbacks(struct device *dev) { return false; }
+ static inline void pm_runtime_mark_last_busy(struct device *dev) {}
+ static inline void __pm_runtime_use_autosuspend(struct device *dev,
+ bool use) {}
+--
+2.30.2
+
--- /dev/null
+From 086350e0892b0287b91e441b5f28411af1f40dc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 16:56:46 -0600
+Subject: power: supply: bq25980: Move props from battery node
+
+From: Ricardo Rivera-Matos <r-rivera-matos@ti.com>
+
+[ Upstream commit 04722cec1436c732d39153ce6ae2ebf71ac3ade7 ]
+
+Currently POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT and
+POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE are exposed on
+the battery node and this is incorrect.
+
+This patch exposes both of them on the charger node rather
+than the battery node.
+
+Fixes: 5069185fc18e ("power: supply: bq25980: Add support for the BQ259xx family")
+Signed-off-by: Ricardo Rivera-Matos <r-rivera-matos@ti.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq25980_charger.c | 40 ++++++++------------------
+ 1 file changed, 12 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/power/supply/bq25980_charger.c b/drivers/power/supply/bq25980_charger.c
+index 530ff4025b31..0008c229fd9c 100644
+--- a/drivers/power/supply/bq25980_charger.c
++++ b/drivers/power/supply/bq25980_charger.c
+@@ -606,33 +606,6 @@ static int bq25980_get_state(struct bq25980_device *bq,
+ return 0;
+ }
+
+-static int bq25980_set_battery_property(struct power_supply *psy,
+- enum power_supply_property psp,
+- const union power_supply_propval *val)
+-{
+- struct bq25980_device *bq = power_supply_get_drvdata(psy);
+- int ret = 0;
+-
+- switch (psp) {
+- case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
+- ret = bq25980_set_const_charge_curr(bq, val->intval);
+- if (ret)
+- return ret;
+- break;
+-
+- case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE:
+- ret = bq25980_set_const_charge_volt(bq, val->intval);
+- if (ret)
+- return ret;
+- break;
+-
+- default:
+- return -EINVAL;
+- }
+-
+- return ret;
+-}
+-
+ static int bq25980_get_battery_property(struct power_supply *psy,
+ enum power_supply_property psp,
+ union power_supply_propval *val)
+@@ -701,6 +674,18 @@ static int bq25980_set_charger_property(struct power_supply *psy,
+ return ret;
+ break;
+
++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
++ ret = bq25980_set_const_charge_curr(bq, val->intval);
++ if (ret)
++ return ret;
++ break;
++
++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE:
++ ret = bq25980_set_const_charge_volt(bq, val->intval);
++ if (ret)
++ return ret;
++ break;
++
+ default:
+ return -EINVAL;
+ }
+@@ -922,7 +907,6 @@ static struct power_supply_desc bq25980_battery_desc = {
+ .name = "bq25980-battery",
+ .type = POWER_SUPPLY_TYPE_BATTERY,
+ .get_property = bq25980_get_battery_property,
+- .set_property = bq25980_set_battery_property,
+ .properties = bq25980_battery_props,
+ .num_properties = ARRAY_SIZE(bq25980_battery_props),
+ .property_is_writeable = bq25980_property_is_writeable,
+--
+2.30.2
+
--- /dev/null
+From 93a9e0cde6a961651ec3eaa01ef79f544c1f628a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 10:54:18 +0100
+Subject: power: supply: bq27xxx: fix sign of current_now for newer ICs
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit b67fdcb7099e9c640bad625c4dd6399debb3376a ]
+
+Commit cd060b4d0868 ("power: supply: bq27xxx: fix polarity of current_now")
+changed the sign of current_now for all bq27xxx variants, but on BQ28Z610
+I'm now seeing negated values *with* that patch.
+
+The GTA04/Openmoko device that was used for testing uses a BQ27000 or
+BQ27010 IC, so I assume only the BQ27XXX_O_ZERO code path was incorrect.
+Revert the behaviour for newer ICs.
+
+Fixes: cd060b4d0868 "power: supply: bq27xxx: fix polarity of current_now"
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq27xxx_battery.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 0262109ac285..20e1dc8a87cf 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1804,7 +1804,7 @@ static int bq27xxx_battery_current(struct bq27xxx_device_info *di,
+ val->intval = curr * BQ27XXX_CURRENT_CONSTANT / BQ27XXX_RS;
+ } else {
+ /* Other gauges return signed value */
+- val->intval = -(int)((s16)curr) * 1000;
++ val->intval = (int)((s16)curr) * 1000;
+ }
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From cd73faed9d0f83d692291d9d7945ac46f6a6b72b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 17:24:03 +0000
+Subject: powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of
+ 'add')
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]
+
+ AS arch/powerpc/platforms/52xx/lite5200_sleep.o
+arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:
+arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression
+
+In the following code, 'addi' is wrong, has to be 'add'
+
+ /* local udelay in sram is needed */
+ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
+ mullw r12, r12, r11
+ mftb r13 /* start */
+ addi r12, r13, r12 /* end */
+
+Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+index 11475c58ea43..afee8b1515a8 100644
+--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S
++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+@@ -181,7 +181,7 @@ sram_code:
+ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
+ mullw r12, r12, r11
+ mftb r13 /* start */
+- addi r12, r13, r12 /* end */
++ add r12, r13, r12 /* end */
+ 1:
+ mftb r13 /* current */
+ cmp cr0, r13, r12
+--
+2.30.2
+
--- /dev/null
+From 7b661d9bb6646b1ba5ee53273cc078fde6011e7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 13:32:48 +0000
+Subject: powerpc/64: Fix the definition of the fixmap area
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 9ccba66d4d2aff9a3909aa77d57ea8b7cc166f3c ]
+
+At the time being, the fixmap area is defined at the top of
+the address space or just below KASAN.
+
+This definition is not valid for PPC64.
+
+For PPC64, use the top of the I/O space.
+
+Because of circular dependencies, it is not possible to include
+asm/fixmap.h in asm/book3s/64/pgtable.h , so define a fixed size
+AREA at the top of the I/O space for fixmap and ensure during
+build that the size is big enough.
+
+Fixes: 265c3491c4bc ("powerpc: Add support for GENERIC_EARLY_IOREMAP")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/0d51620eacf036d683d1a3c41328f69adb601dc0.1618925560.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +++-
+ arch/powerpc/include/asm/fixmap.h | 9 +++++++++
+ arch/powerpc/include/asm/nohash/64/pgtable.h | 5 ++++-
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 058601efbc8a..b703330459b8 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -7,6 +7,7 @@
+ #ifndef __ASSEMBLY__
+ #include <linux/mmdebug.h>
+ #include <linux/bug.h>
++#include <linux/sizes.h>
+ #endif
+
+ /*
+@@ -323,7 +324,8 @@ extern unsigned long pci_io_base;
+ #define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)
+ #define IOREMAP_BASE (PHB_IO_END)
+ #define IOREMAP_START (ioremap_bot)
+-#define IOREMAP_END (KERN_IO_END)
++#define IOREMAP_END (KERN_IO_END - FIXADDR_SIZE)
++#define FIXADDR_SIZE SZ_32M
+
+ /* Advertise special mapping type for AGP */
+ #define HAVE_PAGE_AGP
+diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h
+index 8d03c16a3663..947b5b9c4424 100644
+--- a/arch/powerpc/include/asm/fixmap.h
++++ b/arch/powerpc/include/asm/fixmap.h
+@@ -23,12 +23,17 @@
+ #include <asm/kmap_size.h>
+ #endif
+
++#ifdef CONFIG_PPC64
++#define FIXADDR_TOP (IOREMAP_END + FIXADDR_SIZE)
++#else
++#define FIXADDR_SIZE 0
+ #ifdef CONFIG_KASAN
+ #include <asm/kasan.h>
+ #define FIXADDR_TOP (KASAN_SHADOW_START - PAGE_SIZE)
+ #else
+ #define FIXADDR_TOP ((unsigned long)(-PAGE_SIZE))
+ #endif
++#endif
+
+ /*
+ * Here we define all the compile-time 'special' virtual
+@@ -50,6 +55,7 @@
+ */
+ enum fixed_addresses {
+ FIX_HOLE,
++#ifdef CONFIG_PPC32
+ /* reserve the top 128K for early debugging purposes */
+ FIX_EARLY_DEBUG_TOP = FIX_HOLE,
+ FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+(ALIGN(SZ_128K, PAGE_SIZE)/PAGE_SIZE)-1,
+@@ -72,6 +78,7 @@ enum fixed_addresses {
+ FIX_IMMR_SIZE,
+ #endif
+ /* FIX_PCIE_MCFG, */
++#endif /* CONFIG_PPC32 */
+ __end_of_permanent_fixed_addresses,
+
+ #define NR_FIX_BTMAPS (SZ_256K / PAGE_SIZE)
+@@ -98,6 +105,8 @@ enum fixed_addresses {
+ static inline void __set_fixmap(enum fixed_addresses idx,
+ phys_addr_t phys, pgprot_t flags)
+ {
++ BUILD_BUG_ON(IS_ENABLED(CONFIG_PPC64) && __FIXADDR_SIZE > FIXADDR_SIZE);
++
+ if (__builtin_constant_p(idx))
+ BUILD_BUG_ON(idx >= __end_of_fixed_addresses);
+ else if (WARN_ON(idx >= __end_of_fixed_addresses))
+diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
+index 6cb8aa357191..57cd3892bfe0 100644
+--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
++++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
+@@ -6,6 +6,8 @@
+ * the ppc64 non-hashed page table.
+ */
+
++#include <linux/sizes.h>
++
+ #include <asm/nohash/64/pgtable-4k.h>
+ #include <asm/barrier.h>
+ #include <asm/asm-const.h>
+@@ -54,7 +56,8 @@
+ #define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)
+ #define IOREMAP_BASE (PHB_IO_END)
+ #define IOREMAP_START (ioremap_bot)
+-#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE)
++#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE - FIXADDR_SIZE)
++#define FIXADDR_SIZE SZ_32M
+
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From a68ed5812933c7576c9edbf14ea05716cf0e2aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 20:52:05 +1000
+Subject: powerpc/64s: Fix hash fault to use TRAP accessor
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 1479e3d3b7559133b0a107772b5841e9c2cad450 ]
+
+Hash faults use the trap vector to decide whether this is an
+instruction or data fault. This should use the TRAP accessor
+rather than open access regs->trap.
+
+This won't cause a problem at the moment because 64s only uses
+trap flags for system call interrupts (the norestart flag), but
+that could change if any other trap flags get used in future.
+
+Fixes: a4922f5442e7e ("powerpc/64s: move the hash fault handling logic to C")
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210316105205.407767-1-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/hash_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c
+index 581b20a2feaf..7719995323c3 100644
+--- a/arch/powerpc/mm/book3s64/hash_utils.c
++++ b/arch/powerpc/mm/book3s64/hash_utils.c
+@@ -1545,10 +1545,10 @@ DEFINE_INTERRUPT_HANDLER_RET(__do_hash_fault)
+ if (user_mode(regs) || (region_id == USER_REGION_ID))
+ access &= ~_PAGE_PRIVILEGED;
+
+- if (regs->trap == 0x400)
++ if (TRAP(regs) == 0x400)
+ access |= _PAGE_EXEC;
+
+- err = hash_page_mm(mm, ea, access, regs->trap, flags);
++ err = hash_page_mm(mm, ea, access, TRAP(regs), flags);
+ if (unlikely(err < 0)) {
+ // failed to instert a hash PTE due to an hypervisor error
+ if (user_mode(regs)) {
+--
+2.30.2
+
--- /dev/null
+From 5ef9a15e248138c2158ba6e3b90cb42e4d06d01f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 14:29:56 +1100
+Subject: powerpc/64s: Fix pte update for kernel memory on radix
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+[ Upstream commit b8b2f37cf632434456182e9002d63cbc4cccc50c ]
+
+When adding a PTE a ptesync is needed to order the update of the PTE
+with subsequent accesses otherwise a spurious fault may be raised.
+
+radix__set_pte_at() does not do this for performance gains. For
+non-kernel memory this is not an issue as any faults of this kind are
+corrected by the page fault handler. For kernel memory these faults
+are not handled. The current solution is that there is a ptesync in
+flush_cache_vmap() which should be called when mapping from the
+vmalloc region.
+
+However, map_kernel_page() does not call flush_cache_vmap(). This is
+troublesome in particular for code patching with Strict RWX on radix.
+In do_patch_instruction() the page frame that contains the instruction
+to be patched is mapped and then immediately patched. With no ordering
+or synchronization between setting up the PTE and writing to the page
+it is possible for faults.
+
+As the code patching is done using __put_user_asm_goto() the resulting
+fault is obscured - but using a normal store instead it can be seen:
+
+ BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c
+ Faulting instruction address: 0xc00000000008bd74
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
+ Modules linked in: nop_module(PO+) [last unloaded: nop_module]
+ CPU: 4 PID: 757 Comm: sh Tainted: P O 5.10.0-rc5-01361-ge3c1b78c8440-dirty #43
+ NIP: c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810
+ REGS: c000000016f634a0 TRAP: 0300 Tainted: P O (5.10.0-rc5-01361-ge3c1b78c8440-dirty)
+ MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44002884 XER: 00000000
+ CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1
+
+This results in the kind of issue reported here:
+ https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/
+
+Chris Riedl suggested a reliable way to reproduce the issue:
+ $ mount -t debugfs none /sys/kernel/debug
+ $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) &
+
+Turning ftrace on and off does a large amount of code patching which
+in usually less then 5min will crash giving a trace like:
+
+ ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000)
+ ------------[ ftrace bug ]------------
+ ftrace failed to modify
+ [<c000000000bf8e5c>] napi_busy_loop+0xc/0x390
+ actual: 11:3b:47:4b
+ Setting ftrace call site to call ftrace function
+ ftrace record flags: 80000001
+ (1)
+ expected tramp: c00000000006c96c
+ ------------[ cut here ]------------
+ WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8
+ Modules linked in: nop_module(PO-) [last unloaded: nop_module]
+ CPU: 4 PID: 809 Comm: sh Tainted: P O 5.10.0-rc5-01360-gf878ccaf250a #1
+ NIP: c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0
+ REGS: c000000004c8b760 TRAP: 0700 Tainted: P O (5.10.0-rc5-01360-gf878ccaf250a)
+ MSR: 900000000282b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28008848 XER: 20040000
+ CFAR: c0000000001a9c98 IRQMASK: 0
+ GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022
+ GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8
+ GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118
+ GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000
+ GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008
+ GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8
+ GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020
+ GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0
+ NIP ftrace_bug+0x28c/0x2e8
+ LR ftrace_bug+0x288/0x2e8
+ Call Trace:
+ ftrace_bug+0x288/0x2e8 (unreliable)
+ ftrace_modify_all_code+0x168/0x210
+ arch_ftrace_update_code+0x18/0x30
+ ftrace_run_update_code+0x44/0xc0
+ ftrace_startup+0xf8/0x1c0
+ register_ftrace_function+0x4c/0xc0
+ function_trace_init+0x80/0xb0
+ tracing_set_tracer+0x2a4/0x4f0
+ tracing_set_trace_write+0xd4/0x130
+ vfs_write+0xf0/0x330
+ ksys_write+0x84/0x140
+ system_call_exception+0x14c/0x230
+ system_call_common+0xf0/0x27c
+
+To fix this when updating kernel memory PTEs using ptesync.
+
+Fixes: f1cb8f9beba8 ("powerpc/64s/radix: avoid ptesync after set_pte and ptep_set_access_flags")
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Tidy up change log slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210208032957.1232102-1-jniethe5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++--
+ arch/powerpc/mm/book3s64/radix_pgtable.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
+index c7813dc628fc..59cab558e2f0 100644
+--- a/arch/powerpc/include/asm/book3s/64/radix.h
++++ b/arch/powerpc/include/asm/book3s/64/radix.h
+@@ -222,8 +222,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr,
+ * from ptesync, it should probably go into update_mmu_cache, rather
+ * than set_pte_at (which is used to set ptes unrelated to faults).
+ *
+- * Spurious faults to vmalloc region are not tolerated, so there is
+- * a ptesync in flush_cache_vmap.
++ * Spurious faults from the kernel memory are not tolerated, so there
++ * is a ptesync in flush_cache_vmap, and __map_kernel_page() follows
++ * the pte update sequence from ISA Book III 6.10 Translation Table
++ * Update Synchronization Requirements.
+ */
+ }
+
+diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
+index 98f0b243c1ab..39d488a212a0 100644
+--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
+@@ -108,7 +108,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+@@ -168,7 +168,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 63e73560e18dc2a1bb68ab2a24d678cafeaa86d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 11:38:42 +1100
+Subject: powerpc/64s: Use htab_convert_pte_flags() in hash__mark_rodata_ro()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 2c02e656a29d5f64193eb93da92781bcf0517146 ]
+
+In hash__mark_rodata_ro() we pass the raw PP_RXXX value to
+hash__change_memory_range(). That has the effect of setting the key to
+zero, because PP_RXXX contains no key value.
+
+Fix it by using htab_convert_pte_flags(), which knows how to convert a
+pgprot into a pp value, including the key.
+
+Fixes: d94b827e89dc ("powerpc/book3s64/kuap: Use Key 3 for kernel mapping with hash translation")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Daniel Axtens <dja@axtens.net>
+Link: https://lore.kernel.org/r/20210331003845.216246-3-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/hash_pgtable.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/hash_pgtable.c b/arch/powerpc/mm/book3s64/hash_pgtable.c
+index 567e0c6b3978..03819c259f0a 100644
+--- a/arch/powerpc/mm/book3s64/hash_pgtable.c
++++ b/arch/powerpc/mm/book3s64/hash_pgtable.c
+@@ -428,12 +428,14 @@ static bool hash__change_memory_range(unsigned long start, unsigned long end,
+
+ void hash__mark_rodata_ro(void)
+ {
+- unsigned long start, end;
++ unsigned long start, end, pp;
+
+ start = (unsigned long)_stext;
+ end = (unsigned long)__init_begin;
+
+- WARN_ON(!hash__change_memory_range(start, end, PP_RXXX));
++ pp = htab_convert_pte_flags(pgprot_val(PAGE_KERNEL_ROX), HPTE_USE_KERNEL_KEY);
++
++ WARN_ON(!hash__change_memory_range(start, end, pp));
+ }
+
+ void hash__mark_initmem_nx(void)
+--
+2.30.2
+
--- /dev/null
+From f35ac43f9d557de7fc9cf9302275856a6e4312d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 12:50:14 -0700
+Subject: powerpc/fadump: Mark fadump_calculate_reserve_size as __init
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit fbced1546eaaab57a32e56c974ea8acf10c6abd8 ]
+
+If fadump_calculate_reserve_size() is not inlined, there is a modpost
+warning:
+
+WARNING: modpost: vmlinux.o(.text+0x5196c): Section mismatch in
+reference from the function fadump_calculate_reserve_size() to the
+function .init.text:parse_crashkernel()
+The function fadump_calculate_reserve_size() references
+the function __init parse_crashkernel().
+This is often because fadump_calculate_reserve_size lacks a __init
+annotation or the annotation of parse_crashkernel is wrong.
+
+fadump_calculate_reserve_size() calls parse_crashkernel(), which is
+marked as __init and fadump_calculate_reserve_size() is called from
+within fadump_reserve_mem(), which is also marked as __init.
+
+Mark fadump_calculate_reserve_size() as __init to fix the section
+mismatch. Additionally, remove the inline keyword as it is not necessary
+to inline this function; the compiler is still free to do so if it feels
+it is worthwhile since commit 889b3c1245de ("compiler: remove
+CONFIG_OPTIMIZE_INLINING entirely").
+
+Fixes: 11550dc0a00b ("powerpc/fadump: reuse crashkernel parameter for fadump memory reservation")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1300
+Link: https://lore.kernel.org/r/20210302195013.2626335-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/fadump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 8482739d42f3..eddf362caedc 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -292,7 +292,7 @@ static void fadump_show_config(void)
+ * that is required for a kernel to boot successfully.
+ *
+ */
+-static inline u64 fadump_calculate_reserve_size(void)
++static __init u64 fadump_calculate_reserve_size(void)
+ {
+ u64 base, size, bootmem_min;
+ int ret;
+--
+2.30.2
+
--- /dev/null
+From 4b3b89d0c1b62c812951ddc6eef0b4f56d0b51c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 09:49:00 +0000
+Subject: powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Huang <chenhuang5@huawei.com>
+
+[ Upstream commit 4fe529449d85e78972fa327999961ecc83a0b6db ]
+
+When compiling the powerpc with the SMP disabled, it shows the issue:
+
+arch/powerpc/kernel/watchdog.c: In function ‘watchdog_smp_panic’:
+arch/powerpc/kernel/watchdog.c:177:4: error: implicit declaration of function ‘smp_send_nmi_ipi’; did you mean ‘smp_send_stop’? [-Werror=implicit-function-declaration]
+ 177 | smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000);
+ | ^~~~~~~~~~~~~~~~
+ | smp_send_stop
+cc1: all warnings being treated as errors
+make[2]: *** [scripts/Makefile.build:273: arch/powerpc/kernel/watchdog.o] Error 1
+make[1]: *** [scripts/Makefile.build:534: arch/powerpc/kernel] Error 2
+make: *** [Makefile:1980: arch/powerpc] Error 2
+make: *** Waiting for unfinished jobs....
+
+We found that powerpc used ipi to implement hardlockup watchdog, so the
+HAVE_HARDLOCKUP_DETECTOR_ARCH should depend on the SMP.
+
+Fixes: 2104180a5369 ("powerpc/64s: implement arch-specific hardlockup watchdog")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Huang <chenhuang5@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210327094900.938555-1-chenhuang5@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 386ae12d8523..57c0ab71d51e 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -224,7 +224,7 @@ config PPC
+ select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS
+ select HAVE_MOD_ARCH_SPECIFIC
+ select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S)
+- select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S)
++ select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP
+ select HAVE_OPTPROBES if PPC64
+ select HAVE_PERF_EVENTS
+ select HAVE_PERF_EVENTS_NMI if PPC64
+--
+2.30.2
+
--- /dev/null
+From 03e1493073e618ed30e8e8f235e117c3c4d56dab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 12:26:23 -0700
+Subject: powerpc: iommu: fix build when neither PCI or IBMVIO is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ]
+
+When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a
+build error. The fault injection code is not useful in that kernel config,
+so make the FAIL_IOMMU option depend on PCI || IBMVIO.
+
+Prevents this build error (warning escalated to error):
+../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable]
+ 178 | static struct notifier_block fail_iommu_bus_notifier = {
+
+Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection")
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index ae084357994e..6342f9da4545 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -353,6 +353,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR
+ config FAIL_IOMMU
+ bool "Fault-injection capability for IOMMU"
+ depends on FAULT_INJECTION
++ depends on PCI || IBMVIO
+ help
+ Provide fault-injection capability for IOMMU. Each device can
+ be selectively enabled via the fail_iommu property.
+--
+2.30.2
+
--- /dev/null
+From 66b361ecd349cac608d702c4b355475d3270310a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 17:56:48 +0100
+Subject: powerpc/mm: Move the linear_mapping_mutex to the ifdef where it is
+ used
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 9be77e11dade414d2fa63750aa5c754fac49d619 ]
+
+The mutex linear_mapping_mutex is defined at the of the file while its
+only two user are within the CONFIG_MEMORY_HOTPLUG block.
+A compile without CONFIG_MEMORY_HOTPLUG set fails on PREEMPT_RT because
+its mutex implementation is smart enough to realize that it is unused.
+
+Move the definition of linear_mapping_mutex to ifdef block where it is
+used.
+
+Fixes: 1f73ad3e8d755 ("powerpc/mm: print warning in arch_remove_linear_mapping()")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210219165648.2505482-1-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/mem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 4e8ce6d85232..7a59a5c9aa5d 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -54,7 +54,6 @@
+
+ #include <mm/mmu_decl.h>
+
+-static DEFINE_MUTEX(linear_mapping_mutex);
+ unsigned long long memory_limit;
+ bool init_mem_is_free;
+
+@@ -72,6 +71,7 @@ pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ EXPORT_SYMBOL(phys_mem_access_prot);
+
+ #ifdef CONFIG_MEMORY_HOTPLUG
++static DEFINE_MUTEX(linear_mapping_mutex);
+
+ #ifdef CONFIG_NUMA
+ int memory_add_physaddr_to_nid(u64 start)
+--
+2.30.2
+
--- /dev/null
+From 1e36edf4c260af650a0ceb41c4ad421b0b38b9c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 12:16:01 -0400
+Subject: powerpc/perf: Fix PMU constraint check for EBB events
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ]
+
+The power PMU group constraints includes check for EBB events to make
+sure all events in a group must agree on EBB. This will prevent
+scheduling EBB and non-EBB events together. But in the existing check,
+settings for constraint mask and value is interchanged. Patch fixes the
+same.
+
+Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with
+below in dmesg logs. This happens because EBB event gets enabled along
+with a non-EBB cpu event.
+
+ [35600.453346] cpu_event_pinne[41326]: illegal instruction (4)
+ at 10004a18 nip 10004a18 lr 100049f8 code 1 in
+ cpu_event_pinned_vs_ebb_test[10000000+10000]
+
+Test results after the patch:
+
+ $ ./pmu/ebb/cpu_event_pinned_vs_ebb_test
+ test: cpu_event_pinned_vs_ebb
+ tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty
+ Binding to cpu 8
+ EBB Handler is at 0x100050c8
+ read error on event 0x7fffe6bd4040!
+ PM_RUN_INST_CMPL: result 9872 running/enabled 37930432
+ success: cpu_event_pinned_vs_ebb
+
+This bug was hidden by other logic until commit 1908dc911792 (perf:
+Tweak perf_event_attr::exclusive semantics).
+
+Fixes: 4df489991182 ("powerpc/perf: Add power8 EBB support")
+Reported-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+[mpe: Mention commit 1908dc911792]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1617725761-1464-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index e4f577da33d8..8b5eeb6fb2fb 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -447,8 +447,8 @@ ebb_bhrb:
+ * EBB events are pinned & exclusive, so this should never actually
+ * hit, but we leave it as a fallback in case.
+ */
+- mask |= CNST_EBB_VAL(ebb);
+- value |= CNST_EBB_MASK;
++ mask |= CNST_EBB_MASK;
++ value |= CNST_EBB_VAL(ebb);
+
+ *maskp = mask;
+ *valp = value;
+--
+2.30.2
+
--- /dev/null
+From c7200636c031a588a4c1e0f82fcfd87da9f33ad1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 01:40:15 -0500
+Subject: powerpc/perf: Fix the threshold event selection for memory events in
+ power10
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 66d9b7492887d34c711bc05b36c22438acba51b4 ]
+
+Memory events (mem-loads and mem-stores) currently use the threshold
+event selection as issue to finish. Power10 supports issue to complete
+as part of thresholding which is more appropriate for mem-loads and
+mem-stores. Hence fix the event code for memory events to use issue
+to complete.
+
+Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1614840015-1535-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/power10-events-list.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/power10-events-list.h b/arch/powerpc/perf/power10-events-list.h
+index e45dafe818ed..93be7197d250 100644
+--- a/arch/powerpc/perf/power10-events-list.h
++++ b/arch/powerpc/perf/power10-events-list.h
+@@ -75,5 +75,5 @@ EVENT(PM_RUN_INST_CMPL_ALT, 0x00002);
+ * thresh end (TE)
+ */
+
+-EVENT(MEM_LOADS, 0x34340401e0);
+-EVENT(MEM_STORES, 0x343c0401e0);
++EVENT(MEM_LOADS, 0x35340401e0);
++EVENT(MEM_STORES, 0x353c0401e0);
+--
+2.30.2
+
--- /dev/null
+From f3fbfef27240eb02861e2e18cbdbac25df3c0fd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 13:08:29 -0700
+Subject: powerpc/prom: Mark identical_pvr_fixup as __init
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ]
+
+If identical_pvr_fixup() is not inlined, there are two modpost warnings:
+
+WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference
+from the function identical_pvr_fixup() to the function
+.init.text:of_get_flat_dt_prop()
+The function identical_pvr_fixup() references
+the function __init of_get_flat_dt_prop().
+This is often because identical_pvr_fixup lacks a __init
+annotation or the annotation of of_get_flat_dt_prop is wrong.
+
+WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference
+from the function identical_pvr_fixup() to the function
+.init.text:identify_cpu()
+The function identical_pvr_fixup() references
+the function __init identify_cpu().
+This is often because identical_pvr_fixup lacks a __init
+annotation or the annotation of identify_cpu is wrong.
+
+identical_pvr_fixup() calls two functions marked as __init and is only
+called by a function marked as __init so it should be marked as __init
+as well. At the same time, remove the inline keywork as it is not
+necessary to inline this function. The compiler is still free to do so
+if it feels it is worthwhile since commit 889b3c1245de ("compiler:
+remove CONFIG_OPTIMIZE_INLINING entirely").
+
+Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1316
+Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 9a4797d1d40d..a8b2d6bfc1ca 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -267,7 +267,7 @@ static struct feature_property {
+ };
+
+ #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU)
+-static inline void identical_pvr_fixup(unsigned long node)
++static __init void identical_pvr_fixup(unsigned long node)
+ {
+ unsigned int pvr;
+ const char *model = of_get_flat_dt_prop(node, "model", NULL);
+--
+2.30.2
+
--- /dev/null
+From fa3264361c089bd086a23597310fa8597b4f0f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 11:38:41 +1100
+Subject: powerpc/pseries: Add key to flags in
+ pSeries_lpar_hpte_updateboltedpp()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit b56d55a5aa4aa9fc166595a7feb57f153ef7b555 ]
+
+The flags argument to plpar_pte_protect() (aka. H_PROTECT), includes
+the key in bits 9-13, but currently we always set those bits to zero.
+
+In the past that hasn't been a problem because we always used key 0
+for the kernel, and updateboltedpp() is only used for kernel mappings.
+
+However since commit d94b827e89dc ("powerpc/book3s64/kuap: Use Key 3
+for kernel mapping with hash translation") we are now inadvertently
+changing the key (to zero) when we call plpar_pte_protect().
+
+That hasn't broken anything because updateboltedpp() is only used for
+STRICT_KERNEL_RWX, which is currently disabled on 64s due to other
+bugs.
+
+But we want to fix that, so first we need to pass the key correctly to
+plpar_pte_protect(). We can't pass our newpp value directly in, we
+have to convert it into the form expected by the hcall.
+
+The hcall we're using here is H_PROTECT, which is specified in section
+14.5.4.1.6 of LoPAPR v1.1.
+
+It takes a `flags` parameter, and the description for flags says:
+
+ * flags: AVPN, pp0, pp1, pp2, key0-key4, n, and for the CMO
+ option: CMO Option flags as defined in Table 189‚
+
+If you then go to the start of the parent section, 14.5.4.1, on page
+405, it says:
+
+Register Linkage (For hcall() tokens 0x04 - 0x18)
+ * On Call
+ * R3 function call token
+ * R4 flags (see Table 178‚ “Page Frame Table Access flags field
+ definition‚” on page 401)
+
+Then you have to go to section 14.5.3, and on page 394 there is a list
+of hcalls and their tokens (table 176), and there you can see that
+H_PROTECT == 0x18.
+
+Finally you can look at table 178, on page 401, where it specifies the
+layout of the bits for the key:
+
+ Bit Function
+ -----------------
+ 50-54 | key0-key4
+
+Those are big-endian bit numbers, converting to normal bit numbers you
+get bits 9-13, or 0x3e00.
+
+In the kernel we have:
+
+ #define HPTE_R_KEY_HI ASM_CONST(0x3000000000000000)
+ #define HPTE_R_KEY_LO ASM_CONST(0x0000000000000e00)
+
+So the LO bits of newpp are already in the right place, and the HI
+bits need to be shifted down by 48.
+
+Fixes: d94b827e89dc ("powerpc/book3s64/kuap: Use Key 3 for kernel mapping with hash translation")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210331003845.216246-2-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/lpar.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 3805519a6469..cd38bd421f38 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -977,11 +977,13 @@ static void pSeries_lpar_hpte_updateboltedpp(unsigned long newpp,
+ slot = pSeries_lpar_hpte_find(vpn, psize, ssize);
+ BUG_ON(slot == -1);
+
+- flags = newpp & 7;
++ flags = newpp & (HPTE_R_PP | HPTE_R_N);
+ if (mmu_has_feature(MMU_FTR_KERNEL_RO))
+ /* Move pp0 into bit 8 (IBM 55) */
+ flags |= (newpp & HPTE_R_PP0) >> 55;
+
++ flags |= ((newpp & HPTE_R_KEY_HI) >> 48) | (newpp & HPTE_R_KEY_LO);
++
+ lpar_rc = plpar_pte_protect(flags, slot, 0);
+
+ BUG_ON(lpar_rc != H_SUCCESS);
+--
+2.30.2
+
--- /dev/null
+From a87df629d06022b2913362d5e34e7d8570157cd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 12:24:35 -0600
+Subject: powerpc/pseries: extract host bridge from pci_bus prior to bus
+ removal
+
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+
+[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]
+
+The pci_bus->bridge reference may no longer be valid after
+pci_bus_remove() resulting in passing a bad value to device_unregister()
+for the associated bridge device.
+
+Store the host_bridge reference in a separate variable prior to
+pci_bus_remove().
+
+Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index f9ae17e8a0f4..a8f9140a24fa 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -50,6 +50,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);
+ int remove_phb_dynamic(struct pci_controller *phb)
+ {
+ struct pci_bus *b = phb->bus;
++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge);
+ struct resource *res;
+ int rc, i;
+
+@@ -76,7 +77,8 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ /* Remove the PCI bus and unregister the bridge device from sysfs */
+ phb->bus = NULL;
+ pci_remove_bus(b);
+- device_unregister(b->bridge);
++ host_bridge->bus = NULL;
++ device_unregister(&host_bridge->dev);
+
+ /* Now release the IO resource */
+ if (res->flags & IORESOURCE_IO)
+--
+2.30.2
+
--- /dev/null
+From 00e5588022535e59e23f7db5b388614a6872f47b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 01:54:04 -0300
+Subject: powerpc/pseries/iommu: Fix window size for direct mapping with pmem
+
+From: Leonardo Bras <leobras.c@gmail.com>
+
+[ Upstream commit a9d2f9bb225fd2a764aef57738ab6c7f38d782ae ]
+
+As of today, if the DDW is big enough to fit (1 << MAX_PHYSMEM_BITS)
+it's possible to use direct DMA mapping even with pmem region.
+
+But, if that happens, the window size (len) is set to (MAX_PHYSMEM_BITS
+- page_shift) instead of MAX_PHYSMEM_BITS, causing a pagesize times
+smaller DDW to be created, being insufficient for correct usage.
+
+Fix this so the correct window size is used in this case.
+
+Fixes: bf6e2d562bbc4 ("powerpc/dma: Fallback to dma_ops when persistent memory present")
+Signed-off-by: Leonardo Bras <leobras.c@gmail.com>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210420045404.438735-1-leobras.c@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
+index 9fc5217f0c8e..836cbbe0ecc5 100644
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -1229,7 +1229,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
+ if (pmem_present) {
+ if (query.largest_available_block >=
+ (1ULL << (MAX_PHYSMEM_BITS - page_shift)))
+- len = MAX_PHYSMEM_BITS - page_shift;
++ len = MAX_PHYSMEM_BITS;
+ else
+ dev_info(&dev->dev, "Skipping ibm,pmemory");
+ }
+--
+2.30.2
+
--- /dev/null
+From 01be24bd27a8ec6ed38373b654ad93c7229f2908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 12:09:38 +1100
+Subject: powerpc/pseries: Only register vio drivers if vio bus exists
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 11d92156f7a862091009d7655d19c1e7de37fc7a ]
+
+The vio bus is a fake bus, which we use on pseries LPARs (guests) to
+discover devices provided by the hypervisor. There's no need or sense
+in creating the vio bus on bare metal systems.
+
+Which is why commit 4336b9337824 ("powerpc/pseries: Make vio and
+ibmebus initcalls pseries specific") made the initialisation of the
+vio bus only happen in LPARs.
+
+However as a result of that commit we now see errors at boot on bare
+metal systems:
+
+ Driver 'hvc_console' was unable to register with bus_type 'vio' because the bus was not initialized.
+ Driver 'tpm_ibmvtpm' was unable to register with bus_type 'vio' because the bus was not initialized.
+
+This happens because those drivers are built-in, and are calling
+vio_register_driver(). It in turn calls driver_register() with a
+reference to vio_bus_type, but we haven't registered vio_bus_type with
+the driver core.
+
+Fix it by also guarding vio_register_driver() with a check to see if
+we are on pseries.
+
+Fixes: 4336b9337824 ("powerpc/pseries: Make vio and ibmebus initcalls pseries specific")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210316010938.525657-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/vio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/vio.c b/arch/powerpc/platforms/pseries/vio.c
+index 9cb4fc839fd5..429053d0402a 100644
+--- a/arch/powerpc/platforms/pseries/vio.c
++++ b/arch/powerpc/platforms/pseries/vio.c
+@@ -1285,6 +1285,10 @@ static int vio_bus_remove(struct device *dev)
+ int __vio_register_driver(struct vio_driver *viodrv, struct module *owner,
+ const char *mod_name)
+ {
++ // vio_bus_type is only initialised for pseries
++ if (!machine_is(pseries))
++ return -ENODEV;
++
+ pr_debug("%s: driver %s registering\n", __func__, viodrv->name);
+
+ /* fill in 'struct driver' fields */
+--
+2.30.2
+
--- /dev/null
+From 799492d057c718b3a485bfd9f91fb59c8af1d5db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 17:39:32 +0530
+Subject: powerpc/smp: Reintroduce cpu_core_mask
+
+From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+
+[ Upstream commit c47f892d7aa62765bf0689073f75990b4517a4cf ]
+
+Daniel reported that with Commit 4ca234a9cbd7 ("powerpc/smp: Stop
+updating cpu_core_mask") QEMU was unable to set single NUMA node SMP
+topologies such as:
+ -smp 8,maxcpus=8,cores=2,threads=2,sockets=2
+ i.e he expected 2 sockets in one NUMA node.
+
+The above commit helped to reduce boot time on Large Systems for
+example 4096 vCPU single socket QEMU instance. PAPR is silent on
+having more than one socket within a NUMA node.
+
+cpu_core_mask and cpu_cpu_mask for any CPU would be same unless the
+number of sockets is different from the number of NUMA nodes.
+
+One option is to reintroduce cpu_core_mask but use a slightly
+different method to arrive at the cpu_core_mask. Previously each CPU's
+chip-id would be compared with all other CPU's chip-id to verify if
+both the CPUs were related at the chip level. Now if a CPU 'A' is
+found related / (unrelated) to another CPU 'B', all the thread
+siblings of 'A' and thread siblings of 'B' are automatically marked as
+related / (unrelated).
+
+Also if a platform doesn't support ibm,chip-id property, i.e its
+cpu_to_chip_id returns -1, cpu_core_map holds a copy of
+cpu_cpu_mask().
+
+Fixes: 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask")
+Reported-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Tested-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210415120934.232271-2-srikar@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/smp.h | 5 +++++
+ arch/powerpc/kernel/smp.c | 39 ++++++++++++++++++++++++++++------
+ 2 files changed, 37 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
+index 7a13bc20f0a0..47081a9e13ca 100644
+--- a/arch/powerpc/include/asm/smp.h
++++ b/arch/powerpc/include/asm/smp.h
+@@ -121,6 +121,11 @@ static inline struct cpumask *cpu_sibling_mask(int cpu)
+ return per_cpu(cpu_sibling_map, cpu);
+ }
+
++static inline struct cpumask *cpu_core_mask(int cpu)
++{
++ return per_cpu(cpu_core_map, cpu);
++}
++
+ static inline struct cpumask *cpu_l2_cache_mask(int cpu)
+ {
+ return per_cpu(cpu_l2_cache_map, cpu);
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 5a4d59a1070d..5c7ce1d50631 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1057,17 +1057,12 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ local_memory_node(numa_cpu_lookup_table[cpu]));
+ }
+ #endif
+- /*
+- * cpu_core_map is now more updated and exists only since
+- * its been exported for long. It only will have a snapshot
+- * of cpu_cpu_mask.
+- */
+- cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu));
+ }
+
+ /* Init the cpumasks so the boot CPU is related to itself */
+ cpumask_set_cpu(boot_cpuid, cpu_sibling_mask(boot_cpuid));
+ cpumask_set_cpu(boot_cpuid, cpu_l2_cache_mask(boot_cpuid));
++ cpumask_set_cpu(boot_cpuid, cpu_core_mask(boot_cpuid));
+
+ if (has_coregroup_support())
+ cpumask_set_cpu(boot_cpuid, cpu_coregroup_mask(boot_cpuid));
+@@ -1408,6 +1403,9 @@ static void remove_cpu_from_masks(int cpu)
+ set_cpus_unrelated(cpu, i, cpu_smallcore_mask);
+ }
+
++ for_each_cpu(i, cpu_core_mask(cpu))
++ set_cpus_unrelated(cpu, i, cpu_core_mask);
++
+ if (has_coregroup_support()) {
+ for_each_cpu(i, cpu_coregroup_mask(cpu))
+ set_cpus_unrelated(cpu, i, cpu_coregroup_mask);
+@@ -1468,8 +1466,11 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)
+
+ static void add_cpu_to_masks(int cpu)
+ {
++ struct cpumask *(*submask_fn)(int) = cpu_sibling_mask;
+ int first_thread = cpu_first_thread_sibling(cpu);
++ int chip_id = cpu_to_chip_id(cpu);
+ cpumask_var_t mask;
++ bool ret;
+ int i;
+
+ /*
+@@ -1485,12 +1486,36 @@ static void add_cpu_to_masks(int cpu)
+ add_cpu_to_smallcore_masks(cpu);
+
+ /* In CPU-hotplug path, hence use GFP_ATOMIC */
+- alloc_cpumask_var_node(&mask, GFP_ATOMIC, cpu_to_node(cpu));
++ ret = alloc_cpumask_var_node(&mask, GFP_ATOMIC, cpu_to_node(cpu));
+ update_mask_by_l2(cpu, &mask);
+
+ if (has_coregroup_support())
+ update_coregroup_mask(cpu, &mask);
+
++ if (chip_id == -1 || !ret) {
++ cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu));
++ goto out;
++ }
++
++ if (shared_caches)
++ submask_fn = cpu_l2_cache_mask;
++
++ /* Update core_mask with all the CPUs that are part of submask */
++ or_cpumasks_related(cpu, cpu, submask_fn, cpu_core_mask);
++
++ /* Skip all CPUs already part of current CPU core mask */
++ cpumask_andnot(mask, cpu_online_mask, cpu_core_mask(cpu));
++
++ for_each_cpu(i, mask) {
++ if (chip_id == cpu_to_chip_id(i)) {
++ or_cpumasks_related(cpu, i, submask_fn, cpu_core_mask);
++ cpumask_andnot(mask, mask, submask_fn(i));
++ } else {
++ cpumask_andnot(mask, mask, cpu_core_mask(i));
++ }
++ }
++
++out:
+ free_cpumask_var(mask);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 38156c3a7b15aa20d50d3fa862aaa6c96c1c8dad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 20:41:55 +1000
+Subject: powerpc/syscall: switch user_exit_irqoff and trace_hardirqs_off order
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 5a5a893c4ad897b8a36f846602895515b7407a71 ]
+
+user_exit_irqoff() -> __context_tracking_exit -> vtime_user_exit
+warns in __seqprop_assert due to lockdep thinking preemption is enabled
+because trace_hardirqs_off() has not yet been called.
+
+Switch the order of these two calls, which matches their ordering in
+interrupt_enter_prepare.
+
+Fixes: 5f0b6ac3905f ("powerpc/64/syscall: Reconcile interrupts")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210316104206.407354-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/interrupt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c
+index c475a229a42a..352346e14a08 100644
+--- a/arch/powerpc/kernel/interrupt.c
++++ b/arch/powerpc/kernel/interrupt.c
+@@ -34,11 +34,11 @@ notrace long system_call_exception(long r3, long r4, long r5,
+ if (IS_ENABLED(CONFIG_PPC_IRQ_SOFT_MASK_DEBUG))
+ BUG_ON(irq_soft_mask_return() != IRQS_ALL_DISABLED);
+
++ trace_hardirqs_off(); /* finish reconciling */
++
+ CT_WARN_ON(ct_state() == CONTEXT_KERNEL);
+ user_exit_irqoff();
+
+- trace_hardirqs_off(); /* finish reconciling */
+-
+ if (!IS_ENABLED(CONFIG_BOOKE) && !IS_ENABLED(CONFIG_40x))
+ BUG_ON(!(regs->msr & MSR_RI));
+ BUG_ON(!(regs->msr & MSR_PR));
+--
+2.30.2
+
--- /dev/null
+From 2a64ec3b50a2df34667d6d6b96d86a3dda600366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 16:45:10 +0200
+Subject: powerpc/xive: Drop check on irq_data in xive_core_debug_show()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit a74ce5926b20cd0e6d624a9b2527073a96dfed7f ]
+
+When looping on IRQ descriptor, irq_data is always valid.
+
+Fixes: 930914b7d528 ("powerpc/xive: Add a debugfs file to dump internal XIVE state")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210331144514.892250-6-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/xive/common.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 595310e056f4..6e43bba80707 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -1599,6 +1599,8 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_data
+ u32 target;
+ u8 prio;
+ u32 lirq;
++ struct xive_irq_data *xd;
++ u64 val;
+
+ if (!is_xive_irq(chip))
+ return;
+@@ -1612,17 +1614,14 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_data
+ seq_printf(m, "IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x ",
+ hw_irq, target, prio, lirq);
+
+- if (d) {
+- struct xive_irq_data *xd = irq_data_get_irq_handler_data(d);
+- u64 val = xive_esb_read(xd, XIVE_ESB_GET);
+-
+- seq_printf(m, "flags=%c%c%c PQ=%c%c",
+- xd->flags & XIVE_IRQ_FLAG_STORE_EOI ? 'S' : ' ',
+- xd->flags & XIVE_IRQ_FLAG_LSI ? 'L' : ' ',
+- xd->flags & XIVE_IRQ_FLAG_H_INT_ESB ? 'H' : ' ',
+- val & XIVE_ESB_VAL_P ? 'P' : '-',
+- val & XIVE_ESB_VAL_Q ? 'Q' : '-');
+- }
++ xd = irq_data_get_irq_handler_data(d);
++ val = xive_esb_read(xd, XIVE_ESB_GET);
++ seq_printf(m, "flags=%c%c%c PQ=%c%c",
++ xd->flags & XIVE_IRQ_FLAG_STORE_EOI ? 'S' : ' ',
++ xd->flags & XIVE_IRQ_FLAG_LSI ? 'L' : ' ',
++ xd->flags & XIVE_IRQ_FLAG_H_INT_ESB ? 'H' : ' ',
++ val & XIVE_ESB_VAL_P ? 'P' : '-',
++ val & XIVE_ESB_VAL_Q ? 'Q' : '-');
+ seq_puts(m, "\n");
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 02acf0fb3b6392c77da9e983ca521773950cbf35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 16:45:12 +0200
+Subject: powerpc/xive: Fix xmon command "dxi"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit 33e4bc5946432a4ac173fd08e8e30a13ab94d06d ]
+
+When under xmon, the "dxi" command dumps the state of the XIVE
+interrupts. If an interrupt number is specified, only the state of
+the associated XIVE interrupt is dumped. This form of the command
+lacks an irq_data parameter which is nevertheless used by
+xmon_xive_get_irq_config(), leading to an xmon crash.
+
+Fix that by doing a lookup in the system IRQ mapping to query the IRQ
+descriptor data. Invalid interrupt numbers, or not belonging to the
+XIVE IRQ domain, OPAL event interrupt number for instance, should be
+caught by the previous query done at the firmware level.
+
+Fixes: 97ef27507793 ("powerpc/xive: Fix xmon support on the PowerNV platform")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Greg Kurz <groug@kaod.org>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210331144514.892250-8-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/xive/common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 6e43bba80707..5cacb632eb37 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -253,17 +253,20 @@ notrace void xmon_xive_do_dump(int cpu)
+ xmon_printf("\n");
+ }
+
++static struct irq_data *xive_get_irq_data(u32 hw_irq)
++{
++ unsigned int irq = irq_find_mapping(xive_irq_domain, hw_irq);
++
++ return irq ? irq_get_irq_data(irq) : NULL;
++}
++
+ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)
+ {
+- struct irq_chip *chip = irq_data_get_irq_chip(d);
+ int rc;
+ u32 target;
+ u8 prio;
+ u32 lirq;
+
+- if (!is_xive_irq(chip))
+- return -EINVAL;
+-
+ rc = xive_ops->get_irq_config(hw_irq, &target, &prio, &lirq);
+ if (rc) {
+ xmon_printf("IRQ 0x%08x : no config rc=%d\n", hw_irq, rc);
+@@ -273,6 +276,9 @@ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)
+ xmon_printf("IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x ",
+ hw_irq, target, prio, lirq);
+
++ if (!d)
++ d = xive_get_irq_data(hw_irq);
++
+ if (d) {
+ struct xive_irq_data *xd = irq_data_get_irq_handler_data(d);
+ u64 val = xive_esb_read(xd, XIVE_ESB_GET);
+--
+2.30.2
+
--- /dev/null
+From bdb599810b62701b1df53a82718b02e23a8fe7f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:15:16 +0100
+Subject: printk: limit second loop of syslog_print_all
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit bb07b16c44b2c6ddbafa44bb06454719002e828e ]
+
+The second loop of syslog_print_all() subtracts lengths that were
+added in the first loop. With commit b031a684bfd0 ("printk: remove
+logbuf_lock writer-protection of ringbuffer") it is possible that
+records are (over)written during syslog_print_all(). This allows the
+possibility of the second loop subtracting lengths that were never
+added in the first loop.
+
+This situation can result in syslog_print_all() filling the buffer
+starting from a later record, even though there may have been room
+to fit the earlier record(s) as well.
+
+Fixes: b031a684bfd0 ("printk: remove logbuf_lock writer-protection of ringbuffer")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20210303101528.29901-4-john.ogness@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 575a34b88936..77ae2704e979 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1494,6 +1494,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
+ struct printk_info info;
+ unsigned int line_count;
+ struct printk_record r;
++ u64 max_seq;
+ char *text;
+ int len = 0;
+ u64 seq;
+@@ -1512,9 +1513,15 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
+ prb_for_each_info(clear_seq, prb, seq, &info, &line_count)
+ len += get_record_print_text_size(&info, line_count, true, time);
+
++ /*
++ * Set an upper bound for the next loop to avoid subtracting lengths
++ * that were never added.
++ */
++ max_seq = seq;
++
+ /* move first record forward until length fits into the buffer */
+ prb_for_each_info(clear_seq, prb, seq, &info, &line_count) {
+- if (len <= size)
++ if (len <= size || info.seq >= max_seq)
+ break;
+ len -= get_record_print_text_size(&info, line_count, true, time);
+ }
+--
+2.30.2
+
--- /dev/null
+From 22d94a3daed4a50c45c3cc45684a36ace35248d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 09:08:59 +0800
+Subject: rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 6494ccb93271bee596a12db32ff44867d5be2321 ]
+
+In rcu_nmi_enter(), there is an erroneous instrumentation_end() in the
+second branch of the "if" statement. Oddly enough, "objtool check -f
+vmlinux.o" fails to complain because it is unable to correctly cover
+all cases. Instead, objtool visits the third branch first, which marks
+following trace_rcu_dyntick() as visited. This commit therefore removes
+the spurious instrumentation_end().
+
+Fixes: 04b25a495bd6 ("rcu: Mark rcu_nmi_enter() call to rcu_cleanup_after_idle() noinstr")
+Reported-by Neeraj Upadhyay <neeraju@codeaurora.org>
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 2a739c5fcca5..7356764e49a0 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -1077,7 +1077,6 @@ noinstr void rcu_nmi_enter(void)
+ } else if (!in_nmi()) {
+ instrumentation_begin();
+ rcu_irq_enter_check_tick();
+- instrumentation_end();
+ } else {
+ instrumentation_begin();
+ }
+--
+2.30.2
+
--- /dev/null
+From 21f4e6ebaf9ee45cb960968318b8f0220eb313e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 07:06:14 -0700
+Subject: RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ]
+
+In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside
+bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via
+pci_iounmap() in unmap_io error branch. After the callee returns err code,
+bnxt_qplib_alloc_res calls
+bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then
+dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap().
+
+My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by
+pci_iounmap() in the first time, to avoid the double free.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Acked-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+index fa7878336100..3ca47004b752 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+@@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res,
+
+ unmap_io:
+ pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem);
++ dpit->dbr_bar_reg_iomem = NULL;
+ return -ENOMEM;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 3ed7a88d9fdbfa280b20214dfb7cf72f9541427c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:37 +0000
+Subject: RDMA/bnxt_re: Fix error return code in
+ bnxt_qplib_cq_process_terminal()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 22efb0a8d130c6379c1eb64cbace1542b27e37ff ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/20210408113137.97202-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 995d4633b0a1..d4d4959c2434 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -2784,6 +2784,7 @@ do_rq:
+ dev_err(&cq->hwq.pdev->dev,
+ "FP: CQ Processed terminal reported rq_cons_idx 0x%x exceeds max 0x%x\n",
+ cqe_cons, rq->max_wqe);
++ rc = -EINVAL;
+ goto done;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9952d3b396c61628abc5ddb98a3b2bc714084751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Apr 2021 16:55:54 +0300
+Subject: RDMA/core: Add CM to restrack after successful attachment to a device
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa ]
+
+The device attach triggers addition of CM_ID to the restrack DB.
+However, when error occurs, we releasing this device, but defer CM_ID
+release. This causes to the situation where restrack sees CM_ID that
+is not valid anymore.
+
+As a solution, add the CM_ID to the resource tracking DB only after the
+attachment is finished.
+
+Found by syzcaller:
+infiniband syz0: added syz_tun
+rdma_rxe: ignoring netdev event = 10 for syz_tun
+infiniband syz0: set down
+infiniband syz0: ib_query_port failed (-19)
+restrack: ------------[ cut here ]------------
+infiniband syz0: BUG: RESTRACK detected leak of resources
+restrack: User CM_ID object allocated by syz-executor716 is not freed
+restrack: ------------[ cut here ]------------
+
+Fixes: b09c4d701220 ("RDMA/restrack: Improve readability in task name management")
+Link: https://lore.kernel.org/r/ab93e56ba831eac65c322b3256796fa1589ec0bb.1618753862.git.leonro@nvidia.com
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 94096511599f..6ac07911a17b 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -463,7 +463,6 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv,
+ id_priv->id.route.addr.dev_addr.transport =
+ rdma_node_get_transport(cma_dev->device->node_type);
+ list_add_tail(&id_priv->list, &cma_dev->id_list);
+- rdma_restrack_add(&id_priv->res);
+
+ trace_cm_id_attach(id_priv, cma_dev->device);
+ }
+@@ -700,6 +699,7 @@ static int cma_ib_acquire_dev(struct rdma_id_private *id_priv,
+ mutex_lock(&lock);
+ cma_attach_to_dev(id_priv, listen_id_priv->cma_dev);
+ mutex_unlock(&lock);
++ rdma_restrack_add(&id_priv->res);
+ return 0;
+ }
+
+@@ -754,8 +754,10 @@ static int cma_iw_acquire_dev(struct rdma_id_private *id_priv,
+ }
+
+ out:
+- if (!ret)
++ if (!ret) {
+ cma_attach_to_dev(id_priv, cma_dev);
++ rdma_restrack_add(&id_priv->res);
++ }
+
+ mutex_unlock(&lock);
+ return ret;
+@@ -816,6 +818,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
+
+ found:
+ cma_attach_to_dev(id_priv, cma_dev);
++ rdma_restrack_add(&id_priv->res);
+ mutex_unlock(&lock);
+ addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+ memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
+@@ -2529,6 +2532,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+ rdma_addr_size(cma_src_addr(id_priv)));
+
+ _cma_attach_to_dev(dev_id_priv, cma_dev);
++ rdma_restrack_add(&dev_id_priv->res);
+ cma_id_get(id_priv);
+ dev_id_priv->internal_id = 1;
+ dev_id_priv->afonly = id_priv->afonly;
+@@ -3169,6 +3173,7 @@ port_found:
+ ib_addr_set_pkey(&id_priv->id.route.addr.dev_addr, pkey);
+ id_priv->id.port_num = p;
+ cma_attach_to_dev(id_priv, cma_dev);
++ rdma_restrack_add(&id_priv->res);
+ cma_set_loopback(cma_src_addr(id_priv));
+ out:
+ mutex_unlock(&lock);
+@@ -3201,6 +3206,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ if (status)
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n",
+ status);
++ rdma_restrack_add(&id_priv->res);
+ } else if (status) {
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status);
+ }
+@@ -3812,6 +3818,8 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
+ if (ret)
+ goto err2;
+
++ if (!cma_any_addr(addr))
++ rdma_restrack_add(&id_priv->res);
+ return 0;
+ err2:
+ if (id_priv->cma_dev)
+--
+2.30.2
+
--- /dev/null
+From ba1bba3e273f593807265d6dc0c9cf0ed9ac4bf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 14:35:32 +0100
+Subject: RDMA/core: Fix corrupted SL on passive side
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 194f64a3cad3ab9e381e996a13089de3215d1887 ]
+
+On RoCE systems, a CM REQ contains a Primary Hop Limit > 1 and Primary
+Subnet Local is zero.
+
+In cm_req_handler(), the cm_process_routed_req() function is called. Since
+the Primary Subnet Local value is zero in the request, and since this is
+RoCE (Primary Local LID is permissive), the following statement will be
+executed:
+
+ IBA_SET(CM_REQ_PRIMARY_SL, req_msg, wc->sl);
+
+This corrupts SL in req_msg if it was different from zero. In other words,
+a request to setup a connection using an SL != zero, will not be honored,
+and a connection using SL zero will be created instead.
+
+Fixed by not calling cm_process_routed_req() on RoCE systems, the
+cm_process_route_req() is only for IB anyhow.
+
+Fixes: 3971c9f6dbf2 ("IB/cm: Add interim support for routed paths")
+Link: https://lore.kernel.org/r/1616420132-31005-1-git-send-email-haakon.bugge@oracle.com
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 3d194bb60840..6adbaea358ae 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -2138,7 +2138,8 @@ static int cm_req_handler(struct cm_work *work)
+ goto destroy;
+ }
+
+- cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
++ if (cm_id_priv->av.ah_attr.type != RDMA_AH_ATTR_TYPE_ROCE)
++ cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
+
+ memset(&work->path[0], 0, sizeof(work->path[0]));
+ if (cm_req_has_alt_path(req_msg))
+--
+2.30.2
+
--- /dev/null
+From 02da80a6b7117e02835fe190bd40e4898c284571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 20:44:22 +0530
+Subject: RDMA/cxgb4: add missing qpid increment
+
+From: Potnuri Bharat Teja <bharat@chelsio.com>
+
+[ Upstream commit 3a6684385928d00b29acac7658a5ae1f2a44494c ]
+
+missing qpid increment leads to skipping few qpids while allocating QP.
+This eventually leads to adapter running out of qpids after establishing
+fewer connections than it actually supports.
+Current patch increments the qpid correctly.
+
+Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
+Link: https://lore.kernel.org/r/20210415151422.9139-1-bharat@chelsio.com
+Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
+index 5c95c789f302..e800e8e8bed5 100644
+--- a/drivers/infiniband/hw/cxgb4/resource.c
++++ b/drivers/infiniband/hw/cxgb4/resource.c
+@@ -216,7 +216,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+ goto out;
+ entry->qid = qid;
+ list_add_tail(&entry->entry, &uctx->cqids);
+- for (i = qid; i & rdev->qpmask; i++) {
++ for (i = qid + 1; i & rdev->qpmask; i++) {
+ entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From 4122a28388aa0215bfd13d16f0175d5b0f2dd58f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 17:07:27 +0800
+Subject: RDMA/hns: Fix missing assignment of max_inline_data
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit 9eab614338cdfe08db343954454fa5191d082a11 ]
+
+When querying QP, the ULPs should be informed of the max length of inline
+data supported by the hardware.
+
+Fixes: 30b707886aeb ("RDMA/hns: Support inline data in extented sge space for RC")
+Link: https://lore.kernel.org/r/1617354454-47840-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index ce26f97b2ca2..ad3cee54140e 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5068,6 +5068,7 @@ done:
+ qp_attr->cur_qp_state = qp_attr->qp_state;
+ qp_attr->cap.max_recv_wr = hr_qp->rq.wqe_cnt;
+ qp_attr->cap.max_recv_sge = hr_qp->rq.max_gs - hr_qp->rq.rsv_sge;
++ qp_attr->cap.max_inline_data = hr_qp->max_inline_data;
+
+ if (!ibqp->uobject) {
+ qp_attr->cap.max_send_wr = hr_qp->sq.wqe_cnt;
+--
+2.30.2
+
--- /dev/null
+From 150b991a51b6e4c793244b874e116692e382a8ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 19:21:04 -0500
+Subject: RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
+
+From: Sindhu Devale <sindhu.devale@intel.com>
+
+[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ]
+
+When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk
+entry in the PBLE info list.
+
+Fix it by adding the chunk entry to the PBLE info list only after
+successful addition of SD in i40iw_hmc_sd_one.
+
+This fixes a static checker warning reported here:
+ https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/
+
+Fixes: 9715830157be ("i40iw: add pble resource files")
+Link: https://lore.kernel.org/r/20210416002104.323-1-shiraz.saleem@intel.com
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+index 53e5cd1a2bd6..146a4148219b 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+@@ -393,12 +393,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n",
+ pble_rsrc->next_fpm_addr, chunk->size, chunk->size);
+ pble_rsrc->unallocated_pble -= (chunk->size >> 3);
+- list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ?
+ sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa;
+- if (sd_entry->valid)
+- return 0;
+- if (dev->is_pf) {
++ if (dev->is_pf && !sd_entry->valid) {
+ ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id,
+ sd_reg_val, idx->sd_idx,
+ sd_entry->entry_type, true);
+@@ -409,6 +406,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ }
+
+ sd_entry->valid = true;
++ list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ return 0;
+ error:
+ kfree(chunk);
+--
+2.30.2
+
--- /dev/null
+From bd874244597130f9e016953e356fe0bf3e71183f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 15:51:23 +0200
+Subject: RDMA/mlx5: Fix drop packet rule in egress table
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit c73700806d4e430d182c2be069d230076818a99a ]
+
+Initial drop action support missed that drop action can be added to egress
+flow tables as well. Add the missing support.
+
+This requires making sure that dest_type isn't set to PORT which in turn
+exposes a possibility of passing dst while indicating number of dsts as
+zero. Explicitly check for number of dsts and pass the appropriate
+pointer.
+
+Fixes: f29de9eee782 ("RDMA/mlx5: Add support for drop action in DV steering")
+Link: https://lore.kernel.org/r/20210318135123.680759-1-leon@kernel.org
+Reviewed-by: Mark Bloch <markb@nvidia.com>
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/fs.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c
+index 25da0b05b4e2..f0af3f1ae039 100644
+--- a/drivers/infiniband/hw/mlx5/fs.c
++++ b/drivers/infiniband/hw/mlx5/fs.c
+@@ -1528,8 +1528,8 @@ static struct mlx5_ib_flow_handler *raw_fs_rule_add(
+ dst_num++;
+ }
+
+- handler = _create_raw_flow_rule(dev, ft_prio, dst, fs_matcher,
+- flow_context, flow_act,
++ handler = _create_raw_flow_rule(dev, ft_prio, dst_num ? dst : NULL,
++ fs_matcher, flow_context, flow_act,
+ cmd_in, inlen, dst_num);
+
+ if (IS_ERR(handler)) {
+@@ -1885,8 +1885,9 @@ static int get_dests(struct uverbs_attr_bundle *attrs,
+ else
+ *dest_id = mqp->raw_packet_qp.rq.tirn;
+ *dest_type = MLX5_FLOW_DESTINATION_TYPE_TIR;
+- } else if (fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_EGRESS ||
+- fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_RDMA_TX) {
++ } else if ((fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_EGRESS ||
++ fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_RDMA_TX) &&
++ !(*flags & MLX5_IB_ATTR_CREATE_FLOW_FLAGS_DROP)) {
+ *dest_type = MLX5_FLOW_DESTINATION_TYPE_PORT;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 539bc81d676dd269c809567037e9e1f91003fce5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 14:45:17 +0200
+Subject: RDMA/mlx5: Fix mlx5 rates to IB rates map
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 6fe6e568639859db960c8fcef19a2ece1c2d7eae ]
+
+Correct the map between mlx5 rates and corresponding ib rates, as they
+don't always have a fixed offset between them.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Link: https://lore.kernel.org/r/20210304124517.1100608-4-leon@kernel.org
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index f5a52a6fae43..843f9e7fe96f 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3146,6 +3146,19 @@ enum {
+ MLX5_PATH_FLAG_COUNTER = 1 << 2,
+ };
+
++static int mlx5_to_ib_rate_map(u8 rate)
++{
++ static const int rates[] = { IB_RATE_PORT_CURRENT, IB_RATE_56_GBPS,
++ IB_RATE_25_GBPS, IB_RATE_100_GBPS,
++ IB_RATE_200_GBPS, IB_RATE_50_GBPS,
++ IB_RATE_400_GBPS };
++
++ if (rate < ARRAY_SIZE(rates))
++ return rates[rate];
++
++ return rate - MLX5_STAT_RATE_OFFSET;
++}
++
+ static int ib_to_mlx5_rate_map(u8 rate)
+ {
+ switch (rate) {
+@@ -4485,7 +4498,7 @@ static void to_rdma_ah_attr(struct mlx5_ib_dev *ibdev,
+ rdma_ah_set_path_bits(ah_attr, MLX5_GET(ads, path, mlid));
+
+ static_rate = MLX5_GET(ads, path, stat_rate);
+- rdma_ah_set_static_rate(ah_attr, static_rate ? static_rate - 5 : 0);
++ rdma_ah_set_static_rate(ah_attr, mlx5_to_ib_rate_map(static_rate));
+ if (MLX5_GET(ads, path, grh) ||
+ ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) {
+ rdma_ah_set_grh(ah_attr, NULL, MLX5_GET(ads, path, flow_label),
+--
+2.30.2
+
--- /dev/null
+From 971aaf0d0b878c6b1a8d370db4a4b0ceb057c993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 14:45:15 +0200
+Subject: RDMA/mlx5: Fix query RoCE port
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 7852546f524595245382a919e752468f73421451 ]
+
+mlx5_is_roce_enabled returns the devlink RoCE init value, therefore it
+should be used only when driver is loaded. Instead we just need to read
+the roce_en field.
+
+In addition, rename mlx5_is_roce_enabled to mlx5_is_roce_init_enabled.
+
+Fixes: 7a58779edd75 ("IB/mlx5: Improve query port for representor port")
+Link: https://lore.kernel.org/r/20210304124517.1100608-2-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 6 +++---
+ include/linux/mlx5/driver.h | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 0d69a697d75f..4be7bccefaa4 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -499,7 +499,7 @@ static int mlx5_query_port_roce(struct ib_device *device, u8 port_num,
+ translate_eth_proto_oper(eth_prot_oper, &props->active_speed,
+ &props->active_width, ext);
+
+- if (!dev->is_rep && mlx5_is_roce_enabled(mdev)) {
++ if (!dev->is_rep && dev->mdev->roce.roce_en) {
+ u16 qkey_viol_cntr;
+
+ props->port_cap_flags |= IB_PORT_CM_SUP;
+@@ -4174,7 +4174,7 @@ static int mlx5_ib_roce_init(struct mlx5_ib_dev *dev)
+
+ /* Register only for native ports */
+ err = mlx5_add_netdev_notifier(dev, port_num);
+- if (err || dev->is_rep || !mlx5_is_roce_enabled(mdev))
++ if (err || dev->is_rep || !mlx5_is_roce_init_enabled(mdev))
+ /*
+ * We don't enable ETH interface for
+ * 1. IB representors
+@@ -4711,7 +4711,7 @@ static int mlx5r_probe(struct auxiliary_device *adev,
+ dev->mdev = mdev;
+ dev->num_ports = num_ports;
+
+- if (ll == IB_LINK_LAYER_ETHERNET && !mlx5_is_roce_enabled(mdev))
++ if (ll == IB_LINK_LAYER_ETHERNET && !mlx5_is_roce_init_enabled(mdev))
+ profile = &raw_eth_profile;
+ else
+ profile = &pf_profile;
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 53b89631a1d9..ab07f09f2bad 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1226,7 +1226,7 @@ enum {
+ MLX5_TRIGGERED_CMD_COMP = (u64)1 << 32,
+ };
+
+-static inline bool mlx5_is_roce_enabled(struct mlx5_core_dev *dev)
++static inline bool mlx5_is_roce_init_enabled(struct mlx5_core_dev *dev)
+ {
+ struct devlink *devlink = priv_to_devlink(dev);
+ union devlink_param_value val;
+--
+2.30.2
+
--- /dev/null
+From f3feb52681b84e7637f06b2f2ed36d5c1bb94833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 14:07:42 +0200
+Subject: RDMA/mlx5: Zero out ODP related items in the mlx5_ib_mr
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit a639e66703ee45745dc4057c7c2013ed9e1963a7 ]
+
+All of the ODP code assumes when it calls mlx5_mr_cache_alloc() the ODP
+related fields are zero'd. This is true if the MR was just allocated, but
+if the MR is recycled through the cache then the values are never zero'd.
+
+This causes a bug in the odp_stats, they don't reset when the MR is
+reallocated, also is_odp_implicit is never 0'd.
+
+So we can use memset on a block of the mlx5_ib_mr reorganize the structure
+to put all the data that can be zero'd by the cache at the end.
+
+It is organized as an anonymous struct because the next patch will make
+this a union.
+
+Delete the unused smr_info. Don't set the kernel only desc_size on the
+user path. No longer any need to zero mr->parent before freeing it, the
+memset() will get it now.
+
+Fixes: a3de94e3d61e ("IB/mlx5: Introduce ODP diagnostic counters")
+Link: https://lore.kernel.org/r/20210304120745.1090751-2-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 103 ++++++++++++++++-----------
+ drivers/infiniband/hw/mlx5/mr.c | 14 ++--
+ drivers/infiniband/hw/mlx5/odp.c | 1 -
+ 3 files changed, 66 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 88cc26e008fc..b085c02b53d0 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -547,11 +547,6 @@ static inline const struct mlx5_umr_wr *umr_wr(const struct ib_send_wr *wr)
+ return container_of(wr, struct mlx5_umr_wr, wr);
+ }
+
+-struct mlx5_shared_mr_info {
+- int mr_id;
+- struct ib_umem *umem;
+-};
+-
+ enum mlx5_ib_cq_pr_flags {
+ MLX5_IB_CQ_PR_FLAGS_CQE_128_PAD = 1 << 0,
+ };
+@@ -654,47 +649,69 @@ struct mlx5_ib_dm {
+ atomic64_add(value, &((mr)->odp_stats.counter_name))
+
+ struct mlx5_ib_mr {
+- struct ib_mr ibmr;
+- void *descs;
+- dma_addr_t desc_map;
+- int ndescs;
+- int data_length;
+- int meta_ndescs;
+- int meta_length;
+- int max_descs;
+- int desc_size;
+- int access_mode;
+- unsigned int page_shift;
+- struct mlx5_core_mkey mmkey;
+- struct ib_umem *umem;
+- struct mlx5_shared_mr_info *smr_info;
+- struct list_head list;
+- struct mlx5_cache_ent *cache_ent;
+- u32 out[MLX5_ST_SZ_DW(create_mkey_out)];
+- struct mlx5_core_sig_ctx *sig;
+- void *descs_alloc;
+- int access_flags; /* Needed for rereg MR */
+-
+- struct mlx5_ib_mr *parent;
+- /* Needed for IB_MR_TYPE_INTEGRITY */
+- struct mlx5_ib_mr *pi_mr;
+- struct mlx5_ib_mr *klm_mr;
+- struct mlx5_ib_mr *mtt_mr;
+- u64 data_iova;
+- u64 pi_iova;
+-
+- /* For ODP and implicit */
+- struct xarray implicit_children;
+- union {
+- struct list_head elm;
+- struct work_struct work;
+- } odp_destroy;
+- struct ib_odp_counters odp_stats;
+- bool is_odp_implicit;
++ struct ib_mr ibmr;
++ struct mlx5_core_mkey mmkey;
+
+- struct mlx5_async_work cb_work;
++ /* User MR data */
++ struct mlx5_cache_ent *cache_ent;
++ struct ib_umem *umem;
++
++ /* This is zero'd when the MR is allocated */
++ struct {
++ /* Used only while the MR is in the cache */
++ struct {
++ u32 out[MLX5_ST_SZ_DW(create_mkey_out)];
++ struct mlx5_async_work cb_work;
++ /* Cache list element */
++ struct list_head list;
++ };
++
++ /* Used only by kernel MRs (umem == NULL) */
++ struct {
++ void *descs;
++ void *descs_alloc;
++ dma_addr_t desc_map;
++ int max_descs;
++ int ndescs;
++ int desc_size;
++ int access_mode;
++
++ /* For Kernel IB_MR_TYPE_INTEGRITY */
++ struct mlx5_core_sig_ctx *sig;
++ struct mlx5_ib_mr *pi_mr;
++ struct mlx5_ib_mr *klm_mr;
++ struct mlx5_ib_mr *mtt_mr;
++ u64 data_iova;
++ u64 pi_iova;
++ int meta_ndescs;
++ int meta_length;
++ int data_length;
++ };
++
++ /* Used only by User MRs (umem != NULL) */
++ struct {
++ unsigned int page_shift;
++ /* Current access_flags */
++ int access_flags;
++
++ /* For User ODP */
++ struct mlx5_ib_mr *parent;
++ struct xarray implicit_children;
++ union {
++ struct work_struct work;
++ } odp_destroy;
++ struct ib_odp_counters odp_stats;
++ bool is_odp_implicit;
++ };
++ };
+ };
+
++/* Zero the fields in the mr that are variant depending on usage */
++static inline void mlx5_clear_mr(struct mlx5_ib_mr *mr)
++{
++ memset(mr->out, 0, sizeof(*mr) - offsetof(struct mlx5_ib_mr, out));
++}
++
+ static inline bool is_odp_mr(struct mlx5_ib_mr *mr)
+ {
+ return IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING) && mr->umem &&
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index db05b0e0a8d7..ea8f068a6da3 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -590,6 +590,8 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev,
+ ent->available_mrs--;
+ queue_adjust_cache_locked(ent);
+ spin_unlock_irq(&ent->lock);
++
++ mlx5_clear_mr(mr);
+ }
+ mr->access_flags = access_flags;
+ return mr;
+@@ -615,16 +617,14 @@ static struct mlx5_ib_mr *get_cache_mr(struct mlx5_cache_ent *req_ent)
+ ent->available_mrs--;
+ queue_adjust_cache_locked(ent);
+ spin_unlock_irq(&ent->lock);
+- break;
++ mlx5_clear_mr(mr);
++ return mr;
+ }
+ queue_adjust_cache_locked(ent);
+ spin_unlock_irq(&ent->lock);
+ }
+-
+- if (!mr)
+- req_ent->miss++;
+-
+- return mr;
++ req_ent->miss++;
++ return NULL;
+ }
+
+ static void detach_mr_from_cache(struct mlx5_ib_mr *mr)
+@@ -993,8 +993,6 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd,
+
+ mr->ibmr.pd = pd;
+ mr->umem = umem;
+- mr->access_flags = access_flags;
+- mr->desc_size = sizeof(struct mlx5_mtt);
+ mr->mmkey.iova = iova;
+ mr->mmkey.size = umem->length;
+ mr->mmkey.pd = to_mpd(pd)->pdn;
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index b103555b1f5d..d98755e78362 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -227,7 +227,6 @@ static void free_implicit_child_mr(struct mlx5_ib_mr *mr, bool need_imr_xlt)
+
+ dma_fence_odp_mr(mr);
+
+- mr->parent = NULL;
+ mlx5_mr_cache_free(mr_to_mdev(mr), mr);
+ ib_umem_odp_release(odp);
+ }
+--
+2.30.2
+
--- /dev/null
+From a25fdd53f423ab08660d63d6b4801c028734a59c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:35 +0000
+Subject: RDMA/qedr: Fix error return code in qedr_iw_connect()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 82af6d19d8d9 ("RDMA/qedr: Fix synchronization methods and memory leaks in qedr")
+Link: https://lore.kernel.org/r/20210408113135.92165-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index c4bc58736e48..1715fbe0719d 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ memcpy(in_params.local_mac_addr, dev->ndev->dev_addr, ETH_ALEN);
+
+ if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT,
+- &qp->iwarp_cm_flags))
++ &qp->iwarp_cm_flags)) {
++ rc = -ENODEV;
+ goto err; /* QP already being destroyed */
++ }
+
+ rc = dev->ops->iwarp_connect(dev->rdma_ctx, &in_params, &out_params);
+ if (rc) {
+--
+2.30.2
+
--- /dev/null
+From abfc30d696bdce5dc59969f09e69b4e840553392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 10:40:02 +0200
+Subject: RDMA/rtrs-clt: destroy sysfs after removing session from active list
+
+From: Gioh Kim <gi-oh.kim@ionos.com>
+
+[ Upstream commit 7f4a8592ff29f19c5a2ca549d0973821319afaad ]
+
+A session can be removed dynamically by sysfs interface "remove_path" that
+eventually calls rtrs_clt_remove_path_from_sysfs function. The current
+rtrs_clt_remove_path_from_sysfs first removes the sysfs interfaces and
+frees sess->stats object. Second it removes the session from the active
+list.
+
+Therefore some functions could access non-connected session and access the
+freed sess->stats object even-if they check the session status before
+accessing the session.
+
+For instance rtrs_clt_request and get_next_path_min_inflight check the
+session status and try to send IO to the session. The session status
+could be changed when they are trying to send IO but they could not catch
+the change and update the statistics information in sess->stats object,
+and generate use-after-free problem.
+(see: "RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its
+stats")
+
+This patch changes the rtrs_clt_remove_path_from_sysfs to remove the
+session from the active session list and then destroy the sysfs
+interfaces.
+
+Each function still should check the session status because closing or
+error recovery paths can change the status.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20210412084002.33582-1-gi-oh.kim@ionos.com
+Signed-off-by: Gioh Kim <gi-oh.kim@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 6734329cca33..959ba0462ef0 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -2784,8 +2784,8 @@ int rtrs_clt_remove_path_from_sysfs(struct rtrs_clt_sess *sess,
+ } while (!changed && old_state != RTRS_CLT_DEAD);
+
+ if (likely(changed)) {
+- rtrs_clt_destroy_sess_files(sess, sysfs_self);
+ rtrs_clt_remove_path_from_arr(sess);
++ rtrs_clt_destroy_sess_files(sess, sysfs_self);
+ kobject_put(&sess->kobj);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 6728e4169b10594cf94741573494600bac8d8b0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 22:59:53 -0500
+Subject: RDMA/rxe: Fix a bug in rxe_fill_ip_info()
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 45062f441590810772959d8e1f2b24ba57ce1bd9 ]
+
+Fix a bug in rxe_fill_ip_info() which was attempting to convert from
+RDMA_NETWORK_XXX to RXE_NETWORK_XXX. .._IPV6 should have mapped to .._IPV6
+not .._IPV4.
+
+Fixes: edebc8407b88 ("RDMA/rxe: Fix small problem in network_type patch")
+Link: https://lore.kernel.org/r/20210421035952.4892-1-rpearson@hpe.com
+Suggested-by: Frank Zago <frank.zago@hpe.com>
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Acked-by: Zhu Yanjun <zyjzyj2000@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_av.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_av.c b/drivers/infiniband/sw/rxe/rxe_av.c
+index df0d173d6acb..da2e867a1ed9 100644
+--- a/drivers/infiniband/sw/rxe/rxe_av.c
++++ b/drivers/infiniband/sw/rxe/rxe_av.c
+@@ -88,7 +88,7 @@ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr)
+ type = RXE_NETWORK_TYPE_IPV4;
+ break;
+ case RDMA_NETWORK_IPV6:
+- type = RXE_NETWORK_TYPE_IPV4;
++ type = RXE_NETWORK_TYPE_IPV6;
+ break;
+ default:
+ /* not reached - checked in rxe_av_chk_attr */
+--
+2.30.2
+
--- /dev/null
+From 6222e977fbb41662da844a0a2f1548220fe29223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Apr 2021 18:16:47 -0700
+Subject: RDMA/siw: Fix a use after free in siw_alloc_mr
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 3093ee182f01689b89e9f8797b321603e5de4f63 ]
+
+Our code analyzer reported a UAF.
+
+In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
+siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
+kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
+freed object. After, the execution continue up to the err_out branch of
+siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
+
+My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
+section, to avoid the uaf.
+
+Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
+Link: https://lore.kernel.org/r/20210426011647.3561-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Bernard Metzler <bmt@zurich.ihm.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_mem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
+index 34a910cf0edb..61c17db70d65 100644
+--- a/drivers/infiniband/sw/siw/siw_mem.c
++++ b/drivers/infiniband/sw/siw/siw_mem.c
+@@ -106,8 +106,6 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,
+ mem->perms = rights & IWARP_ACCESS_MASK;
+ kref_init(&mem->ref);
+
+- mr->mem = mem;
+-
+ get_random_bytes(&next, 4);
+ next &= 0x00ffffff;
+
+@@ -116,6 +114,8 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,
+ kfree(mem);
+ return -ENOMEM;
+ }
++
++ mr->mem = mem;
+ /* Set the STag index part */
+ mem->stag = id << 8;
+ mr->base_mr.lkey = mr->base_mr.rkey = mem->stag;
+--
+2.30.2
+
--- /dev/null
+From 60a6c541ec5c83ea230b27853d2f24a3523caf63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:32 +0000
+Subject: RDMA/srpt: Fix error return code in srpt_cm_req_recv()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: db7683d7deb2 ("IB/srpt: Fix login-related race conditions")
+Link: https://lore.kernel.org/r/20210408113132.87250-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 6be60aa5ffe2..7f0420ad9057 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2378,6 +2378,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n",
+ dev_name(&sdev->device->dev), port_num);
+ mutex_unlock(&sport->mutex);
++ ret = -EINVAL;
+ goto reject;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1263c5dc28a9465ce17a3b383e8db1a29526e468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 10:17:37 +0800
+Subject: regmap: set debugfs_name to NULL after it is freed
+
+From: Meng Li <Meng.Li@windriver.com>
+
+[ Upstream commit e41a962f82e7afb5b1ee644f48ad0b3aee656268 ]
+
+There is a upstream commit cffa4b2122f5("regmap:debugfs:
+Fix a memory leak when calling regmap_attach_dev") that
+adds a if condition when create name for debugfs_name.
+With below function invoking logical, debugfs_name is
+freed in regmap_debugfs_exit(), but it is not created again
+because of the if condition introduced by above commit.
+regmap_reinit_cache()
+ regmap_debugfs_exit()
+ ...
+ regmap_debugfs_init()
+So, set debugfs_name to NULL after it is freed.
+
+Fixes: cffa4b2122f5 ("regmap: debugfs: Fix a memory leak when calling regmap_attach_dev")
+Signed-off-by: Meng Li <Meng.Li@windriver.com>
+Link: https://lore.kernel.org/r/20210226021737.7690-1-Meng.Li@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index ff2ee87987c7..211a335a608d 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -660,6 +660,7 @@ void regmap_debugfs_exit(struct regmap *map)
+ regmap_debugfs_free_dump_cache(map);
+ mutex_unlock(&map->cache_lock);
+ kfree(map->debugfs_name);
++ map->debugfs_name = NULL;
+ } else {
+ struct regmap_debugfs_node *node, *tmp;
+
+--
+2.30.2
+
--- /dev/null
+From 3d66660e69165e365838a5283a2d3408f912a727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 10:42:52 +0300
+Subject: regulator: bd9576: Fix return from bd957x_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 320fcd6bbd2b500923db518902c2c640242d2b50 ]
+
+The probe() function returns an uninitialized variable in the success
+path. There is no need for the "err" variable at all, just delete it.
+
+Fixes: b014e9fae7e7 ("regulator: Support ROHM BD9576MUF and BD9573MUF")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Link: https://lore.kernel.org/r/YEsbfLJfEWtnRpoU@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd9576-regulator.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/regulator/bd9576-regulator.c b/drivers/regulator/bd9576-regulator.c
+index a8b5832a5a1b..204a2da054f5 100644
+--- a/drivers/regulator/bd9576-regulator.c
++++ b/drivers/regulator/bd9576-regulator.c
+@@ -206,7 +206,7 @@ static int bd957x_probe(struct platform_device *pdev)
+ {
+ struct regmap *regmap;
+ struct regulator_config config = { 0 };
+- int i, err;
++ int i;
+ bool vout_mode, ddr_sel;
+ const struct bd957x_regulator_data *reg_data = &bd9576_regulators[0];
+ unsigned int num_reg_data = ARRAY_SIZE(bd9576_regulators);
+@@ -279,8 +279,7 @@ static int bd957x_probe(struct platform_device *pdev)
+ break;
+ default:
+ dev_err(&pdev->dev, "Unsupported chip type\n");
+- err = -EINVAL;
+- goto err;
++ return -EINVAL;
+ }
+
+ config.dev = pdev->dev.parent;
+@@ -300,8 +299,7 @@ static int bd957x_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev,
+ "failed to register %s regulator\n",
+ desc->name);
+- err = PTR_ERR(rdev);
+- goto err;
++ return PTR_ERR(rdev);
+ }
+ /*
+ * Clear the VOUT1 GPIO setting - rest of the regulators do not
+@@ -310,8 +308,7 @@ static int bd957x_probe(struct platform_device *pdev)
+ config.ena_gpiod = NULL;
+ }
+
+-err:
+- return err;
++ return 0;
+ }
+
+ static const struct platform_device_id bd957x_pmic_id[] = {
+--
+2.30.2
+
--- /dev/null
+From 2731ed873d5be4b09acc58ab7c40cd3cc7bec5be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 13:26:07 +0800
+Subject: rtlwifi: 8821ae: upgrade PHY and RF parameters
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ]
+
+The signal strength of 5G is quite low, so user can't connect to an AP far
+away. New parameters with new format and its parser are updated by the commit
+84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but
+some parameters are missing. Use this commit to update to the novel parameters
+that use new format.
+
+Fixes: 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210219052607.7323-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++-----
+ 1 file changed, 370 insertions(+), 130 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+index 27c8a5d96520..fcaaf664cbec 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+@@ -249,7 +249,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x824, 0x00030FE0,
+ 0x828, 0x00000000,
+ 0x82C, 0x002081DD,
+- 0x830, 0x2AAA8E24,
++ 0x830, 0x2AAAEEC8,
+ 0x834, 0x0037A706,
+ 0x838, 0x06489B44,
+ 0x83C, 0x0000095B,
+@@ -324,10 +324,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x9D8, 0x00000000,
+ 0x9DC, 0x00000000,
+ 0x9E0, 0x00005D00,
+- 0x9E4, 0x00000002,
++ 0x9E4, 0x00000003,
+ 0x9E8, 0x00000001,
+ 0xA00, 0x00D047C8,
+- 0xA04, 0x01FF000C,
++ 0xA04, 0x01FF800C,
+ 0xA08, 0x8C8A8300,
+ 0xA0C, 0x2E68000F,
+ 0xA10, 0x9500BB78,
+@@ -1320,7 +1320,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x083, 0x00021800,
+ 0x084, 0x00028000,
+ 0x085, 0x00048000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x086, 0x0009483A,
++ 0xA0000000, 0x00000000,
+ 0x086, 0x00094838,
++ 0xB0000000, 0x00000000,
+ 0x087, 0x00044980,
+ 0x088, 0x00048000,
+ 0x089, 0x0000D480,
+@@ -1409,36 +1413,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x03C, 0x000CA000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00001100,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0404, 0xCDEF,
+- 0x034, 0x0004ADF3,
+- 0x034, 0x00049DF0,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF5,
+ 0x034, 0x00049DF2,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004A0F3,
++ 0x034, 0x000490B1,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004A0F3,
+ 0x034, 0x000490B1,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF5,
++ 0x034, 0x00049DF2,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF3,
++ 0x034, 0x00049DF0,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0004ADF7,
+ 0x034, 0x00049DF3,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00048DED,
+- 0x034, 0x00047DEA,
+- 0x034, 0x00046DE7,
+- 0x034, 0x00045CE9,
+- 0x034, 0x00044CE6,
+- 0x034, 0x000438C6,
+- 0x034, 0x00042886,
+- 0x034, 0x00041486,
+- 0x034, 0x00040447,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1448,7 +1448,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1458,7 +1458,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000480AE,
++ 0x034, 0x000470AB,
++ 0x034, 0x0004608B,
++ 0x034, 0x00045069,
++ 0x034, 0x00044048,
++ 0x034, 0x00043045,
++ 0x034, 0x00042026,
++ 0x034, 0x00041023,
++ 0x034, 0x00040002,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000480AE,
+ 0x034, 0x000470AB,
+ 0x034, 0x0004608B,
+@@ -1468,7 +1478,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042026,
+ 0x034, 0x00041023,
+ 0x034, 0x00040002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00048DED,
++ 0x034, 0x00047DEA,
++ 0x034, 0x00046DE7,
++ 0x034, 0x00045CE9,
++ 0x034, 0x00044CE6,
++ 0x034, 0x000438C6,
++ 0x034, 0x00042886,
++ 0x034, 0x00041486,
++ 0x034, 0x00040447,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00048DEF,
+ 0x034, 0x00047DEC,
+ 0x034, 0x00046DE9,
+@@ -1478,38 +1498,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x0004248A,
+ 0x034, 0x0004108D,
+ 0x034, 0x0004008A,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002ADF4,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002A0F3,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002A0F3,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002ADF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0002ADF7,
+- 0xFF0F0200, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00029DF4,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF1,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000290F0,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000290F0,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF1,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00029DF2,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00028DF1,
+- 0x034, 0x00027DEE,
+- 0x034, 0x00026DEB,
+- 0x034, 0x00025CEC,
+- 0x034, 0x00024CE9,
+- 0x034, 0x000238CA,
+- 0x034, 0x00022889,
+- 0x034, 0x00021489,
+- 0x034, 0x0002044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1519,7 +1537,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1529,7 +1547,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000280AF,
+ 0x034, 0x000270AC,
+ 0x034, 0x0002608B,
+@@ -1539,7 +1557,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022026,
+ 0x034, 0x00021023,
+ 0x034, 0x00020002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000280AF,
++ 0x034, 0x000270AC,
++ 0x034, 0x0002608B,
++ 0x034, 0x00025069,
++ 0x034, 0x00024048,
++ 0x034, 0x00023045,
++ 0x034, 0x00022026,
++ 0x034, 0x00021023,
++ 0x034, 0x00020002,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00028DF1,
++ 0x034, 0x00027DEE,
++ 0x034, 0x00026DEB,
++ 0x034, 0x00025CEC,
++ 0x034, 0x00024CE9,
++ 0x034, 0x000238CA,
++ 0x034, 0x00022889,
++ 0x034, 0x00021489,
++ 0x034, 0x0002044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00028DEE,
+ 0x034, 0x00027DEB,
+ 0x034, 0x00026CCD,
+@@ -1549,27 +1587,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022849,
+ 0x034, 0x00021449,
+ 0x034, 0x0002004D,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F02C0, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000A0D7,
++ 0x034, 0x000090D3,
++ 0x034, 0x000080B1,
++ 0x034, 0x000070AE,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000A0D7,
+ 0x034, 0x000090D3,
+ 0x034, 0x000080B1,
+ 0x034, 0x000070AE,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0000ADF7,
+ 0x034, 0x00009DF4,
+ 0x034, 0x00008DF1,
+ 0x034, 0x00007DEE,
+- 0xFF0F02C0, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00006DEB,
+- 0x034, 0x00005CEC,
+- 0x034, 0x00004CE9,
+- 0x034, 0x000038CA,
+- 0x034, 0x00002889,
+- 0x034, 0x00001489,
+- 0x034, 0x0000044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1577,7 +1612,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1585,7 +1620,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000608D,
+ 0x034, 0x0000506B,
+ 0x034, 0x0000404A,
+@@ -1593,7 +1628,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002044,
+ 0x034, 0x00001025,
+ 0x034, 0x00000004,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000608D,
++ 0x034, 0x0000506B,
++ 0x034, 0x0000404A,
++ 0x034, 0x00003047,
++ 0x034, 0x00002044,
++ 0x034, 0x00001025,
++ 0x034, 0x00000004,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00006DEB,
++ 0x034, 0x00005CEC,
++ 0x034, 0x00004CE9,
++ 0x034, 0x000038CA,
++ 0x034, 0x00002889,
++ 0x034, 0x00001489,
++ 0x034, 0x0000044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00006DCD,
+ 0x034, 0x00005CCD,
+ 0x034, 0x00004CCA,
+@@ -1601,11 +1652,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002888,
+ 0x034, 0x00001488,
+ 0x034, 0x00000486,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000040,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1615,7 +1666,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1625,7 +1676,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000145,
++ 0x035, 0x00008145,
++ 0x035, 0x00010145,
++ 0x035, 0x00020196,
++ 0x035, 0x00028196,
++ 0x035, 0x00030196,
++ 0x035, 0x000401C7,
++ 0x035, 0x000481C7,
++ 0x035, 0x000501C7,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1635,7 +1716,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x035, 0x00000145,
+ 0x035, 0x00008145,
+ 0x035, 0x00010145,
+@@ -1645,11 +1726,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x000401C7,
+ 0x035, 0x000481C7,
+ 0x035, 0x000501C7,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000010,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1675,7 +1756,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000056B3,
++ 0x036, 0x0000D6B3,
++ 0x036, 0x000156B3,
++ 0x036, 0x0001D6B3,
++ 0x036, 0x00026634,
++ 0x036, 0x0002E634,
++ 0x036, 0x00036634,
++ 0x036, 0x0003E634,
++ 0x036, 0x000467B4,
++ 0x036, 0x0004E7B4,
++ 0x036, 0x000567B4,
++ 0x036, 0x0005E7B4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1688,7 +1808,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x036, 0x000056B3,
+ 0x036, 0x0000D6B3,
+ 0x036, 0x000156B3,
+@@ -1701,103 +1821,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x0004E7B4,
+ 0x036, 0x000567B4,
+ 0x036, 0x0005E7B4,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00000008,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x0000022A,
++ 0x03C, 0x00000594,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x0000022A,
+ 0x03C, 0x00000594,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000820,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000820,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x00000900,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000002,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x008, 0x00002000,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0DF, 0x000000C0,
+- 0x01F, 0x00040064,
+- 0xFF0F0104, 0xABCD,
++ 0x01F, 0x00000064,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0404, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x058, 0x00081184,
+ 0x059, 0x0006016C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EAD53,
++ 0x062, 0x00093BC4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x061, 0x000EAD53,
+ 0x062, 0x00093BC4,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0200, 0xCDEF,
+- 0x063, 0x000710E9,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110E9,
++ 0xA0000000, 0x00000000,
+ 0x063, 0x000714E9,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0204, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C67C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x064, 0x0001C67C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093016,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093015,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093015,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093016,
++ 0xA0000000, 0x00000000,
+ 0x065, 0x00091016,
+- 0xFF0F0200, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x018, 0x00000006,
+ 0x0EF, 0x00002000,
+ 0x03B, 0x0003824B,
+@@ -1895,9 +2074,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x0B4, 0x0001214C,
+ 0x0B7, 0x0003000C,
+ 0x01C, 0x000539D2,
++ 0x0C4, 0x000AFE00,
+ 0x018, 0x0001F12A,
+- 0x0FE, 0x00000000,
+- 0x0FE, 0x00000000,
++ 0xFFE, 0x00000000,
++ 0xFFE, 0x00000000,
+ 0x018, 0x0001712A,
+
+ };
+@@ -2017,6 +2197,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {
+ u32 RTL8812AE_MAC_1T_ARRAYLEN = ARRAY_SIZE(RTL8812AE_MAC_REG_ARRAY);
+
+ u32 RTL8821AE_MAC_REG_ARRAY[] = {
++ 0x421, 0x0000000F,
+ 0x428, 0x0000000A,
+ 0x429, 0x00000010,
+ 0x430, 0x00000000,
+@@ -2485,7 +2666,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0xA6360001,
+ 0x81C, 0xA5380001,
+ 0x81C, 0xA43A0001,
+- 0x81C, 0xA33C0001,
++ 0x81C, 0x683C0001,
+ 0x81C, 0x673E0001,
+ 0x81C, 0x66400001,
+ 0x81C, 0x65420001,
+@@ -2519,7 +2700,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x017A0001,
+ 0x81C, 0x017C0001,
+ 0x81C, 0x017E0001,
+- 0xFF0F02C0, 0xABCD,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x81C, 0xFB000101,
++ 0x81C, 0xFA020101,
++ 0x81C, 0xF9040101,
++ 0x81C, 0xF8060101,
++ 0x81C, 0xF7080101,
++ 0x81C, 0xF60A0101,
++ 0x81C, 0xF50C0101,
++ 0x81C, 0xF40E0101,
++ 0x81C, 0xF3100101,
++ 0x81C, 0xF2120101,
++ 0x81C, 0xF1140101,
++ 0x81C, 0xF0160101,
++ 0x81C, 0xEF180101,
++ 0x81C, 0xEE1A0101,
++ 0x81C, 0xED1C0101,
++ 0x81C, 0xEC1E0101,
++ 0x81C, 0xEB200101,
++ 0x81C, 0xEA220101,
++ 0x81C, 0xE9240101,
++ 0x81C, 0xE8260101,
++ 0x81C, 0xE7280101,
++ 0x81C, 0xE62A0101,
++ 0x81C, 0xE52C0101,
++ 0x81C, 0xE42E0101,
++ 0x81C, 0xE3300101,
++ 0x81C, 0xA5320101,
++ 0x81C, 0xA4340101,
++ 0x81C, 0xA3360101,
++ 0x81C, 0x87380101,
++ 0x81C, 0x863A0101,
++ 0x81C, 0x853C0101,
++ 0x81C, 0x843E0101,
++ 0x81C, 0x69400101,
++ 0x81C, 0x68420101,
++ 0x81C, 0x67440101,
++ 0x81C, 0x66460101,
++ 0x81C, 0x49480101,
++ 0x81C, 0x484A0101,
++ 0x81C, 0x474C0101,
++ 0x81C, 0x2A4E0101,
++ 0x81C, 0x29500101,
++ 0x81C, 0x28520101,
++ 0x81C, 0x27540101,
++ 0x81C, 0x26560101,
++ 0x81C, 0x25580101,
++ 0x81C, 0x245A0101,
++ 0x81C, 0x235C0101,
++ 0x81C, 0x055E0101,
++ 0x81C, 0x04600101,
++ 0x81C, 0x03620101,
++ 0x81C, 0x02640101,
++ 0x81C, 0x01660101,
++ 0x81C, 0x01680101,
++ 0x81C, 0x016A0101,
++ 0x81C, 0x016C0101,
++ 0x81C, 0x016E0101,
++ 0x81C, 0x01700101,
++ 0x81C, 0x01720101,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x81C, 0xFB000101,
+ 0x81C, 0xFA020101,
+ 0x81C, 0xF9040101,
+@@ -2578,7 +2818,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x016E0101,
+ 0x81C, 0x01700101,
+ 0x81C, 0x01720101,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x81C, 0xFF000101,
+ 0x81C, 0xFF020101,
+ 0x81C, 0xFE040101,
+@@ -2637,7 +2877,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x046E0101,
+ 0x81C, 0x03700101,
+ 0x81C, 0x02720101,
+- 0xFF0F02C0, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x81C, 0x01740101,
+ 0x81C, 0x01760101,
+ 0x81C, 0x01780101,
+--
+2.30.2
+
--- /dev/null
+From fd534ca077c892531273923d198ea642c05ff894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Mar 2021 12:23:37 +0300
+Subject: rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c9eaee0c2ec6b1002044fb698cdfb5d9ef4ed28c ]
+
+The sscanf() function returns the number of matches (0 or 1 in this
+case). It doesn't return error codes. We should return -EINVAL if the
+string is invalid
+
+Fixes: c376c1fc87b7 ("rtw88: add h2c command in debugfs")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/YE8nmatMDBDDWkjq@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
+index 948cb79050ea..e7d51ac9b689 100644
+--- a/drivers/net/wireless/realtek/rtw88/debug.c
++++ b/drivers/net/wireless/realtek/rtw88/debug.c
+@@ -270,7 +270,7 @@ static ssize_t rtw_debugfs_set_rsvd_page(struct file *filp,
+
+ if (num != 2) {
+ rtw_warn(rtwdev, "invalid arguments\n");
+- return num;
++ return -EINVAL;
+ }
+
+ debugfs_priv->rsvd_page.page_offset = offset;
+--
+2.30.2
+
--- /dev/null
+From ba02cc5fb045dca250fb873eccc32ef1b1b72b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 16:47:03 +0800
+Subject: rtw88: refine napi deinit flow
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 7bd3760c71f7a18485d2c10ea0887e1d41519f4e ]
+
+We used to stop napi before disabling irqs. And it turns out
+to cause some problem when we try to stop device while interrupt arrives.
+
+To safely stop pci, we do three steps:
+1. disable interrupt
+2. synchronize_irq
+3. stop_napi
+Since step 2 and 3 may not finish as expected when interrupt is enabled,
+use rtwpci->running to decide whether interrupt should be re-enabled at
+the time.
+
+Fixes: 9e2fd29864c5 ("rtw88: add napi support")
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210415084703.27255-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/pci.c | 19 ++++++++++++++-----
+ drivers/net/wireless/realtek/rtw88/pci.h | 1 +
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
+index 786a48649946..6b5c885798a4 100644
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -581,23 +581,30 @@ static int rtw_pci_start(struct rtw_dev *rtwdev)
+ {
+ struct rtw_pci *rtwpci = (struct rtw_pci *)rtwdev->priv;
+
++ rtw_pci_napi_start(rtwdev);
++
+ spin_lock_bh(&rtwpci->irq_lock);
++ rtwpci->running = true;
+ rtw_pci_enable_interrupt(rtwdev, rtwpci, false);
+ spin_unlock_bh(&rtwpci->irq_lock);
+
+- rtw_pci_napi_start(rtwdev);
+-
+ return 0;
+ }
+
+ static void rtw_pci_stop(struct rtw_dev *rtwdev)
+ {
+ struct rtw_pci *rtwpci = (struct rtw_pci *)rtwdev->priv;
++ struct pci_dev *pdev = rtwpci->pdev;
+
++ spin_lock_bh(&rtwpci->irq_lock);
++ rtwpci->running = false;
++ rtw_pci_disable_interrupt(rtwdev, rtwpci);
++ spin_unlock_bh(&rtwpci->irq_lock);
++
++ synchronize_irq(pdev->irq);
+ rtw_pci_napi_stop(rtwdev);
+
+ spin_lock_bh(&rtwpci->irq_lock);
+- rtw_pci_disable_interrupt(rtwdev, rtwpci);
+ rtw_pci_dma_release(rtwdev, rtwpci);
+ spin_unlock_bh(&rtwpci->irq_lock);
+ }
+@@ -1138,7 +1145,8 @@ static irqreturn_t rtw_pci_interrupt_threadfn(int irq, void *dev)
+ rtw_fw_c2h_cmd_isr(rtwdev);
+
+ /* all of the jobs for this interrupt have been done */
+- rtw_pci_enable_interrupt(rtwdev, rtwpci, rx);
++ if (rtwpci->running)
++ rtw_pci_enable_interrupt(rtwdev, rtwpci, rx);
+ spin_unlock_bh(&rtwpci->irq_lock);
+
+ return IRQ_HANDLED;
+@@ -1558,7 +1566,8 @@ static int rtw_pci_napi_poll(struct napi_struct *napi, int budget)
+ if (work_done < budget) {
+ napi_complete_done(napi, work_done);
+ spin_lock_bh(&rtwpci->irq_lock);
+- rtw_pci_enable_interrupt(rtwdev, rtwpci, false);
++ if (rtwpci->running)
++ rtw_pci_enable_interrupt(rtwdev, rtwpci, false);
+ spin_unlock_bh(&rtwpci->irq_lock);
+ /* When ISR happens during polling and before napi_complete
+ * while no further data is received. Data on the dma_ring will
+diff --git a/drivers/net/wireless/realtek/rtw88/pci.h b/drivers/net/wireless/realtek/rtw88/pci.h
+index e76fc549a788..0ffae887527a 100644
+--- a/drivers/net/wireless/realtek/rtw88/pci.h
++++ b/drivers/net/wireless/realtek/rtw88/pci.h
+@@ -211,6 +211,7 @@ struct rtw_pci {
+ spinlock_t irq_lock;
+ u32 irq_mask[4];
+ bool irq_enabled;
++ bool running;
+
+ /* napi structure */
+ struct net_device netdev;
+--
+2.30.2
+
--- /dev/null
+From 4573b15df43f6cfc96b8df5d6504f293c234be64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Mar 2021 00:13:49 +0300
+Subject: sata_mv: add IRQ checks
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ]
+
+The function mv_platform_probe() neglects to check the results of the
+calls to platform_get_irq() and irq_of_parse_and_map() and blithely
+passes them to ata_host_activate() -- while the latter only checks
+for IRQ0 (treating it as a polling mode indicattion) and passes the
+negative values to devm_request_irq() causing it to fail as it takes
+unsigned values for the IRQ #...
+
+Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ
+#s to ata_host_activate(), propagate upstream the negative error codes,
+and override the IRQ0 with -EINVAL (as we don't want the polling mode).
+
+Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/sata_mv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 664ef658a955..b62446ea5f40 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -4097,6 +4097,10 @@ static int mv_platform_probe(struct platform_device *pdev)
+ n_ports = mv_platform_data->n_ports;
+ irq = platform_get_irq(pdev, 0);
+ }
++ if (irq < 0)
++ return irq;
++ if (!irq)
++ return -EINVAL;
+
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+--
+2.30.2
+
--- /dev/null
+From b0efac2553bcc1cb8574eb570ae531e5baa1715e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 15:54:26 -0400
+Subject: sched/debug: Fix cgroup_path[] serialization
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit ad789f84c9a145f8a18744c0387cec22ec51651e ]
+
+The handling of sysrq key can be activated by echoing the key to
+/proc/sysrq-trigger or via the magic key sequence typed into a terminal
+that is connected to the system in some way (serial, USB or other mean).
+In the former case, the handling is done in a user context. In the
+latter case, it is likely to be in an interrupt context.
+
+Currently in print_cpu() of kernel/sched/debug.c, sched_debug_lock is
+taken with interrupt disabled for the whole duration of the calls to
+print_*_stats() and print_rq() which could last for the quite some time
+if the information dump happens on the serial console.
+
+If the system has many cpus and the sched_debug_lock is somehow busy
+(e.g. parallel sysrq-t), the system may hit a hard lockup panic
+depending on the actually serial console implementation of the
+system.
+
+The purpose of sched_debug_lock is to serialize the use of the global
+cgroup_path[] buffer in print_cpu(). The rests of the printk calls don't
+need serialization from sched_debug_lock.
+
+Calling printk() with interrupt disabled can still be problematic if
+multiple instances are running. Allocating a stack buffer of PATH_MAX
+bytes is not feasible because of the limited size of the kernel stack.
+
+The solution implemented in this patch is to allow only one caller at a
+time to use the full size group_path[], while other simultaneous callers
+will have to use shorter stack buffers with the possibility of path
+name truncation. A "..." suffix will be printed if truncation may have
+happened. The cgroup path name is provided for informational purpose
+only, so occasional path name truncation should not be a big problem.
+
+Fixes: efe25c2c7b3a ("sched: Reinstate group names in /proc/sched_debug")
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210415195426.6677-1-longman@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 486f403a778b..9c8b3ed2199a 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -8,8 +8,6 @@
+ */
+ #include "sched.h"
+
+-static DEFINE_SPINLOCK(sched_debug_lock);
+-
+ /*
+ * This allows printing both to /proc/sched_debug and
+ * to the console
+@@ -470,16 +468,37 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group
+ #endif
+
+ #ifdef CONFIG_CGROUP_SCHED
++static DEFINE_SPINLOCK(sched_debug_lock);
+ static char group_path[PATH_MAX];
+
+-static char *task_group_path(struct task_group *tg)
++static void task_group_path(struct task_group *tg, char *path, int plen)
+ {
+- if (autogroup_path(tg, group_path, PATH_MAX))
+- return group_path;
++ if (autogroup_path(tg, path, plen))
++ return;
+
+- cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
++ cgroup_path(tg->css.cgroup, path, plen);
++}
+
+- return group_path;
++/*
++ * Only 1 SEQ_printf_task_group_path() caller can use the full length
++ * group_path[] for cgroup path. Other simultaneous callers will have
++ * to use a shorter stack buffer. A "..." suffix is appended at the end
++ * of the stack buffer so that it will show up in case the output length
++ * matches the given buffer size to indicate possible path name truncation.
++ */
++#define SEQ_printf_task_group_path(m, tg, fmt...) \
++{ \
++ if (spin_trylock(&sched_debug_lock)) { \
++ task_group_path(tg, group_path, sizeof(group_path)); \
++ SEQ_printf(m, fmt, group_path); \
++ spin_unlock(&sched_debug_lock); \
++ } else { \
++ char buf[128]; \
++ char *bufend = buf + sizeof(buf) - 3; \
++ task_group_path(tg, buf, bufend - buf); \
++ strcpy(bufend - 1, "..."); \
++ SEQ_printf(m, fmt, buf); \
++ } \
+ }
+ #endif
+
+@@ -506,7 +525,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
+ SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p));
+ #endif
+ #ifdef CONFIG_CGROUP_SCHED
+- SEQ_printf(m, " %s", task_group_path(task_group(p)));
++ SEQ_printf_task_group_path(m, task_group(p), " %s")
+ #endif
+
+ SEQ_printf(m, "\n");
+@@ -543,7 +562,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
++ SEQ_printf_task_group_path(m, cfs_rq->tg, "cfs_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "cfs_rq[%d]:\n", cpu);
+@@ -614,7 +633,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
+ {
+ #ifdef CONFIG_RT_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
++ SEQ_printf_task_group_path(m, rt_rq->tg, "rt_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "rt_rq[%d]:\n", cpu);
+@@ -666,7 +685,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
+ static void print_cpu(struct seq_file *m, int cpu)
+ {
+ struct rq *rq = cpu_rq(cpu);
+- unsigned long flags;
+
+ #ifdef CONFIG_X86
+ {
+@@ -717,13 +735,11 @@ do { \
+ }
+ #undef P
+
+- spin_lock_irqsave(&sched_debug_lock, flags);
+ print_cfs_stats(m, cpu);
+ print_rt_stats(m, cpu);
+ print_dl_stats(m, cpu);
+
+ print_rq(m, rq, cpu);
+- spin_unlock_irqrestore(&sched_debug_lock, flags);
+ SEQ_printf(m, "\n");
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0caa2ade82793719273d33aa3894ca0c9165a723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:56:56 +0000
+Subject: sched/fair: Fix shift-out-of-bounds in load_balance()
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 39a2a6eb5c9b66ea7c8055026303b3aa681b49a5 ]
+
+Syzbot reported a handful of occurrences where an sd->nr_balance_failed can
+grow to much higher values than one would expect.
+
+A successful load_balance() resets it to 0; a failed one increments
+it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an
+active balance, which will either set it to sd->cache_nice_tries+1 or reset
+it to 0. However, in case the to-be-active-balanced task is not allowed to
+run on env->dst_cpu, then the increment is done without any further
+modification.
+
+This could then be repeated ad nauseam, and would explain the absurdly high
+values reported by syzbot (86, 149). VincentG noted there is value in
+letting sd->cache_nice_tries grow, so the shift itself should be
+fixed. That means preventing:
+
+ """
+ If the value of the right operand is negative or is greater than or equal
+ to the width of the promoted left operand, the behavior is undefined.
+ """
+
+Thus we need to cap the shift exponent to
+ BITS_PER_TYPE(typeof(lefthand)) - 1.
+
+I had a look around for other similar cases via coccinelle:
+
+ @expr@
+ position pos;
+ expression E1;
+ expression E2;
+ @@
+ (
+ E1 >> E2@pos
+ |
+ E1 >> E2@pos
+ )
+
+ @cst depends on expr@
+ position pos;
+ expression expr.E1;
+ constant cst;
+ @@
+ (
+ E1 >> cst@pos
+ |
+ E1 << cst@pos
+ )
+
+ @script:python depends on !cst@
+ pos << expr.pos;
+ exp << expr.E2;
+ @@
+ # Dirty hack to ignore constexpr
+ if exp.upper() != exp:
+ coccilib.report.print_report(pos[0], "Possible UB shift here")
+
+The only other match in kernel/sched is rq_clock_thermal() which employs
+sched_thermal_decay_shift, and that exponent is already capped to 10, so
+that one is fine.
+
+Fixes: 5a7f55590467 ("sched/fair: Relax constraint on task's load during load balance")
+Reported-by: syzbot+d7581744d5fd27c9fbe1@syzkaller.appspotmail.com
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: http://lore.kernel.org/r/000000000000ffac1205b9a2112f@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 3 +--
+ kernel/sched/sched.h | 7 +++++++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 0eeeeeb66f33..b5ffe808b07b 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7780,8 +7780,7 @@ static int detach_tasks(struct lb_env *env)
+ * scheduler fails to find a good waiting task to
+ * migrate.
+ */
+-
+- if ((load >> env->sd->nr_balance_failed) > env->imbalance)
++ if (shr_bound(load, env->sd->nr_balance_failed) > env->imbalance)
+ goto next;
+
+ env->imbalance -= load;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 10a1522b1e30..e4e4f47cee6a 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -204,6 +204,13 @@ static inline void update_avg(u64 *avg, u64 sample)
+ *avg += diff / 8;
+ }
+
++/*
++ * Shifting a value by an exponent greater *or equal* to the size of said value
++ * is UB; cap at size-1.
++ */
++#define shr_bound(val, shift) \
++ (val >> min_t(typeof(shift), shift, BITS_PER_TYPE(typeof(val)) - 1))
++
+ /*
+ * !! For sched_setattr_nocheck() (kernel) only !!
+ *
+--
+2.30.2
+
--- /dev/null
+From b8ba84654092929adcb1aa8066d5f34c23154e01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Apr 2021 23:43:55 +0300
+Subject: scsi: hisi_sas: Fix IRQ checks
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 6c11dc060427e07ca144eacaccd696106b361b06 ]
+
+Commit df2d8213d9e3 ("hisi_sas: use platform_get_irq()") failed to take
+into account that irq_of_parse_and_map() and platform_get_irq() have a
+different way of indicating an error: the former returns 0 and the latter
+returns a negative error code. Fix up the IRQ checks!
+
+Link: https://lore.kernel.org/r/810f26d3-908b-1d6b-dc5c-40019726baca@omprussia.ru
+Fixes: df2d8213d9e3 ("hisi_sas: use platform_get_irq()")
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 7451377c4cb6..3e359ac752fd 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -1646,7 +1646,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = i * HISI_SAS_PHY_INT_NR;
+ for (j = 0; j < HISI_SAS_PHY_INT_NR; j++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: fail map phy interrupt %d\n",
+ idx);
+ return -ENOENT;
+@@ -1665,7 +1665,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = hisi_hba->n_phy * HISI_SAS_PHY_INT_NR;
+ for (i = 0; i < hisi_hba->queue_count; i++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: could not map cq interrupt %d\n",
+ idx);
+ return -ENOENT;
+@@ -1683,7 +1683,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = (hisi_hba->n_phy * HISI_SAS_PHY_INT_NR) + hisi_hba->queue_count;
+ for (i = 0; i < HISI_SAS_FATAL_INT_NR; i++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: could not map fatal interrupt %d\n",
+ idx);
+ return -ENOENT;
+--
+2.30.2
+
--- /dev/null
+From b724ab1458e064ae0f40a60c4e618091c0682399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 18:10:09 -0600
+Subject: scsi: ibmvfc: Fix invalid state machine BUG_ON()
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+[ Upstream commit 15cfef8623a449d40d16541687afd58e78033be3 ]
+
+This fixes an issue hitting the BUG_ON() in ibmvfc_do_work(). When going
+through a host action of IBMVFC_HOST_ACTION_RESET, we change the action to
+IBMVFC_HOST_ACTION_TGT_DEL, then drop the host lock, and reset the CRQ,
+which changes the host state to IBMVFC_NO_CRQ. If, prior to setting the
+host state to IBMVFC_NO_CRQ, ibmvfc_init_host() is called, it can then end
+up changing the host action to IBMVFC_HOST_ACTION_INIT. If we then change
+the host state to IBMVFC_NO_CRQ, we will then hit the BUG_ON().
+
+Make a couple of changes to avoid this. Leave the host action to be
+IBMVFC_HOST_ACTION_RESET or IBMVFC_HOST_ACTION_REENABLE until after we drop
+the host lock and reset or reenable the CRQ. Also harden the host state
+machine to ensure we cannot leave the reset / reenable state until we've
+finished processing the reset or reenable.
+
+Link: https://lore.kernel.org/r/20210413001009.902400-1-tyreld@linux.ibm.com
+Fixes: 73ee5d867287 ("[SCSI] ibmvfc: Fix soft lockup on resume")
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+[tyreld: added fixes tag]
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+[mkp: fix comment checkpatch warnings]
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ibmvscsi/ibmvfc.c | 57 ++++++++++++++++++++++------------
+ 1 file changed, 38 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 61831f2fdb30..d6675a25719d 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -603,8 +603,17 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ if (vhost->action == IBMVFC_HOST_ACTION_ALLOC_TGTS)
+ vhost->action = action;
+ break;
++ case IBMVFC_HOST_ACTION_REENABLE:
++ case IBMVFC_HOST_ACTION_RESET:
++ vhost->action = action;
++ break;
+ case IBMVFC_HOST_ACTION_INIT:
+ case IBMVFC_HOST_ACTION_TGT_DEL:
++ case IBMVFC_HOST_ACTION_LOGO:
++ case IBMVFC_HOST_ACTION_QUERY_TGTS:
++ case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
++ case IBMVFC_HOST_ACTION_NONE:
++ default:
+ switch (vhost->action) {
+ case IBMVFC_HOST_ACTION_RESET:
+ case IBMVFC_HOST_ACTION_REENABLE:
+@@ -614,15 +623,6 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ break;
+ }
+ break;
+- case IBMVFC_HOST_ACTION_LOGO:
+- case IBMVFC_HOST_ACTION_QUERY_TGTS:
+- case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
+- case IBMVFC_HOST_ACTION_NONE:
+- case IBMVFC_HOST_ACTION_RESET:
+- case IBMVFC_HOST_ACTION_REENABLE:
+- default:
+- vhost->action = action;
+- break;
+ }
+ }
+
+@@ -5373,30 +5373,49 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost)
+ case IBMVFC_HOST_ACTION_INIT_WAIT:
+ break;
+ case IBMVFC_HOST_ACTION_RESET:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ list_splice_init(&vhost->purge, &purge);
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ ibmvfc_complete_purge(&purge);
+ rc = ibmvfc_reset_crq(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc == H_CLOSED)
++ if (!rc || rc == H_CLOSED)
+ vio_enable_interrupts(to_vio_dev(vhost->dev));
+- if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
+- (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_RESET) {
++ /*
++ * The only action we could have changed to would have
++ * been reenable, in which case, we skip the rest of
++ * this path and wait until we've done the re-enable
++ * before sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++
++ if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
++ (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_REENABLE:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ list_splice_init(&vhost->purge, &purge);
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ ibmvfc_complete_purge(&purge);
+ rc = ibmvfc_reenable_crq_queue(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_REENABLE) {
++ /*
++ * The only action we could have changed to would have
++ * been reset, in which case, we skip the rest of this
++ * path and wait until we've done the reset before
++ * sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++ if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_LOGO:
+--
+2.30.2
+
--- /dev/null
+From 207ff66144cb074d679147888233b6e19e9a17fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:43:23 +0300
+Subject: scsi: jazz_esp: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru
+Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/jazz_esp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
+index f0ed6863cc70..60a88a95a8e2 100644
+--- a/drivers/scsi/jazz_esp.c
++++ b/drivers/scsi/jazz_esp.c
+@@ -143,7 +143,9 @@ static int esp_jazz_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
+ if (err < 0)
+ goto fail_unmap_command_block;
+--
+2.30.2
+
--- /dev/null
+From e1ed9163057e3537c5b633ad638a1c921cef9e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Mar 2021 09:18:08 -0800
+Subject: scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb()
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 8dd1c125f7f838abad009b64bff5f0a11afe3cb6 ]
+
+It is possible to call lpfc_issue_els_plogi() passing a did for which no
+matching ndlp is found. A call is then made to lpfc_prep_els_iocb() with a
+null pointer to a lpfc_nodelist structure resulting in a null pointer
+dereference.
+
+Fix by returning an error status if no valid ndlp is found. Fix up comments
+regarding ndlp reference counting.
+
+Link: https://lore.kernel.org/r/20210301171821.3427-10-jsmart2021@gmail.com
+Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
+Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 50 +++++++++++++++++-------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index fd18ac2acc13..3dd22da3153f 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1,7 +1,7 @@
+ /*******************************************************************
+ * This file is part of the Emulex Linux Device Driver for *
+ * Fibre Channel Host Bus Adapters. *
+- * Copyright (C) 2017-2020 Broadcom. All Rights Reserved. The term *
++ * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term *
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. *
+ * Copyright (C) 2004-2016 Emulex. All rights reserved. *
+ * EMULEX and SLI are trademarks of Emulex. *
+@@ -2044,13 +2044,12 @@ out_freeiocb:
+ * This routine issues a Port Login (PLOGI) command to a remote N_Port
+ * (with the @did) for a @vport. Before issuing a PLOGI to a remote N_Port,
+ * the ndlp with the remote N_Port DID must exist on the @vport's ndlp list.
+- * This routine constructs the proper feilds of the PLOGI IOCB and invokes
++ * This routine constructs the proper fields of the PLOGI IOCB and invokes
+ * the lpfc_sli_issue_iocb() routine to send out PLOGI ELS command.
+ *
+- * Note that, in lpfc_prep_els_iocb() routine, the reference count of ndlp
+- * will be incremented by 1 for holding the ndlp and the reference to ndlp
+- * will be stored into the context1 field of the IOCB for the completion
+- * callback function to the PLOGI ELS command.
++ * Note that the ndlp reference count will be incremented by 1 for holding
++ * the ndlp and the reference to ndlp will be stored into the context1 field
++ * of the IOCB for the completion callback function to the PLOGI ELS command.
+ *
+ * Return code
+ * 0 - Successfully issued a plogi for @vport
+@@ -2068,29 +2067,28 @@ lpfc_issue_els_plogi(struct lpfc_vport *vport, uint32_t did, uint8_t retry)
+ int ret;
+
+ ndlp = lpfc_findnode_did(vport, did);
++ if (!ndlp)
++ return 1;
+
+- if (ndlp) {
+- /* Defer the processing of the issue PLOGI until after the
+- * outstanding UNREG_RPI mbox command completes, unless we
+- * are going offline. This logic does not apply for Fabric DIDs
+- */
+- if ((ndlp->nlp_flag & NLP_UNREG_INP) &&
+- ((ndlp->nlp_DID & Fabric_DID_MASK) != Fabric_DID_MASK) &&
+- !(vport->fc_flag & FC_OFFLINE_MODE)) {
+- lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
+- "4110 Issue PLOGI x%x deferred "
+- "on NPort x%x rpi x%x Data: x%px\n",
+- ndlp->nlp_defer_did, ndlp->nlp_DID,
+- ndlp->nlp_rpi, ndlp);
+-
+- /* We can only defer 1st PLOGI */
+- if (ndlp->nlp_defer_did == NLP_EVT_NOTHING_PENDING)
+- ndlp->nlp_defer_did = did;
+- return 0;
+- }
++ /* Defer the processing of the issue PLOGI until after the
++ * outstanding UNREG_RPI mbox command completes, unless we
++ * are going offline. This logic does not apply for Fabric DIDs
++ */
++ if ((ndlp->nlp_flag & NLP_UNREG_INP) &&
++ ((ndlp->nlp_DID & Fabric_DID_MASK) != Fabric_DID_MASK) &&
++ !(vport->fc_flag & FC_OFFLINE_MODE)) {
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
++ "4110 Issue PLOGI x%x deferred "
++ "on NPort x%x rpi x%x Data: x%px\n",
++ ndlp->nlp_defer_did, ndlp->nlp_DID,
++ ndlp->nlp_rpi, ndlp);
++
++ /* We can only defer 1st PLOGI */
++ if (ndlp->nlp_defer_did == NLP_EVT_NOTHING_PENDING)
++ ndlp->nlp_defer_did = did;
++ return 0;
+ }
+
+- /* If ndlp is not NULL, we will bump the reference count on it */
+ cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm));
+ elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, did,
+ ELS_CMD_PLOGI);
+--
+2.30.2
+
--- /dev/null
+From a2f86dd1da7ac60a4cceebd460ff12de15e25320 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 14:58:40 +0100
+Subject: scsi: pm80xx: Fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 40fa7394a1ad5706e795823276f2e394cca145d0 ]
+
+The for-loop iterates with a u8 loop counter i and compares this with the
+loop upper limit of pm8001_ha->max_q_num which is a u32 type. There is a
+potential infinite loop if pm8001_ha->max_q_num is larger than the u8 loop
+counter. Fix this by making the loop counter the same type as
+pm8001_ha->max_q_num.
+
+[mkp: this is purely theoretical, max_q_num is currently limited to 64]
+
+Link: https://lore.kernel.org/r/20210407135840.494747-1-colin.king@canonical.com
+Fixes: 65df7d1986a1 ("scsi: pm80xx: Fix chip initialization failure")
+Addresses-Coverity: ("Infinite loop")
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 31e5455d280c..1b1a57f46989 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -643,7 +643,7 @@ static void init_pci_device_addresses(struct pm8001_hba_info *pm8001_ha)
+ */
+ static int pm8001_chip_init(struct pm8001_hba_info *pm8001_ha)
+ {
+- u8 i = 0;
++ u32 i = 0;
+ u16 deviceid;
+ pci_read_config_word(pm8001_ha->pdev, PCI_DEVICE_ID, &deviceid);
+ /* 8081 controllers need BAR shift to access MPI space
+--
+2.30.2
+
--- /dev/null
+From 8e2908c5e27855da873951b5d4e8160d3943d522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 11:05:33 -0700
+Subject: scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
+
+From: Igor Pylypiv <ipylypiv@google.com>
+
+[ Upstream commit 3f744a14f331f56703a9d74e86520db045f11831 ]
+
+The mpi_uninit_check() takes longer for inbound doorbell register to be
+cleared. Increase the timeout substantially so that the driver does not
+fail to load.
+
+Previously, the inbound doorbell wait time was mistakenly increased in the
+mpi_init_check() instead of mpi_uninit_check(). It is okay to leave the
+mpi_init_check() wait time as-is as these are timeout values and if there
+is a failure, waiting longer is not an issue.
+
+Link: https://lore.kernel.org/r/20210406180534.1924345-2-ipylypiv@google.com
+Fixes: e90e236250e9 ("scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check")
+Reviewed-by: Vishakha Channapattan <vishakhavc@google.com>
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 84315560e8e1..c6b0834e3806 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1502,9 +1502,9 @@ static int mpi_uninit_check(struct pm8001_hba_info *pm8001_ha)
+
+ /* wait until Inbound DoorBell Clear Register toggled */
+ if (IS_SPCV_12G(pm8001_ha->pdev)) {
+- max_wait_count = 4 * 1000 * 1000;/* 4 sec */
++ max_wait_count = 30 * 1000 * 1000; /* 30 sec */
+ } else {
+- max_wait_count = 2 * 1000 * 1000;/* 2 sec */
++ max_wait_count = 15 * 1000 * 1000; /* 15 sec */
+ }
+ do {
+ udelay(1);
+--
+2.30.2
+
--- /dev/null
+From ca55cbb212ba6d4198d1c3163cb7d9df12275e08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 16:23:59 -0700
+Subject: scsi: qla2xxx: Check kzalloc() return value
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e5406d8ad4a1659f4d4d1b39fe203855c4eaef2d ]
+
+Instead of crashing if kzalloc() fails, make qla2x00_get_host_stats()
+return -ENOMEM.
+
+Link: https://lore.kernel.org/r/20210320232359.941-8-bvanassche@acm.org
+Fixes: dbf1f53cfd23 ("scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port")
+Cc: Himanshu Madhani <himanshu.madhani@oracle.com>
+Cc: Saurav Kashyap <skashyap@marvell.com>
+Cc: Nilesh Javali <njavali@marvell.com>
+Cc: Quinn Tran <qutran@marvell.com>
+Cc: Mike Christie <michael.christie@oracle.com>
+Cc: Daniel Wagner <dwagner@suse.de>
+Cc: Lee Duncan <lduncan@suse.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index d021e51344f5..aef2f7cc89d3 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -2584,6 +2584,10 @@ qla2x00_get_host_stats(struct bsg_job *bsg_job)
+ }
+
+ data = kzalloc(response_len, GFP_KERNEL);
++ if (!data) {
++ kfree(req_data);
++ return -ENOMEM;
++ }
+
+ ret = qla2xxx_get_ini_stats(fc_bsg_to_shost(bsg_job), req_data->stat_type,
+ data, response_len);
+--
+2.30.2
+
--- /dev/null
+From 705a1054f2128a72853bfbfeaeb1f8a51a44bab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:45:12 +0300
+Subject: scsi: sni_53c710: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV
+further below). Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru
+Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sni_53c710.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
+index 9e2e196bc202..97c6f81b1d2a 100644
+--- a/drivers/scsi/sni_53c710.c
++++ b/drivers/scsi/sni_53c710.c
+@@ -58,6 +58,7 @@ static int snirm710_probe(struct platform_device *dev)
+ struct NCR_700_Host_Parameters *hostdata;
+ struct Scsi_Host *host;
+ struct resource *res;
++ int rc;
+
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (!res)
+@@ -83,7 +84,9 @@ static int snirm710_probe(struct platform_device *dev)
+ goto out_kfree;
+ host->this_id = 7;
+ host->base = base;
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = rc = platform_get_irq(dev, 0);
++ if (rc < 0)
++ goto out_put_host;
+ if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) {
+ printk(KERN_ERR "snirm710: request_irq failed!\n");
+ goto out_put_host;
+--
+2.30.2
+
--- /dev/null
+From 880720628f0812c0ef405783a6806ca2998bed6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:44:08 +0300
+Subject: scsi: sun3x_esp: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru
+Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sun3x_esp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
+index 7de82f2c9757..d3489ac7ab28 100644
+--- a/drivers/scsi/sun3x_esp.c
++++ b/drivers/scsi/sun3x_esp.c
+@@ -206,7 +206,9 @@ static int esp_sun3x_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs_dma;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED,
+ "SUN3X ESP", esp);
+ if (err < 0)
+--
+2.30.2
+
--- /dev/null
+From bdb15dbc959e3690b0c8ed808e2cf8d37c6ba597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 23:50:58 +0300
+Subject: scsi: ufs: ufshcd-pltfrm: Fix deferred probing
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 339c9b63cc7ce779ce45c675bf709cb58b807fc3 ]
+
+The driver overrides the error codes returned by platform_get_irq() to
+-ENODEV, so if it returns -EPROBE_DEFER, the driver would fail the probe
+permanently instead of the deferred probing. Propagate the error code
+upstream as it should have been done from the start...
+
+Link: https://lore.kernel.org/r/420364ca-614a-45e3-4e35-0e0653c7bc53@omprussia.ru
+Fixes: 2953f850c3b8 ("[SCSI] ufs: use devres functions for ufshcd")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd-pltfrm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
+index 1a69949a4ea1..b56d9b4e5f03 100644
+--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
+@@ -377,7 +377,7 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+- err = -ENODEV;
++ err = irq;
+ goto out;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 2da69924e0ddac533df00be8af0aa1f45d685f33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 15:52:19 +0000
+Subject: seccomp: Fix CONFIG tests for Seccomp_filters
+
+From: Kenta.Tada@sony.com <Kenta.Tada@sony.com>
+
+[ Upstream commit 64bdc0244054f7d4bb621c8b4455e292f4e421bc ]
+
+Strictly speaking, seccomp filters are only used
+when CONFIG_SECCOMP_FILTER.
+This patch fixes the condition to enable "Seccomp_filters"
+in /proc/$pid/status.
+
+Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
+Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/OSBPR01MB26772D245E2CF4F26B76A989F5669@OSBPR01MB2677.jpnprd01.prod.outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/array.c | 2 ++
+ init/init_task.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index bb87e4d89cd8..7ec59171f197 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -342,8 +342,10 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
+ seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
+ #ifdef CONFIG_SECCOMP
+ seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
++#ifdef CONFIG_SECCOMP_FILTER
+ seq_put_decimal_ull(m, "\nSeccomp_filters:\t",
+ atomic_read(&p->seccomp.filter_count));
++#endif
+ #endif
+ seq_puts(m, "\nSpeculation_Store_Bypass:\t");
+ switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) {
+diff --git a/init/init_task.c b/init/init_task.c
+index 3711cdaafed2..8b08c2e19cbb 100644
+--- a/init/init_task.c
++++ b/init/init_task.c
+@@ -210,7 +210,7 @@ struct task_struct init_task
+ #ifdef CONFIG_SECURITY
+ .security = NULL,
+ #endif
+-#ifdef CONFIG_SECCOMP
++#ifdef CONFIG_SECCOMP_FILTER
+ .seccomp = { .filter_count = ATOMIC_INIT(0) },
+ #endif
+ };
+--
+2.30.2
+
--- /dev/null
+From 2ea16a73b8b2c7a9b985ef8bcc9ead62785cc8a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 11:06:15 -0800
+Subject: security: keys: trusted: fix TPM2 authorizations
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+[ Upstream commit de66514d934d70ce73c302ce0644b54970fc7196 ]
+
+In TPM 1.2 an authorization was a 20 byte number. The spec actually
+recommended you to hash variable length passwords and use the sha1
+hash as the authorization. Because the spec doesn't require this
+hashing, the current authorization for trusted keys is a 40 digit hex
+number. For TPM 2.0 the spec allows the passing in of variable length
+passwords and passphrases directly, so we should allow that in trusted
+keys for ease of use. Update the 'blobauth' parameter to take this
+into account, so we can now use plain text passwords for the keys.
+
+so before
+
+keyctl add trusted kmk "new 32 blobauth=f572d396fae9206628714fb2ce00f72e94f2258fkeyhandle=81000001" @u
+
+after we will accept both the old hex sha1 form as well as a new
+directly supplied password:
+
+keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" @u
+
+Since a sha1 hex code must be exactly 40 bytes long and a direct
+password must be 20 or less, we use the length as the discriminator
+for which form is input.
+
+Note this is both and enhancement and a potential bug fix. The TPM
+2.0 spec requires us to strip leading zeros, meaning empyty
+authorization is a zero length HMAC whereas we're currently passing in
+20 bytes of zeros. A lot of TPMs simply accept this as OK, but the
+Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this patch
+makes the Microsoft TPM emulator work with trusted keys.
+
+Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips")
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/keys/trusted-type.h | 1 +
+ security/keys/trusted-keys/trusted_tpm1.c | 32 ++++++++++++++++++-----
+ security/keys/trusted-keys/trusted_tpm2.c | 10 ++++---
+ 3 files changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
+index a94c03a61d8f..b2ed3481c6a0 100644
+--- a/include/keys/trusted-type.h
++++ b/include/keys/trusted-type.h
+@@ -30,6 +30,7 @@ struct trusted_key_options {
+ uint16_t keytype;
+ uint32_t keyhandle;
+ unsigned char keyauth[TPM_DIGEST_SIZE];
++ uint32_t blobauth_len;
+ unsigned char blobauth[TPM_DIGEST_SIZE];
+ uint32_t pcrinfo_len;
+ unsigned char pcrinfo[MAX_PCRINFO_SIZE];
+diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
+index 493eb91ed017..1e13c9f7ea8c 100644
+--- a/security/keys/trusted-keys/trusted_tpm1.c
++++ b/security/keys/trusted-keys/trusted_tpm1.c
+@@ -791,13 +791,33 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ return -EINVAL;
+ break;
+ case Opt_blobauth:
+- if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE)
+- return -EINVAL;
+- res = hex2bin(opt->blobauth, args[0].from,
+- SHA1_DIGEST_SIZE);
+- if (res < 0)
+- return -EINVAL;
++ /*
++ * TPM 1.2 authorizations are sha1 hashes passed in as
++ * hex strings. TPM 2.0 authorizations are simple
++ * passwords (although it can take a hash as well)
++ */
++ opt->blobauth_len = strlen(args[0].from);
++
++ if (opt->blobauth_len == 2 * TPM_DIGEST_SIZE) {
++ res = hex2bin(opt->blobauth, args[0].from,
++ TPM_DIGEST_SIZE);
++ if (res < 0)
++ return -EINVAL;
++
++ opt->blobauth_len = TPM_DIGEST_SIZE;
++ break;
++ }
++
++ if (tpm2 && opt->blobauth_len <= sizeof(opt->blobauth)) {
++ memcpy(opt->blobauth, args[0].from,
++ opt->blobauth_len);
++ break;
++ }
++
++ return -EINVAL;
++
+ break;
++
+ case Opt_migratable:
+ if (*args[0].from == '0')
+ pay->migratable = 0;
+diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
+index c87c4df8703d..4c19d3abddbe 100644
+--- a/security/keys/trusted-keys/trusted_tpm2.c
++++ b/security/keys/trusted-keys/trusted_tpm2.c
+@@ -97,10 +97,12 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+ TPM_DIGEST_SIZE);
+
+ /* sensitive */
+- tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1);
++ tpm_buf_append_u16(&buf, 4 + options->blobauth_len + payload->key_len + 1);
++
++ tpm_buf_append_u16(&buf, options->blobauth_len);
++ if (options->blobauth_len)
++ tpm_buf_append(&buf, options->blobauth, options->blobauth_len);
+
+- tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE);
+- tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE);
+ tpm_buf_append_u16(&buf, payload->key_len + 1);
+ tpm_buf_append(&buf, payload->key, payload->key_len);
+ tpm_buf_append_u8(&buf, payload->migratable);
+@@ -265,7 +267,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
+ NULL /* nonce */, 0,
+ TPM2_SA_CONTINUE_SESSION,
+ options->blobauth /* hmac */,
+- TPM_DIGEST_SIZE);
++ options->blobauth_len);
+
+ rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing");
+ if (rc > 0)
+--
+2.30.2
+
--- /dev/null
+From e2a3b9f5f56ccd008f1ecf5422e0e5e31f21760c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 12:29:47 -0700
+Subject: selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 0f20615d64ee2ad5e2a133a812382d0c4071589b ]
+
+Fix BPF_CORE_READ_BITFIELD() macro used for reading CO-RE-relocatable
+bitfields. Missing breaks in a switch caused 8-byte reads always. This can
+confuse libbpf because it does strict checks that memory load size corresponds
+to the original size of the field, which in this case quite often would be
+wrong.
+
+After fixing that, we run into another problem, which quite subtle, so worth
+documenting here. The issue is in Clang optimization and CO-RE relocation
+interactions. Without that asm volatile construct (also known as
+barrier_var()), Clang will re-order BYTE_OFFSET and BYTE_SIZE relocations and
+will apply BYTE_OFFSET 4 times for each switch case arm. This will result in
+the same error from libbpf about mismatch of memory load size and original
+field size. I.e., if we were reading u32, we'd still have *(u8 *), *(u16 *),
+*(u32 *), and *(u64 *) memory loads, three of which will fail. Using
+barrier_var() forces Clang to apply BYTE_OFFSET relocation first (and once) to
+calculate p, after which value of p is used without relocation in each of
+switch case arms, doing appropiately-sized memory load.
+
+Here's the list of relevant relocations and pieces of generated BPF code
+before and after this patch for test_core_reloc_bitfields_direct selftests.
+
+BEFORE
+=====
+ #45: core_reloc: insn #160 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32
+ #46: core_reloc: insn #167 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
+ #47: core_reloc: insn #174 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
+ #48: core_reloc: insn #178 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
+ #49: core_reloc: insn #182 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
+
+ 157: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
+ 159: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
+ 160: b7 02 00 00 04 00 00 00 r2 = 4
+; BYTE_SIZE relocation here ^^^
+ 161: 66 02 07 00 03 00 00 00 if w2 s> 3 goto +7 <LBB0_63>
+ 162: 16 02 0d 00 01 00 00 00 if w2 == 1 goto +13 <LBB0_65>
+ 163: 16 02 01 00 02 00 00 00 if w2 == 2 goto +1 <LBB0_66>
+ 164: 05 00 12 00 00 00 00 00 goto +18 <LBB0_69>
+
+0000000000000528 <LBB0_66>:
+ 165: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
+ 167: 69 11 08 00 00 00 00 00 r1 = *(u16 *)(r1 + 8)
+; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
+ 168: 05 00 0e 00 00 00 00 00 goto +14 <LBB0_69>
+
+0000000000000548 <LBB0_63>:
+ 169: 16 02 0a 00 04 00 00 00 if w2 == 4 goto +10 <LBB0_67>
+ 170: 16 02 01 00 08 00 00 00 if w2 == 8 goto +1 <LBB0_68>
+ 171: 05 00 0b 00 00 00 00 00 goto +11 <LBB0_69>
+
+0000000000000560 <LBB0_68>:
+ 172: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
+ 174: 79 11 08 00 00 00 00 00 r1 = *(u64 *)(r1 + 8)
+; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
+ 175: 05 00 07 00 00 00 00 00 goto +7 <LBB0_69>
+
+0000000000000580 <LBB0_65>:
+ 176: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
+ 178: 71 11 08 00 00 00 00 00 r1 = *(u8 *)(r1 + 8)
+; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
+ 179: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>
+
+00000000000005a0 <LBB0_67>:
+ 180: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
+ 182: 61 11 08 00 00 00 00 00 r1 = *(u32 *)(r1 + 8)
+; BYTE_OFFSET relo here w/ RIGHT size ^^^^^^^^^^^^^^^^
+
+00000000000005b8 <LBB0_69>:
+ 183: 67 01 00 00 20 00 00 00 r1 <<= 32
+ 184: b7 02 00 00 00 00 00 00 r2 = 0
+ 185: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
+ 186: c7 01 00 00 20 00 00 00 r1 s>>= 32
+ 187: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>
+
+00000000000005e0 <LBB0_71>:
+ 188: 77 01 00 00 20 00 00 00 r1 >>= 32
+
+AFTER
+=====
+
+ #30: core_reloc: insn #132 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
+ #31: core_reloc: insn #134 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32
+
+ 129: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
+ 131: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
+ 132: b7 01 00 00 08 00 00 00 r1 = 8
+; BYTE_OFFSET relo here ^^^
+; no size check for non-memory dereferencing instructions
+ 133: 0f 12 00 00 00 00 00 00 r2 += r1
+ 134: b7 03 00 00 04 00 00 00 r3 = 4
+; BYTE_SIZE relocation here ^^^
+ 135: 66 03 05 00 03 00 00 00 if w3 s> 3 goto +5 <LBB0_63>
+ 136: 16 03 09 00 01 00 00 00 if w3 == 1 goto +9 <LBB0_65>
+ 137: 16 03 01 00 02 00 00 00 if w3 == 2 goto +1 <LBB0_66>
+ 138: 05 00 0a 00 00 00 00 00 goto +10 <LBB0_69>
+
+0000000000000458 <LBB0_66>:
+ 139: 69 21 00 00 00 00 00 00 r1 = *(u16 *)(r2 + 0)
+; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
+ 140: 05 00 08 00 00 00 00 00 goto +8 <LBB0_69>
+
+0000000000000468 <LBB0_63>:
+ 141: 16 03 06 00 04 00 00 00 if w3 == 4 goto +6 <LBB0_67>
+ 142: 16 03 01 00 08 00 00 00 if w3 == 8 goto +1 <LBB0_68>
+ 143: 05 00 05 00 00 00 00 00 goto +5 <LBB0_69>
+
+0000000000000480 <LBB0_68>:
+ 144: 79 21 00 00 00 00 00 00 r1 = *(u64 *)(r2 + 0)
+; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
+ 145: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>
+
+0000000000000490 <LBB0_65>:
+ 146: 71 21 00 00 00 00 00 00 r1 = *(u8 *)(r2 + 0)
+; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
+ 147: 05 00 01 00 00 00 00 00 goto +1 <LBB0_69>
+
+00000000000004a0 <LBB0_67>:
+ 148: 61 21 00 00 00 00 00 00 r1 = *(u32 *)(r2 + 0)
+; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
+
+00000000000004a8 <LBB0_69>:
+ 149: 67 01 00 00 20 00 00 00 r1 <<= 32
+ 150: b7 02 00 00 00 00 00 00 r2 = 0
+ 151: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
+ 152: c7 01 00 00 20 00 00 00 r1 s>>= 32
+ 153: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>
+
+00000000000004d0 <LBB0_71>:
+ 154: 77 01 00 00 20 00 00 00 r1 >>= 323
+
+Fixes: ee26dade0e3b ("libbpf: Add support for relocatable bitfields")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Lorenz Bauer <lmb@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20210426192949.416837-4-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_core_read.h | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/bpf_core_read.h b/tools/lib/bpf/bpf_core_read.h
+index 53b3e199fb25..09ebe3db5f2f 100644
+--- a/tools/lib/bpf/bpf_core_read.h
++++ b/tools/lib/bpf/bpf_core_read.h
+@@ -88,11 +88,19 @@ enum bpf_enum_value_kind {
+ const void *p = (const void *)s + __CORE_RELO(s, field, BYTE_OFFSET); \
+ unsigned long long val; \
+ \
++ /* This is a so-called barrier_var() operation that makes specified \
++ * variable "a black box" for optimizing compiler. \
++ * It forces compiler to perform BYTE_OFFSET relocation on p and use \
++ * its calculated value in the switch below, instead of applying \
++ * the same relocation 4 times for each individual memory load. \
++ */ \
++ asm volatile("" : "=r"(p) : "0"(p)); \
++ \
+ switch (__CORE_RELO(s, field, BYTE_SIZE)) { \
+- case 1: val = *(const unsigned char *)p; \
+- case 2: val = *(const unsigned short *)p; \
+- case 4: val = *(const unsigned int *)p; \
+- case 8: val = *(const unsigned long long *)p; \
++ case 1: val = *(const unsigned char *)p; break; \
++ case 2: val = *(const unsigned short *)p; break; \
++ case 4: val = *(const unsigned int *)p; break; \
++ case 8: val = *(const unsigned long long *)p; break; \
+ } \
+ val <<= __CORE_RELO(s, field, LSHIFT_U64); \
+ if (__CORE_RELO(s, field, SIGNED)) \
+--
+2.30.2
+
--- /dev/null
+From 1260903bd13082b95dbe7611ece9c94fc5f93de7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 12:29:49 -0700
+Subject: selftests/bpf: Fix core_reloc test runner
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit bede0ebf0be87e9678103486a77f39e0334c6791 ]
+
+Fix failed tests checks in core_reloc test runner, which allowed failing tests
+to pass quietly. Also add extra check to make sure that expected to fail test cases with
+invalid names are caught as test failure anyway, as this is not an expected
+failure mode. Also fix mislabeled probed vs direct bitfield test cases.
+
+Fixes: 124a892d1c41 ("selftests/bpf: Test TYPE_EXISTS and TYPE_SIZE CO-RE relocations")
+Reported-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Lorenz Bauer <lmb@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20210426192949.416837-6-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/core_reloc.c | 20 +++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+index cd3ba54a1f68..4b517d76257d 100644
+--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c
++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+@@ -217,7 +217,7 @@ static int duration = 0;
+
+ #define BITFIELDS_CASE(name, ...) { \
+ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_probed.o", \
+- "direct:", name), \
++ "probed:", name), \
+ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \
+ .input_len = sizeof(struct core_reloc_##name), \
+ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
+@@ -225,7 +225,7 @@ static int duration = 0;
+ .output_len = sizeof(struct core_reloc_bitfields_output), \
+ }, { \
+ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_direct.o", \
+- "probed:", name), \
++ "direct:", name), \
+ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \
+ .input_len = sizeof(struct core_reloc_##name), \
+ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
+@@ -545,8 +545,7 @@ static struct core_reloc_test_case test_cases[] = {
+ ARRAYS_ERR_CASE(arrays___err_too_small),
+ ARRAYS_ERR_CASE(arrays___err_too_shallow),
+ ARRAYS_ERR_CASE(arrays___err_non_array),
+- ARRAYS_ERR_CASE(arrays___err_wrong_val_type1),
+- ARRAYS_ERR_CASE(arrays___err_wrong_val_type2),
++ ARRAYS_ERR_CASE(arrays___err_wrong_val_type),
+ ARRAYS_ERR_CASE(arrays___err_bad_zero_sz_arr),
+
+ /* enum/ptr/int handling scenarios */
+@@ -864,13 +863,20 @@ void test_core_reloc(void)
+ "prog '%s' not found\n", probe_name))
+ goto cleanup;
+
++
++ if (test_case->btf_src_file) {
++ err = access(test_case->btf_src_file, R_OK);
++ if (!ASSERT_OK(err, "btf_src_file"))
++ goto cleanup;
++ }
++
+ load_attr.obj = obj;
+ load_attr.log_level = 0;
+ load_attr.target_btf_path = test_case->btf_src_file;
+ err = bpf_object__load_xattr(&load_attr);
+ if (err) {
+ if (!test_case->fails)
+- CHECK(false, "obj_load", "failed to load prog '%s': %d\n", probe_name, err);
++ ASSERT_OK(err, "obj_load");
+ goto cleanup;
+ }
+
+@@ -909,10 +915,8 @@ void test_core_reloc(void)
+ goto cleanup;
+ }
+
+- if (test_case->fails) {
+- CHECK(false, "obj_load_fail", "should fail to load prog '%s'\n", probe_name);
++ if (!ASSERT_FALSE(test_case->fails, "obj_load_should_fail"))
+ goto cleanup;
+- }
+
+ equal = memcmp(data->out, test_case->output,
+ test_case->output_len) == 0;
+--
+2.30.2
+
--- /dev/null
+From 5eb92320ec53cc8cb73899ba4743b7a77ea495ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 12:29:48 -0700
+Subject: selftests/bpf: Fix field existence CO-RE reloc tests
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 5a30eb23922b52f33222c6729b6b3ff1c37a6c66 ]
+
+Negative field existence cases for have a broken assumption that FIELD_EXISTS
+CO-RE relo will fail for fields that match the name but have incompatible type
+signature. That's not how CO-RE relocations generally behave. Types and fields
+that match by name but not by expected type are treated as non-matching
+candidates and are skipped. Error later is reported if no matching candidate
+was found. That's what happens for most relocations, but existence relocations
+(FIELD_EXISTS and TYPE_EXISTS) are more permissive and they are designed to
+return 0 or 1, depending if a match is found. This allows to handle
+name-conflicting but incompatible types in BPF code easily. Combined with
+___flavor suffixes, it's possible to handle pretty much any structural type
+changes in kernel within the compiled once BPF source code.
+
+So, long story short, negative field existence test cases are invalid in their
+assumptions, so this patch reworks them into a single consolidated positive
+case that doesn't match any of the fields.
+
+Fixes: c7566a69695c ("selftests/bpf: Add field existence CO-RE relocs tests")
+Reported-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Lorenz Bauer <lmb@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20210426192949.416837-5-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/core_reloc.c | 31 ++++++++++++-------
+ ...ore_reloc_existence___err_wrong_arr_kind.c | 3 --
+ ...loc_existence___err_wrong_arr_value_type.c | 3 --
+ ...ore_reloc_existence___err_wrong_int_kind.c | 3 --
+ ..._core_reloc_existence___err_wrong_int_sz.c | 3 --
+ ...ore_reloc_existence___err_wrong_int_type.c | 3 --
+ ..._reloc_existence___err_wrong_struct_type.c | 3 --
+ ..._core_reloc_existence___wrong_field_defs.c | 3 ++
+ .../selftests/bpf/progs/core_reloc_types.h | 20 ++----------
+ 9 files changed, 24 insertions(+), 48 deletions(-)
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c
+ delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c
+ create mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+index 06eb956ff7bb..cd3ba54a1f68 100644
+--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c
++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+@@ -210,11 +210,6 @@ static int duration = 0;
+ .bpf_obj_file = "test_core_reloc_existence.o", \
+ .btf_src_file = "btf__core_reloc_" #name ".o" \
+
+-#define FIELD_EXISTS_ERR_CASE(name) { \
+- FIELD_EXISTS_CASE_COMMON(name), \
+- .fails = true, \
+-}
+-
+ #define BITFIELDS_CASE_COMMON(objfile, test_name_prefix, name) \
+ .case_name = test_name_prefix#name, \
+ .bpf_obj_file = objfile, \
+@@ -642,13 +637,25 @@ static struct core_reloc_test_case test_cases[] = {
+ },
+ .output_len = sizeof(struct core_reloc_existence_output),
+ },
+-
+- FIELD_EXISTS_ERR_CASE(existence__err_int_sz),
+- FIELD_EXISTS_ERR_CASE(existence__err_int_type),
+- FIELD_EXISTS_ERR_CASE(existence__err_int_kind),
+- FIELD_EXISTS_ERR_CASE(existence__err_arr_kind),
+- FIELD_EXISTS_ERR_CASE(existence__err_arr_value_type),
+- FIELD_EXISTS_ERR_CASE(existence__err_struct_type),
++ {
++ FIELD_EXISTS_CASE_COMMON(existence___wrong_field_defs),
++ .input = STRUCT_TO_CHAR_PTR(core_reloc_existence___wrong_field_defs) {
++ },
++ .input_len = sizeof(struct core_reloc_existence___wrong_field_defs),
++ .output = STRUCT_TO_CHAR_PTR(core_reloc_existence_output) {
++ .a_exists = 0,
++ .b_exists = 0,
++ .c_exists = 0,
++ .arr_exists = 0,
++ .s_exists = 0,
++ .a_value = 0xff000001u,
++ .b_value = 0xff000002u,
++ .c_value = 0xff000003u,
++ .arr_value = 0xff000004u,
++ .s_value = 0xff000005u,
++ },
++ .output_len = sizeof(struct core_reloc_existence_output),
++ },
+
+ /* bitfield relocation checks */
+ BITFIELDS_CASE(bitfields, {
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c
+deleted file mode 100644
+index dd0ffa518f36..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_arr_kind x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c
+deleted file mode 100644
+index bc83372088ad..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_arr_value_type x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c
+deleted file mode 100644
+index 917bec41be08..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_int_kind x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c
+deleted file mode 100644
+index 6ec7e6ec1c91..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_int_sz x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c
+deleted file mode 100644
+index 7bbcacf2b0d1..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_int_type x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c
+deleted file mode 100644
+index f384dd38ec70..000000000000
+--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c
++++ /dev/null
+@@ -1,3 +0,0 @@
+-#include "core_reloc_types.h"
+-
+-void f(struct core_reloc_existence___err_wrong_struct_type x) {}
+diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c
+new file mode 100644
+index 000000000000..d14b496190c3
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c
+@@ -0,0 +1,3 @@
++#include "core_reloc_types.h"
++
++void f(struct core_reloc_existence___wrong_field_defs x) {}
+diff --git a/tools/testing/selftests/bpf/progs/core_reloc_types.h b/tools/testing/selftests/bpf/progs/core_reloc_types.h
+index 9a2850850121..664eea1013aa 100644
+--- a/tools/testing/selftests/bpf/progs/core_reloc_types.h
++++ b/tools/testing/selftests/bpf/progs/core_reloc_types.h
+@@ -700,27 +700,11 @@ struct core_reloc_existence___minimal {
+ int a;
+ };
+
+-struct core_reloc_existence___err_wrong_int_sz {
+- short a;
+-};
+-
+-struct core_reloc_existence___err_wrong_int_type {
++struct core_reloc_existence___wrong_field_defs {
++ void *a;
+ int b[1];
+-};
+-
+-struct core_reloc_existence___err_wrong_int_kind {
+ struct{ int x; } c;
+-};
+-
+-struct core_reloc_existence___err_wrong_arr_kind {
+ int arr;
+-};
+-
+-struct core_reloc_existence___err_wrong_arr_value_type {
+- short arr[1];
+-};
+-
+-struct core_reloc_existence___err_wrong_struct_type {
+ int s;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 3d51c5837b305d5f173eb9c2a3d9570551d5d64d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 12:40:34 -0700
+Subject: selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool
+ changed
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit cab62c37be057379a2a17b1b2eacd9dcba1e14dc ]
+
+Trigger vmlinux.h and BPF skeletons re-generation if detected that bpftool was
+re-compiled. Otherwise full `make clean` is required to get updated skeletons,
+if bpftool is modified.
+
+Fixes: acbd06206bbb ("selftests/bpf: Add vmlinux.h selftest exercising tracing of syscalls")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210318194036.3521577-11-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 044bfdcf5b74..76a325862119 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -221,7 +221,7 @@ $(HOST_BPFOBJ): $(wildcard $(BPFDIR)/*.[ch] $(BPFDIR)/Makefile) \
+ DESTDIR=$(HOST_SCRATCH_DIR)/ prefix= all install_headers
+ endif
+
+-$(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) | $(BPFTOOL) $(INCLUDE_DIR)
++$(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) | $(INCLUDE_DIR)
+ ifeq ($(VMLINUX_H),)
+ $(call msg,GEN,,$@)
+ $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@
+@@ -346,7 +346,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o: \
+
+ $(TRUNNER_BPF_SKELS): $(TRUNNER_OUTPUT)/%.skel.h: \
+ $(TRUNNER_OUTPUT)/%.o \
+- | $(BPFTOOL) $(TRUNNER_OUTPUT)
++ $(BPFTOOL) \
++ | $(TRUNNER_OUTPUT)
+ $$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@)
+ $(Q)$$(BPFTOOL) gen skeleton $$< > $$@
+ endif
+--
+2.30.2
+
--- /dev/null
+From 44140d8611dc625b61effc3474163181220729b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 01:44:20 +0100
+Subject: selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit cb4969e6f9f5ee12521aec764fa3d4bbd91bc797 ]
+
+Currently the following command produces an error message:
+
+ linux# make kselftest TARGETS=bpf O=/mnt/linux-build
+ # selftests: bpf: test_libbpf.sh
+ # ./test_libbpf.sh: line 23: ./test_libbpf_open: No such file or directory
+ # test_libbpf: failed at file test_l4lb.o
+ # selftests: test_libbpf [FAILED]
+
+The error message might not affect the return code of make, therefore
+one needs to grep make output in order to detect it.
+
+This is not the only instance of the same underlying problem; any test
+with more than one element in $(TEST_PROGS) fails the same way. Another
+example:
+
+ linux# make O=/mnt/linux-build TARGETS=splice kselftest
+ [...]
+ # ./short_splice_read.sh: 15: ./splice_read: not found
+ # FAIL: /sys/module/test_module/sections/.init.text 2
+ not ok 2 selftests: splice: short_splice_read.sh # exit=1
+
+The current logic prepends $(OUTPUT) only to the first member of
+$(TEST_PROGS). After that, run_one() does
+
+ cd `dirname $TEST`
+
+For all tests except the first one, `dirname $TEST` is ., which means
+they cannot access the files generated in $(OUTPUT).
+
+Fix by using $(addprefix) to prepend $(OUTPUT)/ to each member of
+$(TEST_PROGS).
+
+Fixes: 1a940687e424 ("selftests: lib.mk: copy test scripts and test files for make O=dir run")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lib.mk | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index a5ce26d548e4..be17462fe146 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -74,7 +74,8 @@ ifdef building_out_of_srctree
+ rsync -aq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \
+ fi
+ @if [ "X$(TEST_PROGS)" != "X" ]; then \
+- $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(OUTPUT)/$(TEST_PROGS)) ; \
++ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \
++ $(addprefix $(OUTPUT)/,$(TEST_PROGS))) ; \
+ else \
+ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS)); \
+ fi
+--
+2.30.2
+
--- /dev/null
+From 45c7922086883cb971ddf99ba1c54448cf0f2ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 14:19:44 +0200
+Subject: selftests: mlxsw: Remove a redundant if statement in port_scale test
+
+From: Danielle Ratson <danieller@nvidia.com>
+
+[ Upstream commit b6fc2f212108b3676f54d00a2c38e3bc36753980 ]
+
+Currently, the error return code of the failure condition is lost after
+using an if statement, so the test doesn't fail when it should.
+
+Remove the if statement that separates the condition and the error code
+check, so the test won't always pass.
+
+Fixes: 5154b1b826d9b ("selftests: mlxsw: Add a scale test for physical ports")
+Reported-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Danielle Ratson <danieller@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/mlxsw/port_scale.sh | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/mlxsw/port_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/port_scale.sh
+index f813ffefc07e..65f43a7ce9c9 100644
+--- a/tools/testing/selftests/drivers/net/mlxsw/port_scale.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/port_scale.sh
+@@ -55,10 +55,6 @@ port_test()
+ | jq '.[][][] | select(.name=="physical_ports") |.["occ"]')
+
+ [[ $occ -eq $max_ports ]]
+- if [[ $should_fail -eq 0 ]]; then
+- check_err $? "Mismatch ports number: Expected $max_ports, got $occ."
+- else
+- check_err_fail $should_fail $? "Reached more ports than expected"
+- fi
++ check_err_fail $should_fail $? "Attempt to create $max_ports ports (actual result $occ)"
+
+ }
+--
+2.30.2
+
--- /dev/null
+From 6cdcafe45b79842f8107dd34e199d9cf3264ea8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 14:19:45 +0200
+Subject: selftests: mlxsw: Remove a redundant if statement in tc_flower_scale
+ test
+
+From: Danielle Ratson <danieller@nvidia.com>
+
+[ Upstream commit 1f1c92139e36223b89d8140f2b72f75e79baf8bd ]
+
+Currently, the error return code of the failure condition is lost after
+using an if statement, so the test doesn't fail when it should.
+
+Remove the if statement that separates the condition and the error code
+check, so the test won't always pass.
+
+Fixes: abfce9e062021 ("selftests: mlxsw: Reduce running time using offload indication")
+Reported-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Danielle Ratson <danieller@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh
+index cc0f07e72cf2..aa74be9f47c8 100644
+--- a/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh
+@@ -98,11 +98,7 @@ __tc_flower_test()
+ jq -r '[ .[] | select(.kind == "flower") |
+ .options | .in_hw ]' | jq .[] | wc -l)
+ [[ $((offload_count - 1)) -eq $count ]]
+- if [[ $should_fail -eq 0 ]]; then
+- check_err $? "Offload mismatch"
+- else
+- check_err_fail $should_fail $? "Offload more than expacted"
+- fi
++ check_err_fail $should_fail $? "Attempt to offload $count rules (actual result $((offload_count - 1)))"
+ }
+
+ tc_flower_test()
+--
+2.30.2
+
--- /dev/null
+From 041828cec970815232b93dfe78b1f035bc1c831e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 14:19:43 +0200
+Subject: selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit c8d0260cdd96fdccdef0509c4160e28a1012a5d7 ]
+
+The FDB roaming test installs a destination MAC address on the wrong
+interface of an FDB database and tests whether the mirroring fails, because
+packets are sent to the wrong port. The test by mistake installs the FDB
+entry as local. This worked previously, because drivers were notified of
+local FDB entries in the same way as of static entries. However that has
+been fixed in the commit 6ab4c3117aec ("net: bridge: don't notify switchdev
+for local FDB addresses"), and local entries are not notified anymore. As a
+result, the HW is not reconfigured for the FDB roam, and mirroring keeps
+working, failing the test.
+
+To fix the issue, mark the FDB entry as static.
+
+Fixes: 9c7c8a82442c ("selftests: forwarding: mirror_gre_vlan_bridge_1q: Add more tests")
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+index c02291e9841e..880e3ab9d088 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+@@ -271,7 +271,7 @@ test_span_gre_fdb_roaming()
+
+ while ((RET == 0)); do
+ bridge fdb del dev $swp3 $h3mac vlan 555 master 2>/dev/null
+- bridge fdb add dev $swp2 $h3mac vlan 555 master
++ bridge fdb add dev $swp2 $h3mac vlan 555 master static
+ sleep 1
+ fail_test_span_gre_dir $tundev ingress
+
+--
+2.30.2
+
--- /dev/null
+From 04d1130c268143952897bb158f860226633faf8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 09:01:55 -0800
+Subject: selftests/x86: Add a missing .note.GNU-stack section to thunks_32.S
+
+From: Andy Lutomirski <luto@kernel.org>
+
+[ Upstream commit f706bb59204ba1c47e896b456c97977fc97b7964 ]
+
+test_syscall_vdso_32 ended up with an executable stacks because the asm
+was missing the annotation that says that it is modern and doesn't need
+an executable stack. Add the annotation.
+
+This was missed in commit aeaaf005da1d ("selftests/x86: Add missing
+.note.GNU-stack sections").
+
+Fixes: aeaaf005da1d ("selftests/x86: Add missing .note.GNU-stack sections")
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/487ed5348a43c031b816fa7e9efedb75dc324299.1614877299.git.luto@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/x86/thunks_32.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/x86/thunks_32.S b/tools/testing/selftests/x86/thunks_32.S
+index a71d92da8f46..f3f56e681e9f 100644
+--- a/tools/testing/selftests/x86/thunks_32.S
++++ b/tools/testing/selftests/x86/thunks_32.S
+@@ -45,3 +45,5 @@ call64_from_32:
+ ret
+
+ .size call64_from_32, .-call64_from_32
++
++.section .note.GNU-stack,"",%progbits
+--
+2.30.2
+
--- /dev/null
+From 2c9dbcf0dad8e4e82a2fbaa80c8809410b184cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:08 +0200
+Subject: serial: core: return early on unsupported ioctls
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 79c5966cec7b148199386ef9933c31b999379065 ]
+
+Drivers can return -ENOIOCTLCMD when an ioctl is not recognised to tell
+the upper layers to continue looking for a handler.
+
+This is not the case for the RS485 and ISO7816 ioctls whose handlers
+should return -ENOTTY directly in case a serial driver does not
+implement the corresponding methods.
+
+Fixes: a5f276f10ff7 ("serial_core: Handle TIOC[GS]RS485 ioctls.")
+Fixes: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-9-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index ba31e97d3d96..43f02ed055d5 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1305,7 +1305,7 @@ static int uart_set_rs485_config(struct uart_port *port,
+ unsigned long flags;
+
+ if (!port->rs485_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user)))
+ return -EFAULT;
+@@ -1329,7 +1329,7 @@ static int uart_get_iso7816_config(struct uart_port *port,
+ struct serial_iso7816 aux;
+
+ if (!port->iso7816_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ spin_lock_irqsave(&port->lock, flags);
+ aux = port->iso7816;
+@@ -1349,7 +1349,7 @@ static int uart_set_iso7816_config(struct uart_port *port,
+ unsigned long flags;
+
+ if (!port->iso7816_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ if (copy_from_user(&iso7816, iso7816_user, sizeof(*iso7816_user)))
+ return -EFAULT;
+--
+2.30.2
+
--- /dev/null
+From a604ae10ad7bc56af0d90ff1b8feca7c1a3d1f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 03:49:29 +0000
+Subject: serial: liteuart: fix return value check in liteuart_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit cebeddd6d0d9f839b9df2930b6a768b54913a763 ]
+
+In case of error, the function devm_platform_get_and_ioremap_resource()
+returns ERR_PTR() and never returns NULL. The NULL test in the return
+value check should be replaced with IS_ERR().
+
+Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20210305034929.3234352-1-weiyongjun1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/liteuart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/liteuart.c b/drivers/tty/serial/liteuart.c
+index 64842f3539e1..0b06770642cb 100644
+--- a/drivers/tty/serial/liteuart.c
++++ b/drivers/tty/serial/liteuart.c
+@@ -270,8 +270,8 @@ static int liteuart_probe(struct platform_device *pdev)
+
+ /* get membase */
+ port->membase = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
+- if (!port->membase)
+- return -ENXIO;
++ if (IS_ERR(port->membase))
++ return PTR_ERR(port->membase);
+
+ /* values not from device tree */
+ port->dev = &pdev->dev;
+--
+2.30.2
+
--- /dev/null
+From aac403db4887c7fb7725fd2bb288d1c015ab2d6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 23:09:45 +0200
+Subject: serial: omap: don't disable rs485 if rts gpio is missing
+
+From: Dario Binacchi <dariobin@libero.it>
+
+[ Upstream commit 45f6b6db53c80787b79044629b062dfcf2da71ec ]
+
+There are rs485 transceivers (e.g. MAX13487E/MAX13488E) which
+automatically disable or enable the driver and receiver to keep the bus
+in the correct state.
+In these cases we don't need a GPIO for flow control.
+
+Fixes: 4a0ac0f55b18 ("OMAP: add RS485 support")
+Signed-off-by: Dario Binacchi <dariobin@libero.it>
+Link: https://lore.kernel.org/r/20210415210945.25863-1-dariobin@libero.it
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/omap-serial.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
+index 76b94d0ff586..1583e93b2202 100644
+--- a/drivers/tty/serial/omap-serial.c
++++ b/drivers/tty/serial/omap-serial.c
+@@ -302,7 +302,8 @@ static void serial_omap_stop_tx(struct uart_port *port)
+ serial_out(up, UART_OMAP_SCR, up->scr);
+ res = (port->rs485.flags & SER_RS485_RTS_AFTER_SEND) ?
+ 1 : 0;
+- if (gpiod_get_value(up->rts_gpiod) != res) {
++ if (up->rts_gpiod &&
++ gpiod_get_value(up->rts_gpiod) != res) {
+ if (port->rs485.delay_rts_after_send > 0)
+ mdelay(
+ port->rs485.delay_rts_after_send);
+@@ -411,7 +412,7 @@ static void serial_omap_start_tx(struct uart_port *port)
+
+ /* if rts not already enabled */
+ res = (port->rs485.flags & SER_RS485_RTS_ON_SEND) ? 1 : 0;
+- if (gpiod_get_value(up->rts_gpiod) != res) {
++ if (up->rts_gpiod && gpiod_get_value(up->rts_gpiod) != res) {
+ gpiod_set_value(up->rts_gpiod, res);
+ if (port->rs485.delay_rts_before_send > 0)
+ mdelay(port->rs485.delay_rts_before_send);
+@@ -1407,18 +1408,13 @@ serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485)
+ /* store new config */
+ port->rs485 = *rs485;
+
+- /*
+- * Just as a precaution, only allow rs485
+- * to be enabled if the gpio pin is valid
+- */
+ if (up->rts_gpiod) {
+ /* enable / disable rts */
+ val = (port->rs485.flags & SER_RS485_ENABLED) ?
+ SER_RS485_RTS_AFTER_SEND : SER_RS485_RTS_ON_SEND;
+ val = (port->rs485.flags & val) ? 1 : 0;
+ gpiod_set_value(up->rts_gpiod, val);
+- } else
+- port->rs485.flags &= ~SER_RS485_ENABLED;
++ }
+
+ /* Enable interrupts */
+ up->ier = mode;
+--
+2.30.2
+
--- /dev/null
+From 8b6a0b852d88c26fcf9699721ee3a077b258d9a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Apr 2021 11:47:05 +0200
+Subject: serial: omap: fix rs485 half-duplex filtering
+
+From: Dario Binacchi <dariobin@libero.it>
+
+[ Upstream commit e2a5e8448e7393e96ccde346c68764b40a52cc10 ]
+
+Data received during half-duplex transmission must be filtered.
+If the target device responds quickly, emptying the FIFO at the end of
+the transmission can erase not only the echo characters but also part of
+the response message.
+By keeping the receive interrupt enabled even during transmission, it
+allows you to filter each echo character and only in a number equal to
+those transmitted.
+The issue was generated by a target device that started responding
+240us later having received a request in communication at 115200bps.
+Sometimes, some messages received by the target were missing some of the
+first bytes.
+
+Fixes: 3a13884abea0 ("tty/serial: omap: empty the RX FIFO at the end of half-duplex TX")
+Signed-off-by: Dario Binacchi <dariobin@libero.it>
+Link: https://lore.kernel.org/r/20210418094705.27014-1-dariobin@libero.it
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/omap-serial.c | 39 ++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
+index 1583e93b2202..84e8158088cd 100644
+--- a/drivers/tty/serial/omap-serial.c
++++ b/drivers/tty/serial/omap-serial.c
+@@ -159,6 +159,8 @@ struct uart_omap_port {
+ u32 calc_latency;
+ struct work_struct qos_work;
+ bool is_suspending;
++
++ unsigned int rs485_tx_filter_count;
+ };
+
+ #define to_uart_omap_port(p) ((container_of((p), struct uart_omap_port, port)))
+@@ -329,19 +331,6 @@ static void serial_omap_stop_tx(struct uart_port *port)
+ serial_out(up, UART_IER, up->ier);
+ }
+
+- if ((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
+- /*
+- * Empty the RX FIFO, we are not interested in anything
+- * received during the half-duplex transmission.
+- */
+- serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_RCVR);
+- /* Re-enable RX interrupts */
+- up->ier |= UART_IER_RLSI | UART_IER_RDI;
+- up->port.read_status_mask |= UART_LSR_DR;
+- serial_out(up, UART_IER, up->ier);
+- }
+-
+ pm_runtime_mark_last_busy(up->dev);
+ pm_runtime_put_autosuspend(up->dev);
+ }
+@@ -367,6 +356,10 @@ static void transmit_chars(struct uart_omap_port *up, unsigned int lsr)
+ serial_out(up, UART_TX, up->port.x_char);
+ up->port.icount.tx++;
+ up->port.x_char = 0;
++ if ((up->port.rs485.flags & SER_RS485_ENABLED) &&
++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX))
++ up->rs485_tx_filter_count++;
++
+ return;
+ }
+ if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
+@@ -378,6 +371,10 @@ static void transmit_chars(struct uart_omap_port *up, unsigned int lsr)
+ serial_out(up, UART_TX, xmit->buf[xmit->tail]);
+ xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+ up->port.icount.tx++;
++ if ((up->port.rs485.flags & SER_RS485_ENABLED) &&
++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX))
++ up->rs485_tx_filter_count++;
++
+ if (uart_circ_empty(xmit))
+ break;
+ } while (--count > 0);
+@@ -421,7 +418,7 @@ static void serial_omap_start_tx(struct uart_port *port)
+
+ if ((port->rs485.flags & SER_RS485_ENABLED) &&
+ !(port->rs485.flags & SER_RS485_RX_DURING_TX))
+- serial_omap_stop_rx(port);
++ up->rs485_tx_filter_count = 0;
+
+ serial_omap_enable_ier_thri(up);
+ pm_runtime_mark_last_busy(up->dev);
+@@ -492,8 +489,13 @@ static void serial_omap_rlsi(struct uart_omap_port *up, unsigned int lsr)
+ * Read one data character out to avoid stalling the receiver according
+ * to the table 23-246 of the omap4 TRM.
+ */
+- if (likely(lsr & UART_LSR_DR))
++ if (likely(lsr & UART_LSR_DR)) {
+ serial_in(up, UART_RX);
++ if ((up->port.rs485.flags & SER_RS485_ENABLED) &&
++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX) &&
++ up->rs485_tx_filter_count)
++ up->rs485_tx_filter_count--;
++ }
+
+ up->port.icount.rx++;
+ flag = TTY_NORMAL;
+@@ -544,6 +546,13 @@ static void serial_omap_rdi(struct uart_omap_port *up, unsigned int lsr)
+ return;
+
+ ch = serial_in(up, UART_RX);
++ if ((up->port.rs485.flags & SER_RS485_ENABLED) &&
++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX) &&
++ up->rs485_tx_filter_count) {
++ up->rs485_tx_filter_count--;
++ return;
++ }
++
+ flag = TTY_NORMAL;
+ up->port.icount.rx++;
+
+--
+2.30.2
+
--- /dev/null
+From 8d9cbcd242cab528d41ae7dab6c5d7c28c40a5af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:06 +0100
+Subject: serial: stm32: add FIFO flush when port is closed
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 9f77d19207a0e8ba814c8ceb22e90ce7cb2aef64 ]
+
+Transmission complete error is sent when ISR_TC is not set. If port closure
+is requested despite data in TDR / TX FIFO has not been sent (because of
+flow control), ISR_TC is not set and error message is sent on port closure
+but also when a new port is opened.
+
+Flush the data when port is closed, so the error isn't printed twice upon
+next port opening.
+
+Fixes: 64c32eab6603 ("serial: stm32: Add support of TC bit status check")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-12-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 183c76ddb165..d205fce1950a 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -691,6 +691,11 @@ static void stm32_usart_shutdown(struct uart_port *port)
+ if (ret)
+ dev_err(port->dev, "Transmission is not complete\n");
+
++ /* flush RX & TX FIFO */
++ if (ofs->rqr != UNDEF_REG)
++ writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ,
++ port->membase + ofs->rqr);
++
+ stm32_usart_clr_bits(port, ofs->cr1, val);
+
+ free_irq(port->irq, port);
+--
+2.30.2
+
--- /dev/null
+From b4b157363a2c88020fb370eee371e06ac3d22ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:04 +0100
+Subject: serial: stm32: call stm32_transmit_chars locked
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit f16b90c2d9db3e6ac719d1946b9d335ca4ab33f3 ]
+
+stm32_transmit_chars should be called under lock also in tx DMA callback.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-10-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 74046ae3a412..2bdd04a47f91 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -291,13 +291,16 @@ static void stm32_usart_tx_dma_complete(void *arg)
+ struct uart_port *port = arg;
+ struct stm32_port *stm32port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
++ unsigned long flags;
+
+ dmaengine_terminate_async(stm32port->tx_ch);
+ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+ stm32port->tx_dma_busy = false;
+
+ /* Let's see if we have pending data to send */
++ spin_lock_irqsave(&port->lock, flags);
+ stm32_usart_transmit_chars(port);
++ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+ static void stm32_usart_tx_interrupt_enable(struct uart_port *port)
+--
+2.30.2
+
--- /dev/null
+From dd1aeece232ca94b1146ae064de7fc4d0dbb7500 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:00 +0100
+Subject: serial: stm32: fix a deadlock condition with wakeup event
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit ad7676812437a00a4c6be155fc17926069f99084 ]
+
+Deadlock issue is seen when enabling CONFIG_PROVE_LOCKING=Y, and uart
+console as wakeup source. Deadlock occurs when resuming from low power
+mode if system is waked up via usart console.
+The deadlock is triggered 100% when also disabling console suspend prior
+to go to suspend.
+
+Simplified call stack, deadlock condition:
+- stm32_console_write <-- spin_lock already held
+- print_circular_bug
+- pm_wakeup_dev_event <-- triggers lockdep as seen above
+- stm32_receive_chars
+- stm32_interrupt <-- wakeup via uart console, takes the lock
+
+So, revisit spin_lock in stm32-usart driver:
+- there is no need to hold the lock to access ICR (atomic clear of status
+ flags)
+- only hold the lock inside stm32_receive_chars() routine (no need to
+ call pm_wakeup_dev_event with lock held)
+- keep stm32_transmit_chars() routine called with lock held
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-6-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 223cec70c57c..370141445780 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -214,13 +214,18 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
+ struct tty_port *tport = &port->state->port;
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- unsigned long c;
++ unsigned long c, flags;
+ u32 sr;
+ char flag;
+
+ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
+ pm_wakeup_event(tport->tty->dev, 0);
+
++ if (threaded)
++ spin_lock_irqsave(&port->lock, flags);
++ else
++ spin_lock(&port->lock);
++
+ while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res,
+ threaded)) {
+ sr |= USART_SR_DUMMY_RX;
+@@ -276,9 +281,12 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
+ uart_insert_char(port, sr, USART_SR_ORE, c, flag);
+ }
+
+- spin_unlock(&port->lock);
++ if (threaded)
++ spin_unlock_irqrestore(&port->lock, flags);
++ else
++ spin_unlock(&port->lock);
++
+ tty_flip_buffer_push(tport);
+- spin_lock(&port->lock);
+ }
+
+ static void stm32_usart_tx_dma_complete(void *arg)
+@@ -459,8 +467,6 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ u32 sr;
+
+- spin_lock(&port->lock);
+-
+ sr = readl_relaxed(port->membase + ofs->isr);
+
+ if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG)
+@@ -474,10 +480,11 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
+ if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch))
+ stm32_usart_receive_chars(port, false);
+
+- if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch))
++ if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch)) {
++ spin_lock(&port->lock);
+ stm32_usart_transmit_chars(port);
+-
+- spin_unlock(&port->lock);
++ spin_unlock(&port->lock);
++ }
+
+ if (stm32_port->rx_ch)
+ return IRQ_WAKE_THREAD;
+@@ -490,13 +497,9 @@ static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr)
+ struct uart_port *port = ptr;
+ struct stm32_port *stm32_port = to_stm32_port(port);
+
+- spin_lock(&port->lock);
+-
+ if (stm32_port->rx_ch)
+ stm32_usart_receive_chars(port, true);
+
+- spin_unlock(&port->lock);
+-
+ return IRQ_HANDLED;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f82dc8eaee65934b31ff1e2e4a555d525ec09dd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:02 +0100
+Subject: serial: stm32: fix a deadlock in set_termios
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 436c97936001776f16153771ee887f125443e974 ]
+
+CTS/RTS GPIOs support that has been added recently to STM32 UART driver has
+introduced scheduled code in a set_termios part protected by a spin lock.
+This generates a potential deadlock scenario:
+
+Chain exists of:
+&irq_desc_lock_class --> console_owner --> &port_lock_key
+
+Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+lock(&port_lock_key);
+ lock(console_owner);
+ lock(&port_lock_key);
+lock(&irq_desc_lock_class);
+
+*** DEADLOCK ***
+4 locks held by stty/766:
+
+Move the scheduled code after the spinlock.
+
+Fixes: 6cf61b9bd7cc ("tty: serial: Add modem control gpio support for STM32 UART")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-8-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 326f300dd410..a381ee52168a 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -829,12 +829,6 @@ static void stm32_usart_set_termios(struct uart_port *port,
+ cr3 |= USART_CR3_CTSE | USART_CR3_RTSE;
+ }
+
+- /* Handle modem control interrupts */
+- if (UART_ENABLE_MS(port, termios->c_cflag))
+- stm32_usart_enable_ms(port);
+- else
+- stm32_usart_disable_ms(port);
+-
+ usartdiv = DIV_ROUND_CLOSEST(port->uartclk, baud);
+
+ /*
+@@ -916,6 +910,12 @@ static void stm32_usart_set_termios(struct uart_port *port,
+
+ stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+ spin_unlock_irqrestore(&port->lock, flags);
++
++ /* Handle modem control interrupts */
++ if (UART_ENABLE_MS(port, termios->c_cflag))
++ stm32_usart_enable_ms(port);
++ else
++ stm32_usart_disable_ms(port);
+ }
+
+ static const char *stm32_usart_type(struct uart_port *port)
+--
+2.30.2
+
--- /dev/null
+From c2cd3cd784874d3aa8f9858f511553c4d52b7fbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:05 +0100
+Subject: serial: stm32: fix FIFO flush in startup and set_termios
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 315e2d8a125ad77a1bc28f621162713f3e7aef48 ]
+
+Fifo flush set USART_RQR register by calling stm32_usart_set_bits
+routine (Read/Modify/Write). USART_RQR register is a write only
+register. So, read before write isn't correct / relevant to flush
+the FIFOs.
+Replace stm32_usart_set_bits call by writel_relaxed.
+
+Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-11-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 2bdd04a47f91..183c76ddb165 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -657,7 +657,7 @@ static int stm32_usart_startup(struct uart_port *port)
+
+ /* RX FIFO Flush */
+ if (ofs->rqr != UNDEF_REG)
+- stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ);
++ writel_relaxed(USART_RQR_RXFRQ, port->membase + ofs->rqr);
+
+ /* RX enabling */
+ val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
+@@ -762,8 +762,8 @@ static void stm32_usart_set_termios(struct uart_port *port,
+
+ /* flush RX & TX FIFO */
+ if (ofs->rqr != UNDEF_REG)
+- stm32_usart_set_bits(port, ofs->rqr,
+- USART_RQR_TXFRQ | USART_RQR_RXFRQ);
++ writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ,
++ port->membase + ofs->rqr);
+
+ cr1 = USART_CR1_TE | USART_CR1_RE;
+ if (stm32_port->fifoen)
+--
+2.30.2
+
--- /dev/null
+From 18d4eb791e9e461dcbdedd066d19e02618c906ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:22:58 +0100
+Subject: serial: stm32: fix incorrect characters on console
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ]
+
+Incorrect characters are observed on console during boot. This issue occurs
+when init/main.c is modifying termios settings to open /dev/console on the
+rootfs.
+
+This patch adds a waiting loop in set_termios to wait for TX shift register
+empty (and TX FIFO if any) before stopping serial port.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index c6ca8f964c69..eae54b8cf5e2 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -738,8 +738,9 @@ static void stm32_usart_set_termios(struct uart_port *port,
+ unsigned int baud, bits;
+ u32 usartdiv, mantissa, fraction, oversampling;
+ tcflag_t cflag = termios->c_cflag;
+- u32 cr1, cr2, cr3;
++ u32 cr1, cr2, cr3, isr;
+ unsigned long flags;
++ int ret;
+
+ if (!stm32_port->hw_flow_control)
+ cflag &= ~CRTSCTS;
+@@ -748,6 +749,15 @@ static void stm32_usart_set_termios(struct uart_port *port,
+
+ spin_lock_irqsave(&port->lock, flags);
+
++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
++ isr,
++ (isr & USART_SR_TC),
++ 10, 100000);
++
++ /* Send the TC error message only when ISR_TC is not set. */
++ if (ret)
++ dev_err(port->dev, "Transmission is not complete\n");
++
+ /* Stop serial port and reset value */
+ writel_relaxed(0, port->membase + ofs->cr1);
+
+--
+2.30.2
+
--- /dev/null
+From dbd652908e83a3df1f749590f3ba7bcaab867d1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:22:56 +0100
+Subject: serial: stm32: fix probe and remove order for dma
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 87fd0741d6dcf63ebdb14050c2b921ae14c7f307 ]
+
+The probe and remove orders are wrong as the uart_port is registered
+before saving device data in the probe, and unregistered after DMA
+resource deallocation in the remove. uart_port registering should be
+done at the end of probe and unregistering should be done at the begin of
+remove to avoid resource allocation issues.
+
+Fix probe and remove orders. This enforce resource allocation occur at
+proper time.
+Terminate both DMA rx and tx transfers before removing device.
+
+Move pm_runtime after uart_remove_one_port() call in remove() to keep the
+probe error path.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-2-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 57 ++++++++++++++++++++++++--------
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index b3675cf25a69..3d58824ac2af 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -1252,10 +1252,6 @@ static int stm32_usart_serial_probe(struct platform_device *pdev)
+ device_set_wakeup_enable(&pdev->dev, false);
+ }
+
+- ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
+- if (ret)
+- goto err_wirq;
+-
+ ret = stm32_usart_of_dma_rx_probe(stm32port, pdev);
+ if (ret)
+ dev_info(&pdev->dev, "interrupt mode used for rx (no dma)\n");
+@@ -1269,11 +1265,40 @@ static int stm32_usart_serial_probe(struct platform_device *pdev)
+ pm_runtime_get_noresume(&pdev->dev);
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
++
++ ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
++ if (ret)
++ goto err_port;
++
+ pm_runtime_put_sync(&pdev->dev);
+
+ return 0;
+
+-err_wirq:
++err_port:
++ pm_runtime_disable(&pdev->dev);
++ pm_runtime_set_suspended(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
++
++ if (stm32port->rx_ch) {
++ dmaengine_terminate_async(stm32port->rx_ch);
++ dma_release_channel(stm32port->rx_ch);
++ }
++
++ if (stm32port->rx_dma_buf)
++ dma_free_coherent(&pdev->dev,
++ RX_BUF_L, stm32port->rx_buf,
++ stm32port->rx_dma_buf);
++
++ if (stm32port->tx_ch) {
++ dmaengine_terminate_async(stm32port->tx_ch);
++ dma_release_channel(stm32port->tx_ch);
++ }
++
++ if (stm32port->tx_dma_buf)
++ dma_free_coherent(&pdev->dev,
++ TX_BUF_L, stm32port->tx_buf,
++ stm32port->tx_dma_buf);
++
+ if (stm32port->wakeirq > 0)
+ dev_pm_clear_wake_irq(&pdev->dev);
+
+@@ -1295,11 +1320,20 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
+ int err;
+
+ pm_runtime_get_sync(&pdev->dev);
++ err = uart_remove_one_port(&stm32_usart_driver, port);
++ if (err)
++ return(err);
++
++ pm_runtime_disable(&pdev->dev);
++ pm_runtime_set_suspended(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
+
+ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAR);
+
+- if (stm32_port->rx_ch)
++ if (stm32_port->rx_ch) {
++ dmaengine_terminate_async(stm32_port->rx_ch);
+ dma_release_channel(stm32_port->rx_ch);
++ }
+
+ if (stm32_port->rx_dma_buf)
+ dma_free_coherent(&pdev->dev,
+@@ -1308,8 +1342,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
+
+ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+
+- if (stm32_port->tx_ch)
++ if (stm32_port->tx_ch) {
++ dmaengine_terminate_async(stm32_port->tx_ch);
+ dma_release_channel(stm32_port->tx_ch);
++ }
+
+ if (stm32_port->tx_dma_buf)
+ dma_free_coherent(&pdev->dev,
+@@ -1323,12 +1359,7 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
+
+ stm32_usart_deinit_port(stm32_port);
+
+- err = uart_remove_one_port(&stm32_usart_driver, port);
+-
+- pm_runtime_disable(&pdev->dev);
+- pm_runtime_put_noidle(&pdev->dev);
+-
+- return err;
++ return 0;
+ }
+
+ #ifdef CONFIG_SERIAL_STM32_CONSOLE
+--
+2.30.2
+
--- /dev/null
+From d492dc484251877b60bbf48cfcb8a5eef2f1b0ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:22:57 +0100
+Subject: serial: stm32: fix startup by enabling usart for reception
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit f4518a8a75f5be1a121b0c95ad9c6b1eb27d920e ]
+
+RX is configured, but usart is not enabled in startup function.
+Kernel documentation specifies that startup should enable the port for
+reception.
+Fix the startup by enabling usart for reception.
+
+Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-3-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 3d58824ac2af..c6ca8f964c69 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -634,6 +634,7 @@ static int stm32_usart_startup(struct uart_port *port)
+ {
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ const char *name = to_platform_device(port->dev)->name;
+ u32 val;
+ int ret;
+@@ -658,7 +659,7 @@ static int stm32_usart_startup(struct uart_port *port)
+ }
+
+ /* RX FIFO enabling */
+- val = stm32_port->cr1_irq | USART_CR1_RE;
++ val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
+ if (stm32_port->fifoen)
+ val |= USART_CR1_FIFOEN;
+ stm32_usart_set_bits(port, ofs->cr1, val);
+--
+2.30.2
+
--- /dev/null
+From f8754a3e78e023f5025fbbe30a3e03bb0e4be381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:22:59 +0100
+Subject: serial: stm32: fix TX and RX FIFO thresholds
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 25a8e7611da5513b388165661b17173c26e12c04 ]
+
+TX and RX FIFO thresholds may be cleared after suspend/resume, depending
+on the low power mode.
+
+Those configurations (done in startup) are not effective for UART console,
+as:
+- the reference manual indicates that FIFOEN bit can only be written when
+ the USART is disabled (UE=0)
+- a set_termios (where UE is set) is requested firstly for console
+ enabling, before the startup.
+
+Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-5-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index eae54b8cf5e2..223cec70c57c 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -649,19 +649,8 @@ static int stm32_usart_startup(struct uart_port *port)
+ if (ofs->rqr != UNDEF_REG)
+ stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ);
+
+- /* Tx and RX FIFO configuration */
+- if (stm32_port->fifoen) {
+- val = readl_relaxed(port->membase + ofs->cr3);
+- val &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK);
+- val |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT;
+- val |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT;
+- writel_relaxed(val, port->membase + ofs->cr3);
+- }
+-
+- /* RX FIFO enabling */
++ /* RX enabling */
+ val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit);
+- if (stm32_port->fifoen)
+- val |= USART_CR1_FIFOEN;
+ stm32_usart_set_bits(port, ofs->cr1, val);
+
+ return 0;
+@@ -770,9 +759,15 @@ static void stm32_usart_set_termios(struct uart_port *port,
+ if (stm32_port->fifoen)
+ cr1 |= USART_CR1_FIFOEN;
+ cr2 = 0;
++
++ /* Tx and RX FIFO configuration */
+ cr3 = readl_relaxed(port->membase + ofs->cr3);
+- cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTCFG_MASK | USART_CR3_RXFTIE
+- | USART_CR3_TXFTCFG_MASK;
++ cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTIE;
++ if (stm32_port->fifoen) {
++ cr3 &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK);
++ cr3 |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT;
++ cr3 |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT;
++ }
+
+ if (cflag & CSTOPB)
+ cr2 |= USART_CR2_STOP_2B;
+--
+2.30.2
+
--- /dev/null
+From 8ed37b51b0e94dc9cf947de9c3fd12349916643e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:03 +0100
+Subject: serial: stm32: fix tx dma completion, release channel
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit fb4f2e04ac13e7c400e6b86afbbd314a5a2a7e8d ]
+
+This patch add a proper release of dma channels when completing dma tx.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-9-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index a381ee52168a..74046ae3a412 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -292,6 +292,7 @@ static void stm32_usart_tx_dma_complete(void *arg)
+ struct stm32_port *stm32port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
+
++ dmaengine_terminate_async(stm32port->tx_ch);
+ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+ stm32port->tx_dma_busy = false;
+
+--
+2.30.2
+
--- /dev/null
+From 4de2783e0133250c70cf691485bad2d0410acdb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:07 +0100
+Subject: serial: stm32: fix tx_empty condition
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ]
+
+In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of
+TXE) to check transmission data register has been transmitted independently
+of the FIFO mode. TC indicates that both transmit register and shift
+register are empty. When shift register is empty, tx_empty should return
+TIOCSER_TEMT instead of TC value.
+
+Cleans the USART_CR_TC TCCF register define (transmission complete clear
+flag) as it is duplicate of USART_ICR_TCCF.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 5 ++++-
+ drivers/tty/serial/stm32-usart.h | 3 ---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index d205fce1950a..99dfa884cbef 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -515,7 +515,10 @@ static unsigned int stm32_usart_tx_empty(struct uart_port *port)
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+
+- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE;
++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC)
++ return TIOCSER_TEMT;
++
++ return 0;
+ }
+
+ static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl)
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index cb4f327c46db..94b568aa46bb 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -127,9 +127,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX BIT(16)
+
+-/* USART_ICR (F7) */
+-#define USART_CR_TC BIT(6)
+-
+ /* USART_DR */
+ #define USART_DR_MASK GENMASK(8, 0)
+
+--
+2.30.2
+
--- /dev/null
+From 8b74dff73831e56066d6836870033ab62b60346a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:01 +0100
+Subject: serial: stm32: fix wake-up flag handling
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 12761869f0efa524348e2ae31827fd52eebf3f0d ]
+
+This patch fixes several issue with wake-up handling:
+- the WUF irq is handled several times at wake-up
+- the USART is disabled / enabled at suspend to set wake-up flag.
+It can cause glitches during RX.
+
+This patch fix those issues:
+- clear wake-up flag and disable wake-up irq in WUF irq handling
+- enable wake-up from low power on start bit detection at port
+configuration
+- Unmask the wake-up flag irq at suspend and mask it at resume
+
+In addition, pm_wakeup_event handling is moved from receice_chars to WUF
+irq handling.
+
+Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-7-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++++++-------------
+ 1 file changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 370141445780..326f300dd410 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -218,9 +218,6 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
+ u32 sr;
+ char flag;
+
+- if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
+- pm_wakeup_event(tport->tty->dev, 0);
+-
+ if (threaded)
+ spin_lock_irqsave(&port->lock, flags);
+ else
+@@ -463,6 +460,7 @@ static void stm32_usart_transmit_chars(struct uart_port *port)
+ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
+ {
+ struct uart_port *port = ptr;
++ struct tty_port *tport = &port->state->port;
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ u32 sr;
+@@ -473,9 +471,14 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr)
+ writel_relaxed(USART_ICR_RTOCF,
+ port->membase + ofs->icr);
+
+- if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG)
++ if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) {
++ /* Clear wake up flag and disable wake up interrupt */
+ writel_relaxed(USART_ICR_WUCF,
+ port->membase + ofs->icr);
++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE);
++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++ pm_wakeup_event(tport->tty->dev, 0);
++ }
+
+ if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch))
+ stm32_usart_receive_chars(port, false);
+@@ -901,6 +904,12 @@ static void stm32_usart_set_termios(struct uart_port *port,
+ cr1 &= ~(USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK);
+ }
+
++ /* Configure wake up from low power on start bit detection */
++ if (stm32_port->wakeirq > 0) {
++ cr3 &= ~USART_CR3_WUS_MASK;
++ cr3 |= USART_CR3_WUS_START_BIT;
++ }
++
+ writel_relaxed(cr3, port->membase + ofs->cr3);
+ writel_relaxed(cr2, port->membase + ofs->cr2);
+ writel_relaxed(cr1, port->membase + ofs->cr1);
+@@ -1476,23 +1485,20 @@ static void __maybe_unused stm32_usart_serial_en_wakeup(struct uart_port *port,
+ {
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- const struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+- u32 val;
+
+ if (stm32_port->wakeirq <= 0)
+ return;
+
++ /*
++ * Enable low-power wake-up and wake-up irq if argument is set to
++ * "enable", disable low-power wake-up and wake-up irq otherwise
++ */
+ if (enable) {
+- stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+ stm32_usart_set_bits(port, ofs->cr1, USART_CR1_UESM);
+- val = readl_relaxed(port->membase + ofs->cr3);
+- val &= ~USART_CR3_WUS_MASK;
+- /* Enable Wake up interrupt from low power on start bit */
+- val |= USART_CR3_WUS_START_BIT | USART_CR3_WUFIE;
+- writel_relaxed(val, port->membase + ofs->cr3);
+- stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_WUFIE);
+ } else {
+ stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_UESM);
++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE);
+ }
+ }
+
+--
+2.30.2
+
revert-drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch
usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch
revert-tools-power-turbostat-adjust-for-temperature-offset.patch
+firmware-xilinx-fix-dereferencing-freed-memory.patch
+firmware-xilinx-remove-zynqmp_pm_get_eemi_ops-in-is_.patch
+x86-vdso-use-proper-modifier-for-len-s-format-specif.patch
+fpga-fpga-mgr-xilinx-spi-fix-error-messages-on-eprob.patch
+crypto-keembay-ocs-hcu-fix-error-return-code-in-kmb_.patch
+crypto-keembay-ocs-aes-fix-error-return-code-in-kmb_.patch
+crypto-sun8i-ss-fix-result-memory-leak-on-error-path.patch
+memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch
+arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch
+arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-1008
+arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-6779
+arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-524
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-12663
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18130
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-9292
+arm-dts-s5pv210-correct-fuel-gauge-interrupt-trigger.patch
+arm-dts-renesas-add-mmc-aliases-into-r-car-gen2-boar.patch
+arm64-dts-renesas-add-mmc-aliases-into-board-dts-fil.patch
+bus-ti-sysc-fix-initializing-module_pa-for-modules-w.patch
+x86-platform-uv-set-section-block-size-for-hubless-a.patch
+serial-stm32-fix-probe-and-remove-order-for-dma.patch
+serial-stm32-fix-startup-by-enabling-usart-for-recep.patch
+serial-stm32-fix-incorrect-characters-on-console.patch
+serial-stm32-fix-tx-and-rx-fifo-thresholds.patch
+serial-stm32-fix-a-deadlock-condition-with-wakeup-ev.patch
+serial-stm32-fix-wake-up-flag-handling.patch
+serial-stm32-fix-a-deadlock-in-set_termios.patch
+serial-liteuart-fix-return-value-check-in-liteuart_p.patch
+serial-stm32-fix-tx-dma-completion-release-channel.patch
+serial-stm32-call-stm32_transmit_chars-locked.patch
+serial-stm32-fix-fifo-flush-in-startup-and-set_termi.patch
+serial-stm32-add-fifo-flush-when-port-is-closed.patch
+serial-stm32-fix-tx_empty-condition.patch
+usb-typec-tcpm-wait-for-vbus-discharge-to-vsafe0v-be.patch
+usb-typec-tcpci-check-role_control-while-interpretin.patch
+usb-typec-tps6598x-fix-return-value-check-in-tps6598.patch
+usb-typec-stusb160x-fix-return-value-check-in-stusb1.patch
+mfd-intel_pmt-fix-nuisance-messages-and-handling-of-.patch
+regmap-set-debugfs_name-to-null-after-it-is-freed.patch
+spi-rockchip-avoid-objtool-warning.patch
+arm64-dts-broadcom-bcm4908-fix-switch-parent-node-na.patch
+mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch
+mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch
+mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch
+mtd-rawnand-qcom-return-actual-error-code-instead-of.patch
+mtd-don-t-lock-when-recursively-deleting-partitions.patch
+mtd-parsers-qcom-fix-error-condition.patch
+mtd-parsers-qcom-incompatible-with-spi-nor-4k-sector.patch
+mtd-maps-fix-error-return-code-of-physmap_flash_remo.patch
+arm-dts-stm32-fix-usart-2-3-pinconf-to-wake-up-with-.patch
+arm64-dts-ti-k3-j721e-main-update-the-speed-modes-su.patch
+iio-adis16480-fix-pps-mode-sampling-frequency-math.patch
+arm64-dts-qcom-sc7180-trogdor-fix-trip-point-config-.patch
+arm64-dts-qcom-sm8250-fix-level-triggered-pmu-interr.patch
+arm64-dts-qcom-sm8350-fix-level-triggered-pmu-interr.patch
+arm64-dts-qcom-sm8250-fix-timer-interrupt-to-specify.patch
+arm64-dts-qcom-sc7180-avoid-glitching-spi-cs-at-boot.patch
+arm64-dts-qcom-sdm845-fix-number-of-pins-in-gpio-ran.patch
+arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch
+arm64-dts-qcom-sm8250-fix-number-of-pins-in-gpio-ran.patch
+arm64-dts-qcom-sm8350-fix-number-of-pins-in-gpio-ran.patch
+arm64-dts-qcom-db845c-fix-correct-powerdown-pin-for-.patch
+crypto-sun8i-ss-fix-memory-leak-of-object-d-when-dma.patch
+spi-stm32-drop-devres-version-of-spi_register_master.patch
+arm64-dts-broadcom-bcm4908-set-asus-gt-ac5300-port-7.patch
+regulator-bd9576-fix-return-from-bd957x_probe.patch
+arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch
+selftests-x86-add-a-missing-.note.gnu-stack-section-.patch
+crypto-arm-blake2s-fix-for-big-endian.patch
+spi-stm32-fix-use-after-free-on-unbind.patch
+drivers-hv-vmbus-drop-error-message-when-no-request-.patch
+staging-qlge-fix-an-error-code-in-probe.patch
+x86-microcode-check-for-offline-cpus-before-requesti.patch
+usb-host-ehci-tegra-select-usb_gadget-kconfig-option.patch
+devtmpfs-fix-placement-of-complete-call.patch
+usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch
+usb-gadget-pch_udc-check-if-driver-is-present-before.patch
+usb-gadget-pch_udc-check-for-dma-mapping-error.patch
+usb-gadget-pch_udc-initialize-device-pointer-before-.patch
+usb-gadget-pch_udc-provide-a-gpio-line-used-on-intel.patch
+crypto-ccp-fix-command-queuing-to-tee-ring-buffer.patch
+crypto-qat-don-t-release-uninitialized-resources.patch
+crypto-qat-adf_status_pf_running-should-be-set-after.patch
+fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch
+fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch
+fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch
+fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch
+fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch
+fotg210-udc-complete-out-requests-on-short-packets.patch
+usb-gadget-s3c-fix-incorrect-resources-releasing.patch
+usb-gadget-s3c-fix-the-error-handling-path-in-s3c241.patch
+dt-bindings-serial-stm32-use-type-object-instead-of-.patch
+mtd-require-write-permissions-for-locking-and-badblo.patch
+arm64-dts-renesas-r8a779a0-fix-pmu-interrupt.patch
+arm64-dts-mt8183-add-gce-client-reg-for-display-subc.patch
+arm64-dts-mt8173-fix-wrong-power-domain-phandle-of-p.patch
+bus-qcom-put-child-node-before-return.patch
+arm64-dts-qcom-sm8250-fix-display-nodes.patch
+soundwire-bus-fix-device-found-flag-correctly.patch
+soc-mediatek-pm-domains-fix-missing-error-code-in-sc.patch
+phy-ti-j721e-wiz-delete-clk_div_sel-clk-provider-dur.patch
+phy-ralink-phy-mt7621-pci-fix-xtal-bitmask.patch
+phy-marvell-armada375_usbcluster_phy-should-not-defa.patch
+phy-ralink-phy-mt7621-pci-fix-return-value-check-in-.patch
+phy-ingenic-fix-a-typo-in-ingenic_usb_phy_probe.patch
+arm64-dts-mediatek-fix-reset-gpio-level-on-pumpkin.patch
+nfsv4.2-fix-copy-stateid-copying-for-the-async-copy.patch
+crypto-poly1305-fix-poly1305_core_setkey-declaration.patch
+crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch
+usb-gadget-aspeed-fix-dma-map-failure.patch
+usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch
+drivers-nvmem-fix-voltage-settings-for-qti-qfprom-ef.patch
+nvmem-rmem-fix-undefined-reference-to-memremap.patch
+driver-core-platform-declare-early_platform_cleanup-.patch
+arm-dts-qcom-msm8974-lge-nexus5-correct-fuel-gauge-i.patch
+arm-dts-qcom-msm8974-samsung-klte-correct-fuel-gauge.patch
+memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch
+soundwire-stream-fix-memory-leak-in-stream-config-er.patch
+m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch
+firmware-qcom_scm-make-__qcom_scm_is_call_available-.patch
+firmware-qcom_scm-reduce-locking-section-for-__get_c.patch
+firmware-qcom_scm-workaround-lack-of-is-available-ca.patch
+iio-adc-kconfig-make-ad9467-depend-on-adi_axi_adc-sy.patch
+mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch
+irqchip-gic-v3-fix-of_bad_addr-error-handling.patch
+staging-comedi-tests-ni_routes_test-fix-compilation-.patch
+staging-rtl8192u-fix-potential-infinite-loop.patch
+staging-fwserial-fix-tiocsserial-implementation.patch
+staging-fwserial-fix-tiocgserial-implementation.patch
+staging-greybus-uart-fix-unprivileged-tioccserial.patch
+platform-x86-dell-wmi-sysman-make-init_bios_attribut.patch
+soc-qcom-pdr-fix-error-return-code-in-pdr_register_l.patch
+pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch
+clocksource-drivers-timer-ti-dm-fix-posted-mode-stat.patch
+clocksource-drivers-timer-ti-dm-add-missing-set_stat.patch
+clocksource-drivers-ingenic_ost-fix-return-value-che.patch
+spi-fix-use-after-free-with-devm_spi_alloc_.patch
+spi-fsl-add-missing-iounmap-on-error-in-of_fsl_spi_p.patch
+soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch
+soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch
+pm-runtime-replace-inline-function-pm_runtime_callba.patch
+cpuidle-fix-arm_qcom_spm_cpuidle-configuration.patch
+acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch
+crypto-allwinner-add-missing-crypto_-prefix.patch
+crypto-sun8i-ss-fix-memory-leak-of-pad.patch
+crypto-sa2ul-fix-memory-leak-of-rxd.patch
+crypto-qat-fix-a-double-free-in-adf_create_ring.patch
+cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch
+clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch
+cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch
+clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch
+clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch
+cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch
+cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch
+spi-spi-zynqmp-gqspi-use-wait_for_completion_timeout.patch
+spi-spi-zynqmp-gqspi-add-mutex-locking-for-exec_op.patch
+spi-spi-zynqmp-gqspi-transmit-dummy-circles-by-using.patch
+spi-spi-zynqmp-gqspi-fix-incorrect-operating-mode-in.patch
+spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch
+usb-gadget-r8a66597-add-missing-null-check-on-return.patch
+usb-cdc-acm-fix-unprivileged-tioccserial.patch
+usb-cdc-acm-fix-tiocgserial-implementation.patch
+tty-actually-undefine-superseded-async-flags.patch
+tty-fix-return-value-for-unsupported-ioctls.patch
+tty-fix-return-value-for-unsupported-termiox-ioctls.patch
+serial-core-return-early-on-unsupported-ioctls.patch
+firmware-qcom-scm-fix-qcom_scm-configuration.patch
+node-fix-device-cleanups-in-error-handling-code.patch
+crypto-chelsio-read-rxchannel-id-from-firmware.patch
+usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch
+m68k-add-missing-mmap_read_lock-to-sys_cacheflush.patch
+usb-cdnsp-fixes-issue-with-configure-endpoint-comman.patch
+spi-spi-zynqmp-gqspi-fix-missing-unlock-on-error-in-.patch
+memory-renesas-rpc-if-fix-possible-null-pointer-dere.patch
+memory-samsung-exynos5422-dmc-handle-clk_set_parent-.patch
+security-keys-trusted-fix-tpm2-authorizations.patch
+char-tpm-fix-error-return-code-in-tpm_cr50_i2c_tis_r.patch
+platform-x86-pmc_atom-match-all-beckhoff-automation-.patch
+usb-typec-tcpm-honour-psnkstdby-requirement-during-n.patch
+spi-spi-zynqmp-gqspi-fix-runtime-pm-imbalance-in-zyn.patch
+arm-dts-aspeed-rainier-fix-humidity-sensor-bus-addre.patch
+drivers-hv-vmbus-use-after-free-in-__vmbus_open.patch
+crypto-arm64-aes-ce-deal-with-oversight-in-new-ctr-c.patch
+spi-spi-zynqmp-gqspi-fix-clk_enable-disable-imbalanc.patch
+spi-spi-zynqmp-gqspi-fix-hang-issue-when-suspend-res.patch
+spi-spi-zynqmp-gqspi-fix-use-after-free-in-zynqmp_qs.patch
+spi-spi-zynqmp-gqspi-return-enomem-if-dma_map_single.patch
+btrfs-zoned-move-log-tree-node-allocation-out-of-log.patch
+btrfs-zoned-bail-out-in-btrfs_alloc_chunk-for-bad-in.patch
+x86-platform-uv-fix-kexec-build-failure.patch
+hwmon-pmbus-pxe1610-don-t-bail-out-when-not-all-page.patch
+platform-surface-aggregator-fix-a-bit-test.patch
+drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch
+pm-hibernate-x86-use-crc32-instead-of-md5-for-hibern.patch
+usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch
+usb-dwc2-fix-hibernation-between-host-and-device-mod.patch
+ttyprintk-add-tty-hangup-callback.patch
+serial-omap-don-t-disable-rs485-if-rts-gpio-is-missi.patch
+serial-omap-fix-rs485-half-duplex-filtering.patch
+spi-tools-make-a-symbolic-link-to-the-header-file-sp.patch
+xen-blkback-fix-compatibility-bug-with-single-page-r.patch
+soc-aspeed-fix-a-ternary-sign-expansion-bug.patch
+drm-tilcdc-send-vblank-event-when-disabling-crtc.patch
+drm-stm-fix-bus_flags-handling.patch
+drm-amd-display-fix-off-by-one-in-hdmi_14_process_tr.patch
+drm-mcde-panel-inverse-misunderstood-flag.patch
+scsi-lpfc-fix-null-pointer-dereference-in-lpfc_prep_.patch
+sched-fair-fix-shift-out-of-bounds-in-load_balance.patch
+printk-limit-second-loop-of-syslog_print_all.patch
+afs-fix-updating-of-i_mode-due-to-3rd-party-change.patch
+rcu-remove-spurious-instrumentation_end-in-rcu_nmi_e.patch
+media-mtk-fix-mtk-smi-dependency.patch
+media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch
+media-saa7134-use-sg_dma_len-when-building-pgtable.patch
+media-saa7146-use-sg_dma_len-when-building-pgtable.patch
+media-omap4iss-return-error-code-when-omap4iss_get-f.patch
+media-rkisp1-rsz-crash-fix-when-setting-src-format.patch
+media-aspeed-fix-clock-handling-logic.patch
+drm-panel-simple-undo-enable-if-hpd-never-asserts.patch
+power-supply-bq27xxx-fix-sign-of-current_now-for-new.patch
+drm-probe-helper-check-epoch-counter-in-output_poll_.patch
+media-venus-core-fix-some-resource-leaks-in-the-erro.patch
+media-platform-sunxi-sun6i-csi-fix-error-return-code.patch
+media-m88ds3103-fix-return-value-check-in-m88ds3103_.patch
+media-docs-fix-data-organization-of-media_bus_fmt_rg.patch
+media-next-staging-media-atomisp-fix-memory-leak-of-.patch
+media-atomisp-fixed-error-handling-path.patch
+media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch
+media-atomisp-fix-use-after-free-in-atomisp_alloc_cs.patch
+x86-kprobes-retrieve-correct-opcode-for-group-instru.patch
+drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch
+drm-amdkfd-fix-recursive-lock-warnings.patch
+drm-amd-display-free-local-data-after-use.patch
+of-overlay-fix-for_each_child.cocci-warnings.patch
+scsi-qla2xxx-check-kzalloc-return-value.patch
+x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch
+drm-omap-dsi-add-missing-irqf_oneshot.patch
+selftests-fix-prepending-output-to-test_progs.patch
+pata_arasan_cf-fix-irq-check.patch
+pata_ipx4xx_cf-fix-irq-check.patch
+sata_mv-add-irq-checks.patch
+ata-libahci_platform-fix-irq-check.patch
+seccomp-fix-config-tests-for-seccomp_filters.patch
+drm-mediatek-switch-the-hdmi-bridge-ops-to-the-atomi.patch
+drm-mediatek-don-t-support-hdmi-connector-creation.patch
+nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch
+nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch
+clk-imx-fix-reparenting-of-uarts-not-associated-with.patch
+power-supply-bq25980-move-props-from-battery-node.patch
+nvme-retrigger-ana-log-update-if-group-descriptor-is.patch
+media-ccs-fix-sub-device-function.patch
+media-ipu3-cio2-fix-pixel-rate-derived-link-frequenc.patch
+media-i2c-imx219-move-out-locking-unlocking-of-vflip.patch
+media-i2c-imx219-balance-runtime-pm-use-count.patch
+media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch
+media-rkvdec-do-not-require-all-controls-to-be-prese.patch
+vfio-fsl-mc-re-order-vfio_fsl_mc_probe.patch
+vfio-pci-move-vga-and-vf-initialization-to-functions.patch
+vfio-pci-re-order-vfio_pci_probe.patch
+drm-msm-fix-debugfs-deadlock.patch
+drm-msm-dpu-enable-dpu_sspp_qos_8lvl-for-sm8250.patch
+vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch
+clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch
+clk-zynqmp-pll-add-set_pll_mode-to-check-condition-i.patch
+drm-xlnx-zynqmp-fix-a-memset-in-zynqmp_dp_train.patch
+media-i2c-rdamc21-fix-warning-on-u8-cast.patch
+clk-qcom-a7-pll-add-missing-module_device_table.patch
+clk-qcom-a53-pll-add-missing-module_device_table.patch
+clk-qcom-apss-ipq-pll-add-missing-module_device_tabl.patch
+drm-amd-display-use-gfp_atomic-in-dcn20_resource_con.patch
+drm-amd-display-check-fb-of-primary-plane.patch
+drm-radeon-fix-a-missing-check-bug-in-radeon_dp_mst_.patch
+bcache-use-64-bit-arithmetic-instead-of-32-bit.patch
+clk-uniphier-fix-potential-infinite-loop.patch
+scsi-pm80xx-increase-timeout-for-pm80xx-mpi_uninit_c.patch
+scsi-pm80xx-fix-potential-infinite-loop.patch
+scsi-ufs-ufshcd-pltfrm-fix-deferred-probing.patch
+scsi-hisi_sas-fix-irq-checks.patch
+scsi-jazz_esp-add-irq-check.patch
+scsi-sun3x_esp-add-irq-check.patch
+scsi-sni_53c710-add-irq-check.patch
+scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch
+mailbox-sprd-introduce-refcnt-when-clients-requests-.patch
+mfd-stm32-timers-avoid-clearing-auto-reload-register.patch
+nvmet-tcp-fix-a-segmentation-fault-during-io-parsing.patch
+nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch
+media-meson-ge2d-fix-rotation-parameters.patch
+media-cedrus-fix-h265-status-definitions.patch
+hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch
+x86-events-amd-iommu-fix-sysfs-type-mismatch.patch
+perf-amd-uncore-fix-sysfs-type-mismatch.patch
+io_uring-fix-overflows-checks-in-provide-buffers.patch
+block-rnbd-clt-sysfs-remove-copy-buffer-overlap-in-r.patch
+sched-debug-fix-cgroup_path-serialization.patch
+kthread-fix-pf_kthread-vs-to_kthread-race.patch
+ataflop-potential-out-of-bounds-in-do_format.patch
+ataflop-fix-off-by-one-in-ataflop_probe.patch
+drivers-block-null_blk-main-fix-a-double-free-in-nul.patch
+xsk-respect-device-s-headroom-and-tailroom-on-generi.patch
+hid-plantronics-workaround-for-double-volume-key-pre.patch
+perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch
+asoc-intel-boards-sof-wm8804-add-check-for-pll-setti.patch
+asoc-intel-skylake-compile-when-any-configuration-is.patch
+rdma-mlx5-zero-out-odp-related-items-in-the-mlx5_ib_.patch
+rdma-mlx5-fix-query-roce-port.patch
+rdma-mlx5-fix-mlx5-rates-to-ib-rates-map.patch
+net-mlx5-dr-add-missing-vhca_id-consume-from-stev1.patch
+wilc1000-write-value-to-wilc_intr2_enable-register.patch
+kvm-x86-mmu-retry-page-faults-that-hit-an-invalid-me.patch
+bluetooth-avoid-deadlock-between-hci_dev-lock-and-so.patch
+net-lapbether-prevent-racing-when-checking-whether-t.patch
+libbpf-add-explicit-padding-to-bpf_xdp_set_link_opts.patch
+bpftool-fix-maybe-uninitialized-warnings.patch
+iommu-check-dev-iommu-in-iommu_dev_xxx-functions.patch
+iommu-dma-resurrect-the-forcedac-option.patch
+iommu-vt-d-reject-unsupported-page-request-modes.patch
+asoc-tegra30-i2s-restore-hardware-state-on-runtime-p.patch
+net-dsa-bcm_sf2-add-function-finding-rgmii-register.patch
+net-dsa-bcm_sf2-fix-bcm4908-rgmii-reg-s.patch
+selftests-bpf-re-generate-vmlinux.h-and-bpf-skeleton.patch
+libbpf-add-explicit-padding-to-btf_dump_emit_type_de.patch
+powerpc-mm-move-the-linear_mapping_mutex-to-the-ifde.patch
+powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch
+powerpc-prom-mark-identical_pvr_fixup-as-__init.patch
+mips-fix-local_irq_-disable-enable-in-asmmacro.h.patch
+ima-fix-the-error-code-for-restoring-the-pcr-value.patch
+inet-use-bigger-hash-table-for-ip-id-generation.patch
+pinctrl-pinctrl-single-remove-unused-parameter.patch
+pinctrl-pinctrl-single-fix-pcs_pin_dbg_show-when-bit.patch
+mips-loongson64-fix-bug-when-page_size-16kb.patch
+asoc-wm8960-remove-bitclk-relax-condition-in-wm8960_.patch
+iommu-arm-smmu-v3-add-bit-field-sfm-into-gerror_err_.patch
+rdma-mlx5-fix-drop-packet-rule-in-egress-table.patch
+ib-isert-fix-a-use-after-free-in-isert_connect_reque.patch
+powerpc-64s-fix-hash-fault-to-use-trap-accessor.patch
+powerpc-fix-have_hardlockup_detector_arch-build-conf.patch
+mips-bpf-enable-bpf_probe_read-str-on-mips-again.patch
+gpio-guard-gpiochip_irqchip_add_domain-with-gpiolib_.patch
+fs-dlm-fix-missing-unlock-on-error-in-accept_from_so.patch
+asoc-q6afe-clocks-fix-reprobing-of-the-driver.patch
+alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch
+net-phy-lan87xx-fix-access-to-wrong-register-of-lan8.patch
+udp-skip-l4-aggregation-for-udp-tunnel-packets.patch
+udp-never-accept-gso_fraglist-packets.patch
+powerpc-pseries-only-register-vio-drivers-if-vio-bus.patch
+net-tipc-fix-missing-destroy_workqueue-on-error-in-t.patch
+bug-remove-redundant-condition-check-in-report_bug.patch
+rdma-core-fix-corrupted-sl-on-passive-side.patch
+nfc-pn533-prevent-potential-memory-corruption.patch
+net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch
+mips-bmips-fix-syscon-reboot-nodes.patch
+kvm-arm64-fix-error-return-code-in-init_hyp_mode.patch
+iommu-vt-d-don-t-set-then-clear-private-data-in-prq_.patch
+iommu-fix-a-boundary-issue-to-avoid-performance-drop.patch
+iommu-vt-d-report-right-snoop-capability-when-using-.patch
+iommu-vt-d-report-the-right-page-fault-address.patch
+iommu-vt-d-remove-wo-permissions-on-second-level-pag.patch
+iommu-vt-d-invalidate-pasid-cache-when-root-context-.patch
+alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch
+hid-lenovo-use-brightness_set_blocking-callback-for-.patch
+hid-lenovo-fix-lenovo_led_set_tp10ubkbd-error-handli.patch
+hid-lenovo-check-hid_get_drvdata-returns-non-null-in.patch
+hid-lenovo-map-mic-mute-button-to-key_f20-instead-of.patch
+kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch
+asoc-simple-card-fix-possible-uninitialized-single_c.patch
+liquidio-fix-unintented-sign-extension-of-a-left-shi.patch
+ib-hfi1-use-kzalloc-for-mmu_rb_handler-allocation.patch
+powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch
+powerpc-pseries-add-key-to-flags-in-pseries_lpar_hpt.patch
+powerpc-64s-use-htab_convert_pte_flags-in-hash__mark.patch
+powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch
+powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch
+mac80211-bail-out-if-cipher-schemes-are-invalid.patch
+perf-vendor-events-amd-fix-broken-l2-cache-hits-from.patch
+rdma-hns-fix-missing-assignment-of-max_inline_data.patch
+xfs-fix-return-of-uninitialized-value-in-variable-er.patch
+rtw88-fix-an-error-code-in-rtw_debugfs_set_rsvd_page.patch
+mt7601u-fix-always-true-expression.patch
+mt76-mt7615-fix-tx-skb-dma-unmap.patch
+mt76-mt7915-fix-tx-skb-dma-unmap.patch
+mt76-mt7921-fix-suspend-resume-sequence.patch
+mt76-mt7921-fix-memory-leak-in-mt7921_coredump_work.patch
+mt76-connac-fix-up-the-setting-for-ht40-mode-in-mt76.patch
+mt76-mt7921-fixup-rx-bitrate-statistics.patch
+mt76-mt7615-fix-memory-leak-in-mt7615_coredump_work.patch
+mt76-mt7921-fix-aggr-length-histogram.patch
+mt76-mt7915-fix-aggr-len-debugfs-node.patch
+mt76-mt7921-fix-stats-register-definitions.patch
+mt76-mt7615-fix-tsf-configuration.patch
+mt76-mt7615-fix-mib-stats-counter-reporting-to-mac80.patch
+mt76-mt7915-fix-mib-stats-counter-reporting-to-mac80.patch
+mt76-connac-fix-kernel-warning-adding-monitor-interf.patch
+mt76-check-return-value-of-mt76_txq_send_burst-in-mt.patch
+mt76-mt7921-fix-the-base-of-pcie-interrupt.patch
+mt76-mt7921-fix-the-base-of-the-dynamic-remap.patch
+mt76-mt7915-fix-rxrate-reporting.patch
+mt76-mt7915-fix-txrate-reporting.patch
+mt76-mt7663-fix-when-beacon-filter-is-being-applied.patch
+mt76-mt7663s-make-all-of-packets-4-bytes-aligned-in-.patch
+mt76-mt7663s-fix-the-possible-device-hang-in-high-tr.patch
+mt76-mt7615-cleanup-mcu-tx-queue-in-mt7615_dma_reset.patch
+mt76-mt7915-cleanup-mcu-tx-queue-in-mt7915_dma_reset.patch
+mt76-mt7921-always-wake-the-device-in-mt7921_remove_.patch
+mt76-mt7921-fix-inappropriate-wow-setup-with-the-mis.patch
+mt76-mt7921-fix-the-dwell-time-control.patch
+kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch
+ovl-show-userxattr-in-the-mount-data.patch
+ovl-invalidate-readdir-cache-on-changes-to-dir-with-.patch
+rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch
+ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch
+rdma-bnxt_re-fix-error-return-code-in-bnxt_qplib_cq_.patch
+cxgb4-fix-unintentional-sign-extension-issues.patch
+net-thunderx-fix-unintentional-sign-extension-issue.patch
+mt76-mt7921-fix-kernel-crash-when-the-firmware-fails.patch
+rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch
+rdma-rtrs-clt-destroy-sysfs-after-removing-session-f.patch
+pinctrl-at91-pio4-fix-slew-rate-disablement.patch
+i2c-cadence-fix-reference-leak-when-pm_runtime_get_s.patch
+i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch
+i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch
+i2c-imx-fix-reference-leak-when-pm_runtime_get_sync-.patch
+i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch
+i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch
+i2c-stm32f7-fix-reference-leak-when-pm_runtime_get_s.patch
+i2c-xiic-fix-reference-leak-when-pm_runtime_get_sync.patch
+i2c-cadence-add-irq-check.patch
+i2c-emev2-add-irq-check.patch
+i2c-jz4780-add-irq-check.patch
+i2c-mlxbf-add-irq-check.patch
+i2c-rcar-add-irq-check.patch
+i2c-sh7760-add-irq-check.patch
+fuse-fix-matching-of-fuse_dev_ioc_clone-command.patch
+iwlwifi-rs-fw-don-t-support-stbc-for-he-160.patch
+iwlwifi-dbg-disable-ini-debug-in-9000-family-and-bel.patch
+powerpc-xive-drop-check-on-irq_data-in-xive_core_deb.patch
+powerpc-xive-fix-xmon-command-dxi.patch
+powerpc-syscall-switch-user_exit_irqoff-and-trace_ha.patch
+asoc-ak5558-correct-reset-polarity.patch
+net-mlx5-fix-bit-wise-and-with-zero.patch
+net-packet-remove-data-races-in-fanout-operations.patch
+drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch
+iommu-vt-d-fix-an-error-handling-path-in-intel_prepa.patch
+iommu-amd-put-newline-after-closing-bracket-in-warni.patch
+perf-beauty-fix-fsconfig-generator.patch
+drm-amdgpu-fix-an-error-code-in-init_pmu_entry_by_ty.patch
+drm-amd-pm-fix-error-code-in-smu_set_power_limit.patch
+mips-pci-legacy-stop-using-of_pci_range_to_resource.patch
+powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch
+iommu-mediatek-always-enable-the-clk-on-resume.patch
+mptcp-fix-format-specifiers-for-unsigned-int.patch
+powerpc-smp-reintroduce-cpu_core_mask.patch
+kvm-x86-dump_vmcs-should-not-assume-guest_ia32_efer-.patch
+rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch
+wlcore-fix-overlapping-snprintf-arguments-in-debugfs.patch
+i2c-sh7760-fix-irq-error-path.patch
+i2c-mediatek-fix-wrong-dma-sync-flag.patch
+mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch
+netfilter-nft_payload-fix-c-vlan-offload-support.patch
+netfilter-nftables_offload-vlan-id-needs-host-byteor.patch
+netfilter-nftables_offload-special-ethertype-handlin.patch
+vsock-vmci-log-once-the-failed-queue-pair-allocation.patch
+libbpf-initialize-the-bpf_seq_printf-parameters-arra.patch
+net-ethernet-ixp4xx-set-the-dma-masks-explicitly.patch
+gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch
+rdma-cxgb4-add-missing-qpid-increment.patch
+rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch
+alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch
+sfc-ef10-fix-tx-queue-lookup-in-tx-event-handling.patch
+vsock-virtio-free-queued-packets-when-closing-socket.patch
+net-marvell-prestera-fix-port-event-handling-on-init.patch
+net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch
+rtw88-refine-napi-deinit-flow.patch
+mt76-mt7615-fix-memleak-when-mt7615_unregister_devic.patch
+mt76-mt7915-fix-memleak-when-mt7915_unregister_devic.patch
+mt76-mt7921-run-mt7921_mcu_fw_log_2_host-holding-mt7.patch
+powerpc-pseries-iommu-fix-window-size-for-direct-map.patch
+crypto-ccp-detect-and-reject-invalid-addresses-desti.patch
+net-dsa-mv88e6xxx-fix-off-by-one-in-vtu-devlink-regi.patch
+nfp-devlink-initialize-the-devlink-port-attribute-la.patch
+net-stmmac-fix-tso-and-tbs-feature-enabling-during-d.patch
+net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch
+net-phy-intel-xway-enable-integrated-led-functions.patch
+mt76-mt7615-fix-a-dereference-of-pointer-sta-before-.patch
+mt76-mt7921-fix-possible-invalid-register-access.patch
+rdma-rxe-fix-a-bug-in-rxe_fill_ip_info.patch
+rdma-core-add-cm-to-restrack-after-successful-attach.patch
+powerpc-64-fix-the-definition-of-the-fixmap-area.patch
+ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch
+ath10k-fix-a-use-after-free-in-ath10k_htc_send_bundl.patch
+ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch
+wlcore-fix-buffer-overrun-by-snprintf-due-to-incorre.patch
+powerpc-perf-fix-the-threshold-event-selection-for-m.patch
+powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch
+net-phy-marvell-fix-m88e1011_set_downshift.patch
+net-phy-marvell-fix-m88e1111_set_downshift.patch
+net-enetc-fix-link-error-again.patch
+net-xdp-update-pkt_type-if-generic-xdp-changes-unica.patch
+bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch
+arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch
+arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch
+net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch
+selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch
+selftests-mlxsw-remove-a-redundant-if-statement-in-p.patch
+selftests-mlxsw-remove-a-redundant-if-statement-in-t.patch
+mptcp-retransmit-data_fin.patch
+bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch
+kvm-vmx-intercept-fs-gs_base-msr-accesses-for-32-bit.patch
+kvm-svm-zero-out-the-vmcb-array-used-to-track-sev-as.patch
+kvm-svm-free-sev_asid_bitmap-during-init-if-sev-setu.patch
+kvm-svm-disable-sev-sev-es-if-npt-is-disabled.patch
+net-sched-act_ct-fix-wild-memory-access-when-clearin.patch
+net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch
+selftests-bpf-fix-bpf_core_read_bitfield-macro.patch
+selftests-bpf-fix-field-existence-co-re-reloc-tests.patch
+selftests-bpf-fix-core_reloc-test-runner.patch
+bpf-fix-propagation-of-32-bit-unsigned-bounds-from-6.patch
+rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch
+rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch
+net-bridge-mcast-fix-broken-length-header-check-for-.patch
+net-dsa-mv88e6xxx-fix-6095-6097-6185-ports-in-non-se.patch
+net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch
+perf-tools-change-fields-type-in-perf_record_time_co.patch
+perf-jit-let-convert_timestamp-to-be-backwards-compa.patch
+perf-session-add-swap-operation-for-event-time_conv.patch
+ia64-ensure-proper-numa-distance-and-possible-map-in.patch
+ia64-fix-efi_debug-build.patch
+kfifo-fix-ternary-sign-extension-bugs.patch
+mm-slub-enable-slub_debug-static-key-when-creating-c.patch
+mm-memcontrol-slab-fix-obtain-a-reference-to-a-freei.patch
+mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch
+mm-memory-failure-unnecessary-amount-of-unmapping.patch
+afs-fix-speculative-status-fetches.patch
--- /dev/null
+From 3a24df9be3597a84cc80c02c7516663ac03add06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 13:29:35 +0100
+Subject: sfc: ef10: fix TX queue lookup in TX event handling
+
+From: Edward Cree <ecree.xilinx@gmail.com>
+
+[ Upstream commit 172e269edfce34bac7c61c15551816bda4b0f140 ]
+
+We're starting from a TXQ label, not a TXQ type, so
+ efx_channel_get_tx_queue() is inappropriate. This worked by chance,
+ because labels and types currently match on EF10, but we shouldn't
+ rely on that.
+
+Fixes: 12804793b17c ("sfc: decouple TXQ type from label")
+Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index da6886dcac37..4fa72b573c17 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -2928,8 +2928,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)
+
+ /* Get the transmit queue */
+ tx_ev_q_label = EFX_QWORD_FIELD(*event, ESF_DZ_TX_QLABEL);
+- tx_queue = efx_channel_get_tx_queue(channel,
+- tx_ev_q_label % EFX_MAX_TXQ_PER_CHANNEL);
++ tx_queue = channel->tx_queue + (tx_ev_q_label % EFX_MAX_TXQ_PER_CHANNEL);
+
+ if (!tx_queue->timestamping) {
+ /* Transmit completion */
+--
+2.30.2
+
--- /dev/null
+From 8974581f39334aaca57c60f8f2564425be732620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 09:39:19 +0930
+Subject: soc: aspeed: fix a ternary sign expansion bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ffa828534036348fa90fb3079ccc0972d202c4a ]
+
+The intent here was to return negative error codes but it actually
+returns positive values. The problem is that type promotion with
+ternary operations is quite complicated.
+
+"ret" is an int. "copied" is a u32. And the snoop_file_read() function
+returns long. What happens is that "ret" is cast to u32 and becomes
+positive then it's cast to long and it's still positive.
+
+Fix this by removing the ternary so that "ret" is type promoted directly
+to long.
+
+Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Patrick Venture <venture@google.com>
+Link: https://lore.kernel.org/r/YIE90PSXsMTa2Y8n@mwanda
+Link: https://lore.kernel.org/r/20210423000919.1249474-1-joel@jms.id.au'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-lpc-snoop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+index 20acac6342ef..5828f94b8a7d 100644
+--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
++++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+@@ -95,8 +95,10 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer,
+ return -EINTR;
+ }
+ ret = kfifo_to_user(&chan->fifo, buffer, count, &copied);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static __poll_t snoop_file_poll(struct file *file,
+--
+2.30.2
+
--- /dev/null
+From 3e5beed8a51a6622fe4adbd58c39249a4d0626af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 10:10:54 +0100
+Subject: soc: mediatek: pm-domains: Fix missing error code in
+ scpsys_add_subdomain()
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 9950588a45241b0efcfc312ab0e414260ceca709 ]
+
+Adding one power domain in scpsys_add_subdomain is missing to assign an
+error code when it fails. Fix that assigning an error code to 'ret',
+this also fixes the follwowing smatch warning.
+
+ drivers/soc/mediatek/mtk-pm-domains.c:492 scpsys_add_subdomain() warn: missing error code 'ret'
+
+Fixes: dd65030295e2 ("soc: mediatek: pm-domains: Don't print an error if child domain is deferred")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20210303091054.796975-1-enric.balletbo@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-pm-domains.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/mediatek/mtk-pm-domains.c b/drivers/soc/mediatek/mtk-pm-domains.c
+index b7f697666bdd..06aaf03b194c 100644
+--- a/drivers/soc/mediatek/mtk-pm-domains.c
++++ b/drivers/soc/mediatek/mtk-pm-domains.c
+@@ -487,8 +487,9 @@ static int scpsys_add_subdomain(struct scpsys *scpsys, struct device_node *paren
+
+ child_pd = scpsys_add_one_domain(scpsys, child);
+ if (IS_ERR(child_pd)) {
+- dev_err_probe(scpsys->dev, PTR_ERR(child_pd),
+- "%pOF: failed to get child domain id\n", child);
++ ret = PTR_ERR(child_pd);
++ dev_err_probe(scpsys->dev, ret, "%pOF: failed to get child domain id\n",
++ child);
+ goto err_put_node;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 099419652e5830c3dd9251553d715a008a3cd46e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 15:25:26 -0800
+Subject: soc: qcom: mdt_loader: Detect truncated read of segments
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ]
+
+Given that no validation of how much data the firmware loader read in
+for a given segment truncated segment files would best case result in a
+hash verification failure, without any indication of what went wrong.
+
+Improve this by validating that the firmware loader did return the
+amount of data requested.
+
+Fixes: 445c2410a449 ("soc: qcom: mdt_loader: Use request_firmware_into_buf()")
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210107232526.716989-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index 2ddaee5ef9cc..eba7f76f9d61 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -261,6 +261,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (seg_fw->size != phdr->p_filesz) {
++ dev_err(dev,
++ "failed to load segment %d from truncated file %s\n",
++ i, fw_name);
++ release_firmware(seg_fw);
++ ret = -EINVAL;
++ break;
++ }
++
+ release_firmware(seg_fw);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From fc99ce60b4c576b8aba7b8920f3531927ca7db42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 15:31:19 -0800
+Subject: soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ]
+
+The code validates that segments of p_memsz bytes of a segment will fit
+in the provided memory region, but does not validate that p_filesz bytes
+will, which means that an incorrectly crafted ELF header might write
+beyond the provided memory region.
+
+Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5")
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index 24cd193dec55..2ddaee5ef9cc 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (phdr->p_filesz > phdr->p_memsz) {
++ dev_err(dev,
++ "refusing to load segment %d with p_filesz > p_memsz\n",
++ i);
++ ret = -EINVAL;
++ break;
++ }
++
+ ptr = mem_region + offset;
+
+ if (phdr->p_filesz && phdr->p_offset < fw->size) {
+--
+2.30.2
+
--- /dev/null
+From a9afdc8dda88c779dbe8ed8614870ed81792968c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 14:50:34 +0800
+Subject: soc: qcom: pdr: Fix error return code in pdr_register_listener
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 769738fc49bb578e05d404b481a9241d18147d86 ]
+
+Fix to return the error code -EREMOTEIO from pdr_register_listener
+rather than 0.
+
+Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201125065034.154217-1-miaoqinglang@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/pdr_interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c
+index 209dcdca923f..915d5bc3d46e 100644
+--- a/drivers/soc/qcom/pdr_interface.c
++++ b/drivers/soc/qcom/pdr_interface.c
+@@ -153,7 +153,7 @@ static int pdr_register_listener(struct pdr_handle *pdr,
+ if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
+ pr_err("PDR: %s register listener failed: 0x%x\n",
+ pds->service_path, resp.resp.error);
+- return ret;
++ return -EREMOTEIO;
+ }
+
+ pds->state = resp.curr_state;
+--
+2.30.2
+
--- /dev/null
+From 4125d712ba802092f8a1282d197c834aa74e2be7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 10:48:16 +0000
+Subject: soundwire: bus: Fix device found flag correctly
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit f03690f4f6992225d05dbd1171212e5be5a370dd ]
+
+found flag is used to indicate SoundWire devices that are
+both enumerated on the bus and available in the device list.
+However this flag is not reset correctly after one iteration,
+This could miss some of the devices that are enumerated on the
+bus but not in device list. So reset this correctly to fix this issue!
+
+Fixes: d52d7a1be02c ("soundwire: Add Slave status handling helpers")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210309104816.20350-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 46885429928a..4ec29338ce9a 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -705,7 +705,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+ struct sdw_slave *slave, *_s;
+ struct sdw_slave_id id;
+ struct sdw_msg msg;
+- bool found = false;
++ bool found;
+ int count = 0, ret;
+ u64 addr;
+
+@@ -737,6 +737,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+
+ sdw_extract_slave_id(bus, addr, &id);
+
++ found = false;
+ /* Now compare with entries */
+ list_for_each_entry_safe(slave, _s, &bus->slaves, node) {
+ if (sdw_compare_devid(slave, id) == 0) {
+--
+2.30.2
+
--- /dev/null
+From 37d6b4c52c9814d76d2adb93fdacf60f1fde677d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 08:46:10 +0800
+Subject: soundwire: stream: fix memory leak in stream config error path
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 48f17f96a81763c7c8bf5500460a359b9939359f ]
+
+When stream config is failed, master runtime will release all
+slave runtime in the slave_rt_list, but slave runtime is not
+added to the list at this time. This patch frees slave runtime
+in the config error path to fix the memory leak.
+
+Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management")
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Keyon Jie <yang.jie@intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/stream.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index 1099b5d1262b..a418c3c7001c 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -1375,8 +1375,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
+ }
+
+ ret = sdw_config_stream(&slave->dev, stream, stream_config, true);
+- if (ret)
++ if (ret) {
++ /*
++ * sdw_release_master_stream will release s_rt in slave_rt_list in
++ * stream_error case, but s_rt is only added to slave_rt_list
++ * when sdw_config_stream is successful, so free s_rt explicitly
++ * when sdw_config_stream is failed.
++ */
++ kfree(s_rt);
+ goto stream_error;
++ }
+
+ list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list);
+
+--
+2.30.2
+
--- /dev/null
+From 06c9367c283d76d5912ab2ffbf330c18fdc5599a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 02:55:27 -0700
+Subject: spi: Fix use-after-free with devm_spi_alloc_*
+
+From: William A. Kennington III <wak@google.com>
+
+[ Upstream commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 ]
+
+We can't rely on the contents of the devres list during
+spi_unregister_controller(), as the list is already torn down at the
+time we perform devres_find() for devm_spi_release_controller. This
+causes devices registered with devm_spi_alloc_{master,slave}() to be
+mistakenly identified as legacy, non-devm managed devices and have their
+reference counters decremented below 0.
+
+------------[ cut here ]------------
+WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
+[<b0396f04>] (refcount_warn_saturate) from [<b03c56a4>] (kobject_put+0x90/0x98)
+[<b03c5614>] (kobject_put) from [<b0447b4c>] (put_device+0x20/0x24)
+ r4:b6700140
+[<b0447b2c>] (put_device) from [<b07515e8>] (devm_spi_release_controller+0x3c/0x40)
+[<b07515ac>] (devm_spi_release_controller) from [<b045343c>] (release_nodes+0x84/0xc4)
+ r5:b6700180 r4:b6700100
+[<b04533b8>] (release_nodes) from [<b0454160>] (devres_release_all+0x5c/0x60)
+ r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10
+[<b0454104>] (devres_release_all) from [<b044e41c>] (__device_release_driver+0x144/0x1ec)
+ r5:b117ad94 r4:b163dc10
+[<b044e2d8>] (__device_release_driver) from [<b044f70c>] (device_driver_detach+0x84/0xa0)
+ r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10
+[<b044f688>] (device_driver_detach) from [<b044d274>] (unbind_store+0xe4/0xf8)
+
+Instead, determine the devm allocation state as a flag on the
+controller which is guaranteed to be stable during cleanup.
+
+Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation")
+Signed-off-by: William A. Kennington III <wak@google.com>
+Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 9 ++-------
+ include/linux/spi/spi.h | 3 +++
+ 2 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 927c2a28011f..8da4fe475b84 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2496,6 +2496,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
+
+ ctlr = __spi_alloc_controller(dev, size, slave);
+ if (ctlr) {
++ ctlr->devm_allocated = true;
+ *ptr = ctlr;
+ devres_add(dev, ptr);
+ } else {
+@@ -2842,11 +2843,6 @@ int devm_spi_register_controller(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
+-static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
+-{
+- return *(struct spi_controller **)res == ctlr;
+-}
+-
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2893,8 +2889,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ /* Release the last reference on the controller if its driver
+ * has not yet been converted to devm_spi_alloc_master/slave().
+ */
+- if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
+- devm_spi_match_controller, ctlr))
++ if (!ctlr->devm_allocated)
+ put_device(&ctlr->dev);
+
+ /* free bus id */
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index 592897fa4f03..643139b1eafe 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -510,6 +510,9 @@ struct spi_controller {
+
+ #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */
+
++ /* flag indicating this is a non-devres managed controller */
++ bool devm_allocated;
++
+ /* flag indicating this is an SPI slave controller */
+ bool slave;
+
+--
+2.30.2
+
--- /dev/null
+From cff2e57d60aa1a23a84411ff6ac1dc950f9d0571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 22:03:50 +0800
+Subject: spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5fed9fe5b41aea58e5b32be506dc50c9ab9a0e4d ]
+
+Add the missing iounmap() before return from of_fsl_spi_probe()
+in the error handling case.
+
+Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210401140350.1677925-1-yangyingliang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index e4a8d203f940..d0e5aa18b7ba 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -707,6 +707,11 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+ struct resource mem;
+ int irq, type;
+ int ret;
++ bool spisel_boot = false;
++#if IS_ENABLED(CONFIG_FSL_SOC)
++ struct mpc8xxx_spi_probe_info *pinfo = NULL;
++#endif
++
+
+ ret = of_mpc8xxx_spi_probe(ofdev);
+ if (ret)
+@@ -715,9 +720,8 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+ type = fsl_spi_get_type(&ofdev->dev);
+ if (type == TYPE_FSL) {
+ struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
+- bool spisel_boot = false;
+ #if IS_ENABLED(CONFIG_FSL_SOC)
+- struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(pdata);
++ pinfo = to_of_pinfo(pdata);
+
+ spisel_boot = of_property_read_bool(np, "fsl,spisel_boot");
+ if (spisel_boot) {
+@@ -746,15 +750,24 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+
+ ret = of_address_to_resource(np, 0, &mem);
+ if (ret)
+- return ret;
++ goto unmap_out;
+
+ irq = platform_get_irq(ofdev, 0);
+- if (irq < 0)
+- return irq;
++ if (irq < 0) {
++ ret = irq;
++ goto unmap_out;
++ }
+
+ master = fsl_spi_probe(dev, &mem, irq);
+
+ return PTR_ERR_OR_ZERO(master);
++
++unmap_out:
++#if IS_ENABLED(CONFIG_FSL_SOC)
++ if (spisel_boot)
++ iounmap(pinfo->immr_spi_cs);
++#endif
++ return ret;
+ }
+
+ static int of_fsl_spi_remove(struct platform_device *ofdev)
+--
+2.30.2
+
--- /dev/null
+From 537dcd4e1881ad12065d4a5faa910ae9438d4dca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 09:54:30 +0000
+Subject: spi: fsl-lpspi: Fix PM reference leak in
+ lpspi_prepare_xfer_hardware()
+
+From: Wang Li <wangli74@huawei.com>
+
+[ Upstream commit a03675497970a93fcf25d81d9d92a59c2d7377a7 ]
+
+pm_runtime_get_sync will increment pm usage counter even it failed.
+Forgetting to putting operation will result in reference leak here.
+Fix it by replacing it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Li <wangli74@huawei.com>
+Link: https://lore.kernel.org/r/20210409095430.29868-1-wangli74@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index a2886ee44e4c..5d98611dd999 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -200,7 +200,7 @@ static int lpspi_prepare_xfer_hardware(struct spi_controller *controller)
+ spi_controller_get_devdata(controller);
+ int ret;
+
+- ret = pm_runtime_get_sync(fsl_lpspi->dev);
++ ret = pm_runtime_resume_and_get(fsl_lpspi->dev);
+ if (ret < 0) {
+ dev_err(fsl_lpspi->dev, "failed to enable clock\n");
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From bb0eb447f6301bad39ca7206195970fbdbf1bd19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 15:00:48 +0100
+Subject: spi: rockchip: avoid objtool warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e50989527faeafb79f45a0f7529ba8e01dff1fff ]
+
+Building this file with clang leads to a an unreachable code path
+causing a warning from objtool:
+
+drivers/spi/spi-rockchip.o: warning: objtool: rockchip_spi_transfer_one()+0x2e0: sibling call from callable instruction with modified stack frame
+
+Change the unreachable() into an error return that can be
+handled if it ever happens, rather than silently crashing
+the kernel.
+
+Fixes: 65498c6ae241 ("spi: rockchip: support 4bit words")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Pratyush Yadav <p.yadav@ti.com>
+Link: https://lore.kernel.org/r/20210226140109.3477093-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rockchip.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 936ef54e0903..0d75080da648 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -476,7 +476,7 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs,
+ return 1;
+ }
+
+-static void rockchip_spi_config(struct rockchip_spi *rs,
++static int rockchip_spi_config(struct rockchip_spi *rs,
+ struct spi_device *spi, struct spi_transfer *xfer,
+ bool use_dma, bool slave_mode)
+ {
+@@ -521,7 +521,9 @@ static void rockchip_spi_config(struct rockchip_spi *rs,
+ * ctlr->bits_per_word_mask, so this shouldn't
+ * happen
+ */
+- unreachable();
++ dev_err(rs->dev, "unknown bits per word: %d\n",
++ xfer->bits_per_word);
++ return -EINVAL;
+ }
+
+ if (use_dma) {
+@@ -554,6 +556,8 @@ static void rockchip_spi_config(struct rockchip_spi *rs,
+ */
+ writel_relaxed(2 * DIV_ROUND_UP(rs->freq, 2 * xfer->speed_hz),
+ rs->regs + ROCKCHIP_SPI_BAUDR);
++
++ return 0;
+ }
+
+ static size_t rockchip_spi_max_transfer_size(struct spi_device *spi)
+@@ -577,6 +581,7 @@ static int rockchip_spi_transfer_one(
+ struct spi_transfer *xfer)
+ {
+ struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
++ int ret;
+ bool use_dma;
+
+ WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
+@@ -596,7 +601,9 @@ static int rockchip_spi_transfer_one(
+
+ use_dma = ctlr->can_dma ? ctlr->can_dma(ctlr, spi, xfer) : false;
+
+- rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave);
++ ret = rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave);
++ if (ret)
++ return ret;
+
+ if (use_dma)
+ return rockchip_spi_prepare_dma(rs, ctlr, xfer);
+--
+2.30.2
+
--- /dev/null
+From 94879b82e4dc585209e665561bcac3c472b74115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:02:21 +0800
+Subject: spi: spi-zynqmp-gqspi: add mutex locking for exec_op
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a0f65be6e880a14d3445b75e7dc03d7d015fc922 ]
+
+The spi-mem framework has no locking to prevent ctlr->mem_ops->exec_op
+from concurrency. So add the locking to zynqmp_qspi_exec_op.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Link: https://lore.kernel.org/r/20210408040223.23134-3-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index d49ab6575553..3b39461d58b3 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -173,6 +173,7 @@ struct zynqmp_qspi {
+ u32 genfifoentry;
+ enum mode_type mode;
+ struct completion data_completion;
++ struct mutex op_lock;
+ };
+
+ /**
+@@ -951,6 +952,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth,
+ op->dummy.buswidth, op->data.buswidth);
+
++ mutex_lock(&xqspi->op_lock);
+ zynqmp_qspi_config_op(xqspi, mem->spi);
+ zynqmp_qspi_chipselect(mem->spi, false);
+ genfifoentry |= xqspi->genfifocs;
+@@ -1084,6 +1086,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ return_err:
+
+ zynqmp_qspi_chipselect(mem->spi, true);
++ mutex_unlock(&xqspi->op_lock);
+
+ return err;
+ }
+@@ -1156,6 +1159,8 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ goto clk_dis_pclk;
+ }
+
++ mutex_init(&xqspi->op_lock);
++
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+ pm_runtime_set_active(&pdev->dev);
+--
+2.30.2
+
--- /dev/null
+From 422f3b1cdd18119d135a06936dfaee4dda067d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 08:46:48 +0800
+Subject: spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit c6bdae08012b2ca3e94f3a41ef4ca8cfe7c9ab6f ]
+
+The clks "pclk" and "ref_clk" are enabled twice during the probe. The
+first time is in the function zynqmp_qspi_probe and the second time is
+in zynqmp_qspi_setup_op which is called by devm_spi_register_controller.
+Then calling zynqmp_qspi_remove (rmmod this module) to disable these clks
+will trigger a warning as below:
+
+[ 309.124604] Unpreparing enabled qspi_ref
+[ 309.128641] WARNING: CPU: 1 PID: 537 at drivers/clk/clk.c:824 clk_core_unprepare+0x108/0x110
+
+Since pm_runtime works now, clks can be enabled/disabled by calling
+zynqmp_runtime_suspend/resume. So we don't need to enable these clks
+explicitly in zynqmp_qspi_setup_op. Remove them to fix this issue.
+
+And remove clk enabling/disabling in zynqmp_qspi_resume because there is
+no spi transfer operation so enabling ref_clk is redundant meanwhile pclk
+is not disabled for it is shared with other peripherals.
+
+Furthermore replace clk_enable/disable with clk_prepare_enable and
+clk_disable_unprepare in runtime_suspend/resume functions.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210416004652.2975446-2-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 47 ++++++----------------------------
+ 1 file changed, 8 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 32e53f379e9b..f9056f0a480c 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -487,24 +487,10 @@ static int zynqmp_qspi_setup_op(struct spi_device *qspi)
+ {
+ struct spi_controller *ctlr = qspi->master;
+ struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr);
+- struct device *dev = &ctlr->dev;
+- int ret;
+
+ if (ctlr->busy)
+ return -EBUSY;
+
+- ret = clk_enable(xqspi->refclk);
+- if (ret) {
+- dev_err(dev, "Cannot enable device clock.\n");
+- return ret;
+- }
+-
+- ret = clk_enable(xqspi->pclk);
+- if (ret) {
+- dev_err(dev, "Cannot enable APB clock.\n");
+- clk_disable(xqspi->refclk);
+- return ret;
+- }
+ zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, GQSPI_EN_MASK);
+
+ return 0;
+@@ -863,26 +849,9 @@ static int __maybe_unused zynqmp_qspi_suspend(struct device *dev)
+ static int __maybe_unused zynqmp_qspi_resume(struct device *dev)
+ {
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+- struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr);
+- int ret = 0;
+-
+- ret = clk_enable(xqspi->pclk);
+- if (ret) {
+- dev_err(dev, "Cannot enable APB clock.\n");
+- return ret;
+- }
+-
+- ret = clk_enable(xqspi->refclk);
+- if (ret) {
+- dev_err(dev, "Cannot enable device clock.\n");
+- clk_disable(xqspi->pclk);
+- return ret;
+- }
+
+ spi_controller_resume(ctlr);
+
+- clk_disable(xqspi->refclk);
+- clk_disable(xqspi->pclk);
+ return 0;
+ }
+
+@@ -898,8 +867,8 @@ static int __maybe_unused zynqmp_runtime_suspend(struct device *dev)
+ {
+ struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev);
+
+- clk_disable(xqspi->refclk);
+- clk_disable(xqspi->pclk);
++ clk_disable_unprepare(xqspi->refclk);
++ clk_disable_unprepare(xqspi->pclk);
+
+ return 0;
+ }
+@@ -917,16 +886,16 @@ static int __maybe_unused zynqmp_runtime_resume(struct device *dev)
+ struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev);
+ int ret;
+
+- ret = clk_enable(xqspi->pclk);
++ ret = clk_prepare_enable(xqspi->pclk);
+ if (ret) {
+ dev_err(dev, "Cannot enable APB clock.\n");
+ return ret;
+ }
+
+- ret = clk_enable(xqspi->refclk);
++ ret = clk_prepare_enable(xqspi->refclk);
+ if (ret) {
+ dev_err(dev, "Cannot enable device clock.\n");
+- clk_disable(xqspi->pclk);
++ clk_disable_unprepare(xqspi->pclk);
+ return ret;
+ }
+
+@@ -1136,13 +1105,11 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ goto remove_master;
+ }
+
+- init_completion(&xqspi->data_completion);
+-
+ xqspi->refclk = devm_clk_get(&pdev->dev, "ref_clk");
+ if (IS_ERR(xqspi->refclk)) {
+ dev_err(dev, "ref_clk clock not found.\n");
+ ret = PTR_ERR(xqspi->refclk);
+- goto clk_dis_pclk;
++ goto remove_master;
+ }
+
+ ret = clk_prepare_enable(xqspi->pclk);
+@@ -1157,6 +1124,8 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ goto clk_dis_pclk;
+ }
+
++ init_completion(&xqspi->data_completion);
++
+ mutex_init(&xqspi->op_lock);
+
+ pm_runtime_use_autosuspend(&pdev->dev);
+--
+2.30.2
+
--- /dev/null
+From a43a8aaf178f88f0128c75afd6710d3c1338e3b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 08:46:49 +0800
+Subject: spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 799f923f0a66a9c99f0a3eaa078b306db7a8b33a ]
+
+After calling platform_set_drvdata(pdev, xqspi) in probe, the return
+value of dev_get_drvdata(dev) is a pointer to struct zynqmp_qspi but
+not struct spi_controller. A wrong structure type passing to the
+functions spi_controller_suspend/resume will hang the system.
+
+And we should check the return value of spi_controller_suspend, if
+an error is returned, return it to PM subsystem to stop suspend.
+
+Also, GQSPI_EN_MASK should be written to GQSPI_EN_OFST to enable
+the spi controller in zynqmp_qspi_resume since it was disabled in
+zynqmp_qspi_suspend before.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210416004652.2975446-3-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index f9056f0a480c..1146359528b9 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -157,6 +157,7 @@ enum mode_type {GQSPI_MODE_IO, GQSPI_MODE_DMA};
+ * @data_completion: completion structure
+ */
+ struct zynqmp_qspi {
++ struct spi_controller *ctlr;
+ void __iomem *regs;
+ struct clk *refclk;
+ struct clk *pclk;
+@@ -827,10 +828,13 @@ static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits,
+ */
+ static int __maybe_unused zynqmp_qspi_suspend(struct device *dev)
+ {
+- struct spi_controller *ctlr = dev_get_drvdata(dev);
+- struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr);
++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev);
++ struct spi_controller *ctlr = xqspi->ctlr;
++ int ret;
+
+- spi_controller_suspend(ctlr);
++ ret = spi_controller_suspend(ctlr);
++ if (ret)
++ return ret;
+
+ zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0);
+
+@@ -848,7 +852,10 @@ static int __maybe_unused zynqmp_qspi_suspend(struct device *dev)
+ */
+ static int __maybe_unused zynqmp_qspi_resume(struct device *dev)
+ {
+- struct spi_controller *ctlr = dev_get_drvdata(dev);
++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev);
++ struct spi_controller *ctlr = xqspi->ctlr;
++
++ zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, GQSPI_EN_MASK);
+
+ spi_controller_resume(ctlr);
+
+@@ -865,7 +872,7 @@ static int __maybe_unused zynqmp_qspi_resume(struct device *dev)
+ */
+ static int __maybe_unused zynqmp_runtime_suspend(struct device *dev)
+ {
+- struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev);
++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev);
+
+ clk_disable_unprepare(xqspi->refclk);
+ clk_disable_unprepare(xqspi->pclk);
+@@ -883,7 +890,7 @@ static int __maybe_unused zynqmp_runtime_suspend(struct device *dev)
+ */
+ static int __maybe_unused zynqmp_runtime_resume(struct device *dev)
+ {
+- struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev);
++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_prepare_enable(xqspi->pclk);
+@@ -1090,6 +1097,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+
+ xqspi = spi_controller_get_devdata(ctlr);
+ xqspi->dev = dev;
++ xqspi->ctlr = ctlr;
+ platform_set_drvdata(pdev, xqspi);
+
+ xqspi->regs = devm_platform_ioremap_resource(pdev, 0);
+--
+2.30.2
+
--- /dev/null
+From dc858e5cd7a6ddc21a59f2b491108b1ac54f69d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:02:23 +0800
+Subject: spi: spi-zynqmp-gqspi: fix incorrect operating mode in
+ zynqmp_qspi_read_op
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 41d310930084502433fcb3c4baf219e7424b7734 ]
+
+When starting a read operation, we should call zynqmp_qspi_setuprxdma
+first to set xqspi->mode according to xqspi->bytes_to_receive and
+to calculate correct xqspi->dma_rx_bytes. Then in the function
+zynqmp_qspi_fillgenfifo, generate the appropriate command with
+operating mode and bytes to transfer, and fill the GENFIFO with
+the command to perform the read operation.
+
+Calling zynqmp_qspi_fillgenfifo before zynqmp_qspi_setuprxdma will
+result in incorrect transfer length and operating mode. So change
+the calling order to fix this issue.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Link: https://lore.kernel.org/r/20210408040223.23134-5-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index cf73a069b759..036d8ae41c06 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -827,8 +827,8 @@ static void zynqmp_qspi_write_op(struct zynqmp_qspi *xqspi, u8 tx_nbits,
+ static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits,
+ u32 genfifoentry)
+ {
+- zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry);
+ zynqmp_qspi_setuprxdma(xqspi);
++ zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From aee0cc7d0d21351522c4a6a1b3aaa7da8ce7f60a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 16:00:25 +0000
+Subject: spi: spi-zynqmp-gqspi: Fix missing unlock on error in
+ zynqmp_qspi_exec_op()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 6043357263fbe2df0bf0736d971ad5dce7d19dc1 ]
+
+Add the missing unlock before return from function zynqmp_qspi_exec_op()
+in the error handling case.
+
+Fixes: a0f65be6e880 ("spi: spi-zynqmp-gqspi: add mutex locking for exec_op")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20210412160025.194171-1-weiyongjun1@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 036d8ae41c06..408e348382c5 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -965,8 +965,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+
+ if (op->cmd.opcode) {
+ tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA);
+- if (!tmpbuf)
++ if (!tmpbuf) {
++ mutex_unlock(&xqspi->op_lock);
+ return -ENOMEM;
++ }
+ tmpbuf[0] = op->cmd.opcode;
+ reinit_completion(&xqspi->data_completion);
+ xqspi->txbuf = tmpbuf;
+--
+2.30.2
+
--- /dev/null
+From d435ab8d7ac83342e2264e6a29966431a27138c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 15:46:44 +0800
+Subject: spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a21fbc42807b15b74b0891bd557063e6acf4fcae ]
+
+When platform_get_irq() fails, a pairing PM usage counter
+increment is needed to keep the counter balanced. It's the
+same for the following error paths.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20210408092559.3824-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 408e348382c5..32e53f379e9b 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -1163,11 +1163,16 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
++
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "Failed to pm_runtime_get_sync: %d\n", ret);
++ goto clk_dis_all;
++ }
++
+ /* QSPI controller initializations */
+ zynqmp_qspi_init_hw(xqspi);
+
+- pm_runtime_mark_last_busy(&pdev->dev);
+- pm_runtime_put_autosuspend(&pdev->dev);
+ xqspi->irq = platform_get_irq(pdev, 0);
+ if (xqspi->irq <= 0) {
+ ret = -ENXIO;
+@@ -1190,6 +1195,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ ctlr->mode_bits = SPI_CPOL | SPI_CPHA | SPI_RX_DUAL | SPI_RX_QUAD |
+ SPI_TX_DUAL | SPI_TX_QUAD;
+ ctlr->dev.of_node = np;
++ ctlr->auto_runtime_pm = true;
+
+ ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ if (ret) {
+@@ -1197,9 +1203,13 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ goto clk_dis_all;
+ }
+
++ pm_runtime_mark_last_busy(&pdev->dev);
++ pm_runtime_put_autosuspend(&pdev->dev);
++
+ return 0;
+
+ clk_dis_all:
++ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ clk_disable_unprepare(xqspi->refclk);
+--
+2.30.2
+
--- /dev/null
+From a07e5afe57e871e1fdf3aee1160fcecfedd13657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 08:46:51 +0800
+Subject: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a2c5bedb2d55dd27c642c7b9fb6886d7ad7bdb58 ]
+
+When handling op->addr, it is using the buffer "tmpbuf" which has been
+freed. This will trigger a use-after-free KASAN warning. Let's use
+temporary variables to store op->addr.val and op->cmd.opcode to fix
+this issue.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 1146359528b9..8cd20ff084f4 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -926,8 +926,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ struct zynqmp_qspi *xqspi = spi_controller_get_devdata
+ (mem->spi->master);
+ int err = 0, i;
+- u8 *tmpbuf;
+ u32 genfifoentry = 0;
++ u16 opcode = op->cmd.opcode;
++ u64 opaddr;
+
+ dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n",
+ op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth,
+@@ -940,14 +941,8 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ genfifoentry |= xqspi->genfifobus;
+
+ if (op->cmd.opcode) {
+- tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA);
+- if (!tmpbuf) {
+- mutex_unlock(&xqspi->op_lock);
+- return -ENOMEM;
+- }
+- tmpbuf[0] = op->cmd.opcode;
+ reinit_completion(&xqspi->data_completion);
+- xqspi->txbuf = tmpbuf;
++ xqspi->txbuf = &opcode;
+ xqspi->rxbuf = NULL;
+ xqspi->bytes_to_transfer = op->cmd.nbytes;
+ xqspi->bytes_to_receive = 0;
+@@ -961,13 +956,12 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ if (!wait_for_completion_timeout
+ (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+ err = -ETIMEDOUT;
+- kfree(tmpbuf);
+ goto return_err;
+ }
+- kfree(tmpbuf);
+ }
+
+ if (op->addr.nbytes) {
++ xqspi->txbuf = &opaddr;
+ for (i = 0; i < op->addr.nbytes; i++) {
+ *(((u8 *)xqspi->txbuf) + i) = op->addr.val >>
+ (8 * (op->addr.nbytes - i - 1));
+--
+2.30.2
+
--- /dev/null
+From 5accd89c5fd0a92d6aba37114d1fce6484f6b285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 08:46:52 +0800
+Subject: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 126bdb606fd2802454e6048caef1be3e25dd121e ]
+
+The spi controller supports 44-bit address space on AXI in DMA mode,
+so set dma_addr_t width to 44-bit to avoid using a swiotlb mapping.
+In addition, if dma_map_single fails, it should return immediately
+instead of continuing doing the DMA operation which bases on invalid
+address.
+
+This fixes the following crash which occurs in reading a big block
+from flash:
+
+[ 123.633577] zynqmp-qspi ff0f0000.spi: swiotlb buffer is full (sz: 4194304 bytes), total 32768 (slots), used 0 (slots)
+[ 123.644230] zynqmp-qspi ff0f0000.spi: ERR:rxdma:memory not mapped
+[ 123.784625] Unable to handle kernel paging request at virtual address 00000000003fffc0
+[ 123.792536] Mem abort info:
+[ 123.795313] ESR = 0x96000145
+[ 123.798351] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 123.803655] SET = 0, FnV = 0
+[ 123.806693] EA = 0, S1PTW = 0
+[ 123.809818] Data abort info:
+[ 123.812683] ISV = 0, ISS = 0x00000145
+[ 123.816503] CM = 1, WnR = 1
+[ 123.819455] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000805047000
+[ 123.825887] [00000000003fffc0] pgd=0000000803b45003, p4d=0000000803b45003, pud=0000000000000000
+[ 123.834586] Internal error: Oops: 96000145 [#1] PREEMPT SMP
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210416004652.2975446-6-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 8cd20ff084f4..7162387b9f96 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -731,7 +731,7 @@ static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id)
+ * zynqmp_qspi_setuprxdma - This function sets up the RX DMA operation
+ * @xqspi: xqspi is a pointer to the GQSPI instance.
+ */
+-static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi)
++static int zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi)
+ {
+ u32 rx_bytes, rx_rem, config_reg;
+ dma_addr_t addr;
+@@ -745,7 +745,7 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi)
+ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, config_reg);
+ xqspi->mode = GQSPI_MODE_IO;
+ xqspi->dma_rx_bytes = 0;
+- return;
++ return 0;
+ }
+
+ rx_rem = xqspi->bytes_to_receive % 4;
+@@ -753,8 +753,10 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi)
+
+ addr = dma_map_single(xqspi->dev, (void *)xqspi->rxbuf,
+ rx_bytes, DMA_FROM_DEVICE);
+- if (dma_mapping_error(xqspi->dev, addr))
++ if (dma_mapping_error(xqspi->dev, addr)) {
+ dev_err(xqspi->dev, "ERR:rxdma:memory not mapped\n");
++ return -ENOMEM;
++ }
+
+ xqspi->dma_rx_bytes = rx_bytes;
+ xqspi->dma_addr = addr;
+@@ -775,6 +777,8 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi)
+
+ /* Write the number of bytes to transfer */
+ zynqmp_gqspi_write(xqspi, GQSPI_QSPIDMA_DST_SIZE_OFST, rx_bytes);
++
++ return 0;
+ }
+
+ /**
+@@ -811,11 +815,17 @@ static void zynqmp_qspi_write_op(struct zynqmp_qspi *xqspi, u8 tx_nbits,
+ * @genfifoentry: genfifoentry is pointer to the variable in which
+ * GENFIFO mask is returned to calling function
+ */
+-static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits,
++static int zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits,
+ u32 genfifoentry)
+ {
+- zynqmp_qspi_setuprxdma(xqspi);
++ int ret;
++
++ ret = zynqmp_qspi_setuprxdma(xqspi);
++ if (ret)
++ return ret;
+ zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry);
++
++ return 0;
+ }
+
+ /**
+@@ -1029,8 +1039,11 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ xqspi->rxbuf = (u8 *)op->data.buf.in;
+ xqspi->bytes_to_receive = op->data.nbytes;
+ xqspi->bytes_to_transfer = 0;
+- zynqmp_qspi_read_op(xqspi, op->data.buswidth,
++ err = zynqmp_qspi_read_op(xqspi, op->data.buswidth,
+ genfifoentry);
++ if (err)
++ goto return_err;
++
+ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST,
+ zynqmp_gqspi_read
+ (xqspi, GQSPI_CONFIG_OFST) |
+@@ -1157,6 +1170,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ goto clk_dis_all;
+ }
+
++ dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
+ ctlr->bits_per_word_mask = SPI_BPW_MASK(8);
+ ctlr->num_chipselect = GQSPI_DEFAULT_NUM_CS;
+ ctlr->mem_ops = &zynqmp_qspi_mem_ops;
+--
+2.30.2
+
--- /dev/null
+From 2da0f20c356a40189a2b003a55804b5f3f49a807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:02:22 +0800
+Subject: spi: spi-zynqmp-gqspi: transmit dummy circles by using the
+ controller's internal functionality
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 8ad07d79bd56a531990a1a3f3f1c0eb19d2de806 ]
+
+There is a data corruption issue that occurs in the reading operation
+(cmd:0x6c) when transmitting common data as dummy circles.
+
+The gqspi controller has the functionality to send dummy clock circles.
+When writing data with the fields [receive, transmit, data_xfer] = [0,0,1]
+to the Generic FIFO, and configuring the correct SPI mode, the controller
+will transmit dummy circles.
+
+So let's switch to hardware dummy cycles transfer to fix this issue.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Link: https://lore.kernel.org/r/20210408040223.23134-4-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 40 +++++++++++++++-------------------
+ 1 file changed, 18 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 3b39461d58b3..cf73a069b759 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -521,7 +521,7 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size)
+ {
+ u32 count = 0, intermediate;
+
+- while ((xqspi->bytes_to_transfer > 0) && (count < size)) {
++ while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) {
+ memcpy(&intermediate, xqspi->txbuf, 4);
+ zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
+
+@@ -580,7 +580,7 @@ static void zynqmp_qspi_fillgenfifo(struct zynqmp_qspi *xqspi, u8 nbits,
+ genfifoentry |= GQSPI_GENFIFO_DATA_XFER;
+ genfifoentry |= GQSPI_GENFIFO_TX;
+ transfer_len = xqspi->bytes_to_transfer;
+- } else {
++ } else if (xqspi->rxbuf) {
+ genfifoentry &= ~GQSPI_GENFIFO_TX;
+ genfifoentry |= GQSPI_GENFIFO_DATA_XFER;
+ genfifoentry |= GQSPI_GENFIFO_RX;
+@@ -588,6 +588,11 @@ static void zynqmp_qspi_fillgenfifo(struct zynqmp_qspi *xqspi, u8 nbits,
+ transfer_len = xqspi->dma_rx_bytes;
+ else
+ transfer_len = xqspi->bytes_to_receive;
++ } else {
++ /* Sending dummy circles here */
++ genfifoentry &= ~(GQSPI_GENFIFO_TX | GQSPI_GENFIFO_RX);
++ genfifoentry |= GQSPI_GENFIFO_DATA_XFER;
++ transfer_len = xqspi->bytes_to_transfer;
+ }
+ genfifoentry |= zynqmp_qspi_selectspimode(xqspi, nbits);
+ xqspi->genfifoentry = genfifoentry;
+@@ -1011,32 +1016,23 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ }
+
+ if (op->dummy.nbytes) {
+- tmpbuf = kzalloc(op->dummy.nbytes, GFP_KERNEL | GFP_DMA);
+- if (!tmpbuf)
+- return -ENOMEM;
+- memset(tmpbuf, 0xff, op->dummy.nbytes);
+- reinit_completion(&xqspi->data_completion);
+- xqspi->txbuf = tmpbuf;
++ xqspi->txbuf = NULL;
+ xqspi->rxbuf = NULL;
+- xqspi->bytes_to_transfer = op->dummy.nbytes;
++ /*
++ * xqspi->bytes_to_transfer here represents the dummy circles
++ * which need to be sent.
++ */
++ xqspi->bytes_to_transfer = op->dummy.nbytes * 8 / op->dummy.buswidth;
+ xqspi->bytes_to_receive = 0;
+- zynqmp_qspi_write_op(xqspi, op->dummy.buswidth,
++ /*
++ * Using op->data.buswidth instead of op->dummy.buswidth here because
++ * we need to use it to configure the correct SPI mode.
++ */
++ zynqmp_qspi_write_op(xqspi, op->data.buswidth,
+ genfifoentry);
+ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST,
+ zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) |
+ GQSPI_CFG_START_GEN_FIFO_MASK);
+- zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST,
+- GQSPI_IER_TXEMPTY_MASK |
+- GQSPI_IER_GENFIFOEMPTY_MASK |
+- GQSPI_IER_TXNOT_FULL_MASK);
+- if (!wait_for_completion_interruptible_timeout
+- (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+- err = -ETIMEDOUT;
+- kfree(tmpbuf);
+- goto return_err;
+- }
+-
+- kfree(tmpbuf);
+ }
+
+ if (op->data.nbytes) {
+--
+2.30.2
+
--- /dev/null
+From b0184ad340e3b525012743078b88deeec1b213bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:02:20 +0800
+Subject: spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make
+ zynqmp_qspi_exec_op not interruptible
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a16bff68b75fd082d36aa0b14b540bd7a3ebebbd ]
+
+When Ctrl+C occurs during the process of zynqmp_qspi_exec_op, the function
+wait_for_completion_interruptible_timeout will return a non-zero value
+-ERESTARTSYS immediately. This will disrupt the SPI memory operation
+because the data transmitting may begin before the command or address
+transmitting completes. Use wait_for_completion_timeout to prevent
+the process from being interruptible.
+
+This patch fixes the error as below:
+root@xilinx-zynqmp:~# flash_erase /dev/mtd3 0 0
+Erasing 4 Kibyte @ 3d000 -- 4 % complete
+ (Press Ctrl+C)
+[ 169.581911] zynqmp-qspi ff0f0000.spi: Chip select timed out
+[ 170.585907] zynqmp-qspi ff0f0000.spi: Chip select timed out
+[ 171.589910] zynqmp-qspi ff0f0000.spi: Chip select timed out
+[ 172.593910] zynqmp-qspi ff0f0000.spi: Chip select timed out
+[ 173.597907] zynqmp-qspi ff0f0000.spi: Chip select timed out
+[ 173.603480] spi-nor spi0.0: Erase operation failed.
+[ 173.608368] spi-nor spi0.0: Attempted to modify a protected sector.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Link: https://lore.kernel.org/r/20210408040223.23134-2-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index c8fa6ee18ae7..d49ab6575553 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -973,7 +973,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST,
+ GQSPI_IER_GENFIFOEMPTY_MASK |
+ GQSPI_IER_TXNOT_FULL_MASK);
+- if (!wait_for_completion_interruptible_timeout
++ if (!wait_for_completion_timeout
+ (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+ err = -ETIMEDOUT;
+ kfree(tmpbuf);
+@@ -1001,7 +1001,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ GQSPI_IER_TXEMPTY_MASK |
+ GQSPI_IER_GENFIFOEMPTY_MASK |
+ GQSPI_IER_TXNOT_FULL_MASK);
+- if (!wait_for_completion_interruptible_timeout
++ if (!wait_for_completion_timeout
+ (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+ err = -ETIMEDOUT;
+ goto return_err;
+@@ -1076,7 +1076,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ GQSPI_IER_RXEMPTY_MASK);
+ }
+ }
+- if (!wait_for_completion_interruptible_timeout
++ if (!wait_for_completion_timeout
+ (&xqspi->data_completion, msecs_to_jiffies(1000)))
+ err = -ETIMEDOUT;
+ }
+--
+2.30.2
+
--- /dev/null
+From 2ebe31497d33bf14d09fecb38a646568a59234ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 11:34:46 +0100
+Subject: spi: stm32: drop devres version of spi_register_master
+
+From: Antonio Borneo <antonio.borneo@foss.st.com>
+
+[ Upstream commit 8d559a64f00b59af9cc02b803ff52f6e6880a651 ]
+
+A call to spi_unregister_master() triggers calling remove()
+for all the spi devices binded to the spi master.
+
+Some spi device driver requires to "talk" with the spi device
+during the remove(), e.g.:
+- a LCD panel like drivers/gpu/drm/panel/panel-lg-lg4573.c
+ will turn off the backlighting sending a command over spi.
+This implies that the spi master must be fully functional when
+spi_unregister_master() is called, either if it is called
+explicitly in the master's remove() code or implicitly by the
+devres framework.
+
+Devres calls devres_release_all() to release all the resources
+"after" the remove() of the spi master driver (check code of
+__device_release_driver() in drivers/base/dd.c).
+If the spi master driver has an empty remove() then there would
+be no issue; the devres_release_all() will release everything
+in reverse order w.r.t. probe().
+But if code in spi master driver remove() disables the spi or
+makes it not functional (like in this spi-stm32), then devres
+cannot be used safely for unregistering the spi master and the
+binded spi devices.
+
+Replace devm_spi_register_master() with spi_register_master()
+and add spi_unregister_master() as first action in remove().
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+
+Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1615545286-5395-1-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 25c076461011..97cf3a2d4180 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1929,7 +1929,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- ret = devm_spi_register_master(&pdev->dev, master);
++ ret = spi_register_master(master);
+ if (ret) {
+ dev_err(&pdev->dev, "spi master registration failed: %d\n",
+ ret);
+@@ -1960,6 +1960,7 @@ static int stm32_spi_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct stm32_spi *spi = spi_master_get_devdata(master);
+
++ spi_unregister_master(master);
+ spi->cfg->disable(spi);
+
+ if (master->dma_tx)
+--
+2.30.2
+
--- /dev/null
+From 73d2289ee9e0ce657dd60d6175ac5f090b37e6d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 08:24:50 +0100
+Subject: spi: stm32: Fix use-after-free on unbind
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 79c6246ae8793448c05da86a4c82298eed8549b0 ]
+
+stm32_spi_remove() accesses the driver's private data after calling
+spi_unregister_master() even though that function releases the last
+reference on the spi_master and thereby frees the private data.
+
+Fix by switching over to the new devm_spi_alloc_master() helper which
+keeps the private data accessible until the driver has unbound.
+
+Fixes: 8d559a64f00b ("spi: stm32: drop devres version of spi_register_master")
+
+Reported-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1616052290-10887-1-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 97cf3a2d4180..7f0244a246e9 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1803,7 +1803,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
+ struct reset_control *rst;
+ int ret;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(struct stm32_spi));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(struct stm32_spi));
+ if (!master) {
+ dev_err(&pdev->dev, "spi master allocation failed\n");
+ return -ENOMEM;
+@@ -1821,18 +1821,16 @@ static int stm32_spi_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ spi->base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(spi->base)) {
+- ret = PTR_ERR(spi->base);
+- goto err_master_put;
+- }
++ if (IS_ERR(spi->base))
++ return PTR_ERR(spi->base);
+
+ spi->phys_addr = (dma_addr_t)res->start;
+
+ spi->irq = platform_get_irq(pdev, 0);
+- if (spi->irq <= 0) {
+- ret = dev_err_probe(&pdev->dev, spi->irq, "failed to get irq\n");
+- goto err_master_put;
+- }
++ if (spi->irq <= 0)
++ return dev_err_probe(&pdev->dev, spi->irq,
++ "failed to get irq\n");
++
+ ret = devm_request_threaded_irq(&pdev->dev, spi->irq,
+ spi->cfg->irq_handler_event,
+ spi->cfg->irq_handler_thread,
+@@ -1840,20 +1838,20 @@ static int stm32_spi_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev, "irq%d request failed: %d\n", spi->irq,
+ ret);
+- goto err_master_put;
++ return ret;
+ }
+
+ spi->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(spi->clk)) {
+ ret = PTR_ERR(spi->clk);
+ dev_err(&pdev->dev, "clk get failed: %d\n", ret);
+- goto err_master_put;
++ return ret;
+ }
+
+ ret = clk_prepare_enable(spi->clk);
+ if (ret) {
+ dev_err(&pdev->dev, "clk enable failed: %d\n", ret);
+- goto err_master_put;
++ return ret;
+ }
+ spi->clk_rate = clk_get_rate(spi->clk);
+ if (!spi->clk_rate) {
+@@ -1949,8 +1947,6 @@ err_dma_release:
+ dma_release_channel(spi->dma_rx);
+ err_clk_disable:
+ clk_disable_unprepare(spi->clk);
+-err_master_put:
+- spi_master_put(master);
+
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From b2f7d7f398d97892e9e7599da0a007bb92cda648 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 18:26:04 +0800
+Subject: spi: tools: make a symbolic link to the header file spi.h
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit bc2e9578baed90f36abe6bb922b9598a327b0555 ]
+
+The header file spi.h in include/uapi/linux/spi is needed for spidev.h,
+so we also need make a symbolic link to it to eliminate the error message
+as below:
+
+In file included from spidev_test.c:24:
+include/linux/spi/spidev.h:28:10: fatal error: linux/spi/spi.h: No such file or directory
+ 28 | #include <linux/spi/spi.h>
+ | ^~~~~~~~~~~~~~~~~
+compilation terminated.
+
+Fixes: f7005142dace ("spi: uapi: unify SPI modes into a single spi.h")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210422102604.3034217-1-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/spi/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/spi/Makefile b/tools/spi/Makefile
+index ada881afb489..0aa6dbd31fb8 100644
+--- a/tools/spi/Makefile
++++ b/tools/spi/Makefile
+@@ -25,11 +25,12 @@ include $(srctree)/tools/build/Makefile.include
+ #
+ # We need the following to be outside of kernel tree
+ #
+-$(OUTPUT)include/linux/spi/spidev.h: ../../include/uapi/linux/spi/spidev.h
++$(OUTPUT)include/linux/spi: ../../include/uapi/linux/spi
+ mkdir -p $(OUTPUT)include/linux/spi 2>&1 || true
+ ln -sf $(CURDIR)/../../include/uapi/linux/spi/spidev.h $@
++ ln -sf $(CURDIR)/../../include/uapi/linux/spi/spi.h $@
+
+-prepare: $(OUTPUT)include/linux/spi/spidev.h
++prepare: $(OUTPUT)include/linux/spi
+
+ #
+ # spidev_test
+--
+2.30.2
+
--- /dev/null
+From f27b19a7d1b7c0439c47b86ce448a8c94cee49bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 15:01:38 +0100
+Subject: staging: comedi: tests: ni_routes_test: Fix compilation error
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+[ Upstream commit 6db58ed2b2d9bb1792eace4f9aa70e8bdd730ffc ]
+
+The `ni_routes_test` module is not currently selectable using the
+Kconfig files, but can be built by specifying `CONFIG_COMEDI_TESTS=m` on
+the "make" command line. It currently fails to compile due to an extra
+parameter added to the `ni_assign_device_routes` function by
+commit e3b7ce73c578 ("staging: comedi: ni_routes: Allow alternate board
+name for routes"). Fix it by supplying the value `NULL` for the added
+`alt_board_name` parameter (which specifies that there is no alternate
+board name).
+
+Fixes: e3b7ce73c578 ("staging: comedi: ni_routes: Allow alternate board name for routes")
+Cc: Spencer E. Olson <olsonse@umich.edu>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20210407140142.447250-2-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/comedi/drivers/tests/ni_routes_test.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/tests/ni_routes_test.c b/drivers/staging/comedi/drivers/tests/ni_routes_test.c
+index 4061b3b5f8e9..68defeb53de4 100644
+--- a/drivers/staging/comedi/drivers/tests/ni_routes_test.c
++++ b/drivers/staging/comedi/drivers/tests/ni_routes_test.c
+@@ -217,7 +217,8 @@ void test_ni_assign_device_routes(void)
+ const u8 *table, *oldtable;
+
+ init_pci_6070e();
+- ni_assign_device_routes(ni_eseries, pci_6070e, &private.routing_tables);
++ ni_assign_device_routes(ni_eseries, pci_6070e, NULL,
++ &private.routing_tables);
+ devroutes = private.routing_tables.valid_routes;
+ table = private.routing_tables.route_values;
+
+@@ -253,7 +254,8 @@ void test_ni_assign_device_routes(void)
+ olddevroutes = devroutes;
+ oldtable = table;
+ init_pci_6220();
+- ni_assign_device_routes(ni_mseries, pci_6220, &private.routing_tables);
++ ni_assign_device_routes(ni_mseries, pci_6220, NULL,
++ &private.routing_tables);
+ devroutes = private.routing_tables.valid_routes;
+ table = private.routing_tables.route_values;
+
+--
+2.30.2
+
--- /dev/null
+From 38ff62c4f096b0e43dec1aa12f418ca40d157bcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 12:23:22 +0200
+Subject: staging: fwserial: fix TIOCGSERIAL implementation
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 5e84a66f3682af4f177bb24bb2ad5135c51f764a ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+The xmit_fifo_size parameter could be used to set the hardware transmit
+fifo size of a legacy UART when it could not be detected, but the
+interface is limited to eight bits and should be left unset when not
+used.
+
+Fix the fwserial implementation by dropping its custom interpretation of
+the unused xmit_fifo_size field, which was overflowed with the driver
+FIFO size. Also leave the type and flags fields unset as these cannot be
+changed.
+
+The close_delay and closing_wait parameters returned by TIOCGSERIAL are
+specified in centiseconds. The driver does not yet support changing
+closing_wait, but let's report back the default value actually used (30
+seconds).
+
+Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407102334.32361-5-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fwserial/fwserial.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
+index 2888b80a2c1a..0f4655d7d520 100644
+--- a/drivers/staging/fwserial/fwserial.c
++++ b/drivers/staging/fwserial/fwserial.c
+@@ -1218,13 +1218,12 @@ static int get_serial_info(struct tty_struct *tty,
+ struct fwtty_port *port = tty->driver_data;
+
+ mutex_lock(&port->port.mutex);
+- ss->type = PORT_UNKNOWN;
+- ss->line = port->port.tty->index;
+- ss->flags = port->port.flags;
+- ss->xmit_fifo_size = FWTTY_PORT_TXFIFO_LEN;
++ ss->line = port->index;
+ ss->baud_base = 400000000;
+ ss->close_delay = jiffies_to_msecs(port->port.close_delay) / 10;
++ ss->closing_wait = 3000;
+ mutex_unlock(&port->port.mutex);
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1cc21907828f978e0b66dd1cac37b5b76212ef45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 12:23:21 +0200
+Subject: staging: fwserial: fix TIOCSSERIAL implementation
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit a7eaaa9d1032e68669bb479496087ba8fc155ab6 ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+A non-privileged user has only ever been able to set the since long
+deprecated ASYNC_SPD flags and trying to change any other *supported*
+feature should result in -EPERM being returned. Setting the current
+values for any supported features should return success.
+
+Fix the fwserial implementation which was returning -EPERM also for a
+privileged user when trying to change certain unsupported parameters,
+and instead return success consistently.
+
+Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407102334.32361-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fwserial/fwserial.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
+index 440d11423812..2888b80a2c1a 100644
+--- a/drivers/staging/fwserial/fwserial.c
++++ b/drivers/staging/fwserial/fwserial.c
+@@ -1234,10 +1234,6 @@ static int set_serial_info(struct tty_struct *tty,
+ struct fwtty_port *port = tty->driver_data;
+ unsigned int cdelay;
+
+- if (ss->irq != 0 || ss->port != 0 || ss->custom_divisor != 0 ||
+- ss->baud_base != 400000000)
+- return -EPERM;
+-
+ cdelay = msecs_to_jiffies(ss->close_delay * 10);
+
+ mutex_lock(&port->port.mutex);
+--
+2.30.2
+
--- /dev/null
+From 0ab77af6e4cf413fb4f57706cfa0c525cd9a616b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 12:23:24 +0200
+Subject: staging: greybus: uart: fix unprivileged TIOCCSERIAL
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 60c6b305c11b5fd167ce5e2ce42f3a9098c388f0 ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+A non-privileged user has only ever been able to set the since long
+deprecated ASYNC_SPD flags and trying to change any other *supported*
+feature should result in -EPERM being returned. Setting the current
+values for any supported features should return success.
+
+Fix the greybus implementation which instead indicated that the
+TIOCSSERIAL ioctl was not even implemented when a non-privileged user
+set the current values.
+
+Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407102334.32361-7-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/uart.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index 29846dc1e1bf..a520f7f213db 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -641,8 +641,6 @@ static int set_serial_info(struct tty_struct *tty,
+ if ((close_delay != gb_tty->port.close_delay) ||
+ (closing_wait != gb_tty->port.closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ gb_tty->port.close_delay = close_delay;
+ gb_tty->port.closing_wait = closing_wait;
+--
+2.30.2
+
--- /dev/null
+From 22550173df8e45994a2b0853d9edac2527428ac2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 18:06:49 +0300
+Subject: staging: qlge: fix an error code in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f7bff017741d98567265ed6a6449311a51810fb6 ]
+
+If alloc_etherdev_mq() fails then return -ENOMEM instead of success.
+The "err = 0;" triggers an unused assignment now so remove that as
+well.
+
+Fixes: 953b94009377 ("staging: qlge: Initialize devlink health dump framework")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YFiyicHI189PXrha@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/qlge/qlge_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/qlge/qlge_main.c b/drivers/staging/qlge/qlge_main.c
+index 5516be3af898..c1d52190e1bd 100644
+--- a/drivers/staging/qlge/qlge_main.c
++++ b/drivers/staging/qlge/qlge_main.c
+@@ -4550,7 +4550,7 @@ static int qlge_probe(struct pci_dev *pdev,
+ struct net_device *ndev = NULL;
+ struct devlink *devlink;
+ static int cards_found;
+- int err = 0;
++ int err;
+
+ devlink = devlink_alloc(&qlge_devlink_ops, sizeof(struct qlge_adapter));
+ if (!devlink)
+@@ -4561,8 +4561,10 @@ static int qlge_probe(struct pci_dev *pdev,
+ ndev = alloc_etherdev_mq(sizeof(struct qlge_netdev_priv),
+ min(MAX_CPUS,
+ netif_get_num_default_rss_queues()));
+- if (!ndev)
++ if (!ndev) {
++ err = -ENOMEM;
+ goto devlink_free;
++ }
+
+ ndev_priv = netdev_priv(ndev);
+ ndev_priv->qdev = qdev;
+--
+2.30.2
+
--- /dev/null
+From 417d612991004f3bbdab71531b0fb60de0d6163b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 16:03:08 +0100
+Subject: staging: rtl8192u: Fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ]
+
+The for-loop iterates with a u8 loop counter i and compares this
+with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum
+that is a u16 type. There is a potential infinite loop if SlotNum
+is larger than the u8 loop counter. Fix this by making the loop
+counter the same type as SlotNum.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192u/r8192U_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index 9fc4adc83d77..b5a313649f44 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -3210,7 +3210,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum,
+ u32 *TotalRxDataNum)
+ {
+ u16 SlotIndex;
+- u8 i;
++ u16 i;
+
+ *TotalRxBcnNum = 0;
+ *TotalRxDataNum = 0;
+--
+2.30.2
+
--- /dev/null
+From 7e78302d81e411c880e0bf02c93bcb54fc0ccaa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:01 +0200
+Subject: tty: actually undefine superseded ASYNC flags
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit d09845e98a05850a8094ea8fd6dd09a8e6824fff ]
+
+Some kernel-internal ASYNC flags have been superseded by tty-port flags
+and should no longer be used by kernel drivers.
+
+Fix the misspelled "__KERNEL__" compile guards which failed their sole
+purpose to break out-of-tree drivers that have not yet been updated.
+
+Fixes: 5c0517fefc92 ("tty: core: Undefine ASYNC_* flags superceded by TTY_PORT* flags")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/tty_flags.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h
+index 900a32e63424..6a3ac496a56c 100644
+--- a/include/uapi/linux/tty_flags.h
++++ b/include/uapi/linux/tty_flags.h
+@@ -39,7 +39,7 @@
+ * WARNING: These flags are no longer used and have been superceded by the
+ * TTY_PORT_ flags in the iflags field (and not userspace-visible)
+ */
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */
+ #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */
+ #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */
+@@ -81,7 +81,7 @@
+ #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI)
+ #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI)
+
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ /* These flags are no longer used (and were always masked from userspace) */
+ #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED)
+ #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE)
+--
+2.30.2
+
--- /dev/null
+From 40bec0686e7dde5ebaa334d3502e3c2c0cf68cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:02 +0200
+Subject: tty: fix return value for unsupported ioctls
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ]
+
+Drivers should return -ENOTTY ("Inappropriate I/O control operation")
+when an ioctl isn't supported, while -EINVAL is used for invalid
+arguments.
+
+Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned
+-EINVAL when a tty driver did not implement the corresponding
+operations.
+
+Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a
+corresponding Fixes tag below.
+
+Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_io.c | 10 +++++-----
+ include/linux/tty_driver.h | 2 +-
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 391bada4cedb..adbcbfa11b29 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2530,14 +2530,14 @@ out:
+ * @p: pointer to result
+ *
+ * Obtain the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+
+ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ {
+- int retval = -EINVAL;
++ int retval = -ENOTTY;
+
+ if (tty->ops->tiocmget) {
+ retval = tty->ops->tiocmget(tty);
+@@ -2555,7 +2555,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ * @p: pointer to desired bits
+ *
+ * Set the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+@@ -2567,7 +2567,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
+ unsigned int set, clear, val;
+
+ if (tty->ops->tiocmset == NULL)
+- return -EINVAL;
++ return -ENOTTY;
+
+ retval = get_user(val, p);
+ if (retval)
+@@ -2607,7 +2607,7 @@ int tty_get_icount(struct tty_struct *tty,
+ if (tty->ops->get_icount)
+ return tty->ops->get_icount(tty, icount);
+ else
+- return -EINVAL;
++ return -ENOTTY;
+ }
+ EXPORT_SYMBOL_GPL(tty_get_icount);
+
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index 61c3372d3f32..2f719b471d52 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -228,7 +228,7 @@
+ *
+ * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
+ * structure to complete. This method is optional and will only be called
+- * if provided (otherwise EINVAL will be returned).
++ * if provided (otherwise ENOTTY will be returned).
+ */
+
+ #include <linux/export.h>
+--
+2.30.2
+
--- /dev/null
+From ef8f219dded645a205a2b177908d49beecc5aed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:03 +0200
+Subject: tty: fix return value for unsupported termiox ioctls
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 8871de06ff78e9333d86c87d7071452b690e7c9b ]
+
+Drivers should return -ENOTTY ("Inappropriate I/O control operation")
+when an ioctl isn't supported, while -EINVAL is used for invalid
+arguments.
+
+Support for termiox was added by commit 1d65b4a088de ("tty: Add
+termiox") in 2008 but no driver support ever followed and it was
+recently ripped out by commit e0efb3168d34 ("tty: Remove dead termiox
+code").
+
+Fix the return value for the unsupported termiox ioctls, which have
+always returned -EINVAL, by explicitly returning -ENOTTY rather than
+removing them completely and falling back to the default unrecognised-
+ioctl handling.
+
+Fixes: 1d65b4a088de ("tty: Add termiox")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
+index 4de1c6ddb8ff..803da2d111c8 100644
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -774,8 +774,8 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
+ case TCSETX:
+ case TCSETXW:
+ case TCSETXF:
+- return -EINVAL;
+-#endif
++ return -ENOTTY;
++#endif
+ case TIOCGSOFTCAR:
+ copy_termios(real_tty, &kterm);
+ ret = put_user((kterm.c_cflag & CLOCAL) ? 1 : 0,
+--
+2.30.2
+
--- /dev/null
+From 25719c3666913b7f817b631af3791f3714b0e1f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 09:22:22 +0900
+Subject: ttyprintk: Add TTY hangup callback.
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ]
+
+syzbot is reporting hung task due to flood of
+
+ tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
+ port->count);
+
+message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
+decrementing port->count due to tty_hung_up_p() == true.
+
+----------
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+ int i;
+ int fd[10];
+
+ for (i = 0; i < 10; i++)
+ fd[i] = open("/dev/ttyprintk", O_WRONLY);
+ ioctl(fd[0], TIOCVHANGUP);
+ for (i = 0; i < 10; i++)
+ close(fd[i]);
+ close(open("/dev/ttyprintk", O_WRONLY));
+ return 0;
+}
+----------
+
+When TTY hangup happens, port->count needs to be reset via
+"struct tty_operations"->hangup callback.
+
+[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
+
+Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
+Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com>
+Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
+Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ttyprintk.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
+index 6a0059e508e3..93f5d11c830b 100644
+--- a/drivers/char/ttyprintk.c
++++ b/drivers/char/ttyprintk.c
+@@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
+ return 0;
+ }
+
++/*
++ * TTY operations hangup function.
++ */
++static void tpk_hangup(struct tty_struct *tty)
++{
++ struct ttyprintk_port *tpkp = tty->driver_data;
++
++ tty_port_hangup(&tpkp->port);
++}
++
+ static const struct tty_operations ttyprintk_ops = {
+ .open = tpk_open,
+ .close = tpk_close,
+ .write = tpk_write,
+ .write_room = tpk_write_room,
+ .ioctl = tpk_ioctl,
++ .hangup = tpk_hangup,
+ };
+
+ static const struct tty_port_operations null_ops = { };
+--
+2.30.2
+
--- /dev/null
+From 868979f5fdf5ced4479cbff104768529426d572c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 12:28:52 +0200
+Subject: udp: never accept GSO_FRAGLIST packets
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 78352f73dc5047f3f744764cc45912498c52f3c9 ]
+
+Currently the UDP protocol delivers GSO_FRAGLIST packets to
+the sockets without the expected segmentation.
+
+This change addresses the issue introducing and maintaining
+a couple of new fields to explicitly accept SKB_GSO_UDP_L4
+or GSO_FRAGLIST packets. Additionally updates udp_unexpected_gso()
+accordingly.
+
+UDP sockets enabling UDP_GRO stil keep accept_udp_fraglist
+zeroed.
+
+v1 -> v2:
+ - use 2 bits instead of a whole GSO bitmask (Willem)
+
+Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/udp.h | 16 +++++++++++++---
+ net/ipv4/udp.c | 3 +++
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/udp.h b/include/linux/udp.h
+index aa84597bdc33..ae58ff3b6b5b 100644
+--- a/include/linux/udp.h
++++ b/include/linux/udp.h
+@@ -51,7 +51,9 @@ struct udp_sock {
+ * different encapsulation layer set
+ * this
+ */
+- gro_enabled:1; /* Can accept GRO packets */
++ gro_enabled:1, /* Request GRO aggregation */
++ accept_udp_l4:1,
++ accept_udp_fraglist:1;
+ /*
+ * Following member retains the information to create a UDP header
+ * when the socket is uncorked.
+@@ -131,8 +133,16 @@ static inline void udp_cmsg_recv(struct msghdr *msg, struct sock *sk,
+
+ static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb)
+ {
+- return !udp_sk(sk)->gro_enabled && skb_is_gso(skb) &&
+- skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4;
++ if (!skb_is_gso(skb))
++ return false;
++
++ if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && !udp_sk(sk)->accept_udp_l4)
++ return true;
++
++ if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST && !udp_sk(sk)->accept_udp_fraglist)
++ return true;
++
++ return false;
+ }
+
+ #define udp_portaddr_for_each_entry(__sk, list) \
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 99d743eb9dc4..c586a6bb8c6d 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2664,9 +2664,12 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
+
+ case UDP_GRO:
+ lock_sock(sk);
++
++ /* when enabling GRO, accept the related GSO packet type */
+ if (valbool)
+ udp_tunnel_encap_enable(sk->sk_socket);
+ up->gro_enabled = valbool;
++ up->accept_udp_l4 = valbool;
+ release_sock(sk);
+ break;
+
+--
+2.30.2
+
--- /dev/null
+From f1482c161324c8522031f7ce0700790653230706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 12:28:50 +0200
+Subject: udp: skip L4 aggregation for UDP tunnel packets
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 18f25dc399901426dff61e676ba603ff52c666f7 ]
+
+If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there
+are UDP tunnels available in the system, udp_gro_receive() could end-up
+doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at
+the outer UDP tunnel level for packets effectively carrying and UDP
+tunnel header.
+
+That could cause inner protocol corruption. If e.g. the relevant
+packets carry a vxlan header, different vxlan ids will be ignored/
+aggregated to the same GSO packet. Inner headers will be ignored, too,
+so that e.g. TCP over vxlan push packets will be held in the GRO
+engine till the next flush, etc.
+
+Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the
+current packet could land in a UDP tunnel, and let udp_gro_receive()
+do GRO via udp_sk(sk)->gro_receive.
+
+The check implemented in this patch is broader than what is strictly
+needed, as the existing UDP tunnel could be e.g. configured on top of
+a different device: we could end-up skipping GRO at-all for some packets.
+
+Anyhow, that is a very thin corner case and covering it will add quite
+a bit of complexity.
+
+v1 -> v2:
+ - hopefully clarify the commit message
+
+Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
+Fixes: 36707061d6ba ("udp: allow forwarding of plain (non-fraglisted) UDP GRO packets")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_offload.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index c5b4b586570f..25134a3548e9 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -515,21 +515,24 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
+ unsigned int off = skb_gro_offset(skb);
+ int flush = 1;
+
++ /* we can do L4 aggregation only if the packet can't land in a tunnel
++ * otherwise we could corrupt the inner stream
++ */
+ NAPI_GRO_CB(skb)->is_flist = 0;
+- if (skb->dev->features & NETIF_F_GRO_FRAGLIST)
+- NAPI_GRO_CB(skb)->is_flist = sk ? !udp_sk(sk)->gro_enabled: 1;
++ if (!sk || !udp_sk(sk)->gro_receive) {
++ if (skb->dev->features & NETIF_F_GRO_FRAGLIST)
++ NAPI_GRO_CB(skb)->is_flist = sk ? !udp_sk(sk)->gro_enabled : 1;
+
+- if ((!sk && (skb->dev->features & NETIF_F_GRO_UDP_FWD)) ||
+- (sk && udp_sk(sk)->gro_enabled) || NAPI_GRO_CB(skb)->is_flist) {
+- pp = call_gro_receive(udp_gro_receive_segment, head, skb);
++ if ((!sk && (skb->dev->features & NETIF_F_GRO_UDP_FWD)) ||
++ (sk && udp_sk(sk)->gro_enabled) || NAPI_GRO_CB(skb)->is_flist)
++ pp = call_gro_receive(udp_gro_receive_segment, head, skb);
+ return pp;
+ }
+
+- if (!sk || NAPI_GRO_CB(skb)->encap_mark ||
++ if (NAPI_GRO_CB(skb)->encap_mark ||
+ (uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
+ NAPI_GRO_CB(skb)->csum_cnt == 0 &&
+- !NAPI_GRO_CB(skb)->csum_valid) ||
+- !udp_sk(sk)->gro_receive)
++ !NAPI_GRO_CB(skb)->csum_valid))
+ goto out;
+
+ /* mark that this skb passed once through the tunnel gro layer */
+--
+2.30.2
+
--- /dev/null
+From 0eb45e6f8151ef5bbcc9f37a12c3ae9cd07b4090 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 15:16:02 +0200
+Subject: USB: cdc-acm: fix TIOCGSERIAL implementation
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 496960274153bdeb9d1f904ff1ea875cef8232c1 ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+The xmit_fifo_size parameter could be used to set the hardware transmit
+fifo size of a legacy UART when it could not be detected, but the
+interface is limited to eight bits and should be left unset when it is
+not used.
+
+Similarly, baud_base could be used to set the UART base clock when it
+could not be detected, but might as well be left unset when it is not
+known (which is the case for CDC).
+
+Fix the cdc-acm TIOCGSERIAL implementation by dropping its custom
+interpretation of the unused xmit_fifo_size and baud_base fields, which
+overflowed the former with the URB buffer size and set the latter to the
+current line speed. Also return the port line number, which is the only
+other value used besides the close parameters.
+
+Note that the current line speed can still be retrieved through the
+standard termios interfaces.
+
+Fixes: 18c75720e667 ("USB: allow users to run setserial with cdc-acm")
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210408131602.27956-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index b57cbdf4ff9f..c103961c3fae 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -929,8 +929,7 @@ static int get_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ {
+ struct acm *acm = tty->driver_data;
+
+- ss->xmit_fifo_size = acm->writesize;
+- ss->baud_base = le32_to_cpu(acm->line.dwDTERate);
++ ss->line = acm->minor;
+ ss->close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
+ ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ ASYNC_CLOSING_WAIT_NONE :
+--
+2.30.2
+
--- /dev/null
+From d88aee2f30040ecbffc7a8c43ac2f67f6b62ad26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 15:16:01 +0200
+Subject: USB: cdc-acm: fix unprivileged TIOCCSERIAL
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+A non-privileged user has only ever been able to set the since long
+deprecated ASYNC_SPD flags and trying to change any other *supported*
+feature should result in -EPERM being returned. Setting the current
+values for any supported features should return success.
+
+Fix the cdc-acm implementation which instead indicated that the
+TIOCSSERIAL ioctl was not even implemented when a non-privileged user
+set the current values.
+
+Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)")
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 473b64ebc45f..b57cbdf4ff9f 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -955,8 +955,6 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ if ((close_delay != acm->port.close_delay) ||
+ (closing_wait != acm->port.closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ acm->port.close_delay = close_delay;
+ acm->port.closing_wait = closing_wait;
+--
+2.30.2
+
--- /dev/null
+From 8603723e4892af572a5e649fa6af1dce7878bd05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 08:36:29 +0200
+Subject: usb: cdnsp: Fixes issue with Configure Endpoint command
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+[ Upstream commit 10076de33b5ed5b1e049593a611d2fd9eba60565 ]
+
+Patch adds flag EP_UNCONFIGURED to detect whether endpoint was
+unconfigured. This flag is set in cdnsp_reset_device after Reset Device
+command. Among others this command disables all non control endpoints.
+Flag is used in cdnsp_gadget_ep_disable to protect controller against
+invoking Configure Endpoint command on disabled endpoint. Lack of this
+protection in some cases caused that Configure Endpoint command completed
+with Context State Error code completion.
+
+Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 17 ++++++++++++-----
+ drivers/usb/cdns3/cdnsp-gadget.h | 1 +
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index d7d4bdd57f46..56707b6b0f57 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -727,7 +727,7 @@ int cdnsp_reset_device(struct cdnsp_device *pdev)
+ * are in Disabled state.
+ */
+ for (i = 1; i < CDNSP_ENDPOINTS_NUM; ++i)
+- pdev->eps[i].ep_state |= EP_STOPPED;
++ pdev->eps[i].ep_state |= EP_STOPPED | EP_UNCONFIGURED;
+
+ trace_cdnsp_handle_cmd_reset_dev(slot_ctx);
+
+@@ -942,6 +942,7 @@ static int cdnsp_gadget_ep_enable(struct usb_ep *ep,
+
+ pep = to_cdnsp_ep(ep);
+ pdev = pep->pdev;
++ pep->ep_state &= ~EP_UNCONFIGURED;
+
+ if (dev_WARN_ONCE(pdev->dev, pep->ep_state & EP_ENABLED,
+ "%s is already enabled\n", pep->name))
+@@ -1023,9 +1024,13 @@ static int cdnsp_gadget_ep_disable(struct usb_ep *ep)
+ goto finish;
+ }
+
+- cdnsp_cmd_stop_ep(pdev, pep);
+ pep->ep_state |= EP_DIS_IN_RROGRESS;
+- cdnsp_cmd_flush_ep(pdev, pep);
++
++ /* Endpoint was unconfigured by Reset Device command. */
++ if (!(pep->ep_state & EP_UNCONFIGURED)) {
++ cdnsp_cmd_stop_ep(pdev, pep);
++ cdnsp_cmd_flush_ep(pdev, pep);
++ }
+
+ /* Remove all queued USB requests. */
+ while (!list_empty(&pep->pending_list)) {
+@@ -1043,10 +1048,12 @@ static int cdnsp_gadget_ep_disable(struct usb_ep *ep)
+
+ cdnsp_endpoint_zero(pdev, pep);
+
+- ret = cdnsp_update_eps_configuration(pdev, pep);
++ if (!(pep->ep_state & EP_UNCONFIGURED))
++ ret = cdnsp_update_eps_configuration(pdev, pep);
++
+ cdnsp_free_endpoint_rings(pdev, pep);
+
+- pep->ep_state &= ~EP_ENABLED;
++ pep->ep_state &= ~(EP_ENABLED | EP_UNCONFIGURED);
+ pep->ep_state |= EP_STOPPED;
+
+ finish:
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h
+index 6bbb26548c04..783ca8ffde00 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.h
++++ b/drivers/usb/cdns3/cdnsp-gadget.h
+@@ -835,6 +835,7 @@ struct cdnsp_ep {
+ #define EP_WEDGE BIT(4)
+ #define EP0_HALTED_STATUS BIT(5)
+ #define EP_HAS_STREAMS BIT(6)
++#define EP_UNCONFIGURED BIT(7)
+
+ bool skip;
+ };
+--
+2.30.2
+
--- /dev/null
+From c54fbaa738927f3a7276509eca8fb16bf808cc88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 16:47:14 +0400
+Subject: usb: dwc2: Fix hibernation between host and device modes.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+[ Upstream commit 24d209dba5a3959b2ebde7cf3ad40c8015e814cf ]
+
+When core is in hibernation in host mode and a device cable
+was connected then driver exited from device hibernation.
+However, registers saved for host mode and when exited from
+device hibernation register restore would be done for device
+register which was wrong because there was no device registers
+stored to restore.
+
+- Added dwc_handle_gpwrdn_disc_det() function which handles
+ gpwrdn disconnect detect flow and exits hibernation
+ without restoring the registers.
+- Updated exiting from hibernation in GPWRDN_STS_CHGINT with
+ calling dwc_handle_gpwrdn_disc_det() function. Here no register
+ is restored which is the solution described above.
+
+Fixes: 65c9c4c6b01f ("usb: dwc2: Add dwc2_handle_gpwrdn_intr() handler")
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210416124715.75355A005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/core_intr.c | 154 +++++++++++++++++++----------------
+ 1 file changed, 83 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index 800c8b6c55ff..510fd0572feb 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -660,6 +660,71 @@ static u32 dwc2_read_common_intr(struct dwc2_hsotg *hsotg)
+ return 0;
+ }
+
++/**
++ * dwc_handle_gpwrdn_disc_det() - Handles the gpwrdn disconnect detect.
++ * Exits hibernation without restoring registers.
++ *
++ * @hsotg: Programming view of DWC_otg controller
++ * @gpwrdn: GPWRDN register
++ */
++static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg,
++ u32 gpwrdn)
++{
++ u32 gpwrdn_tmp;
++
++ /* Switch-on voltage to the core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable Power Down Clamp */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Deassert reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable PMU interrupt */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ /* De-assert Wakeup Logic */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUACTV;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ hsotg->hibernated = 0;
++ hsotg->bus_suspended = 0;
++
++ if (gpwrdn & GPWRDN_IDSTS) {
++ hsotg->op_state = OTG_STATE_B_PERIPHERAL;
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hsotg_core_init_disconnected(hsotg, false);
++ dwc2_hsotg_core_connect(hsotg);
++ } else {
++ hsotg->op_state = OTG_STATE_A_HOST;
++
++ /* Initialize the Core for Host mode */
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hcd_start(hsotg);
++ }
++}
++
+ /*
+ * GPWRDN interrupt handler.
+ *
+@@ -681,64 +746,14 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+
+ if ((gpwrdn & GPWRDN_DISCONN_DET) &&
+ (gpwrdn & GPWRDN_DISCONN_DET_MSK) && !linestate) {
+- u32 gpwrdn_tmp;
+-
+ dev_dbg(hsotg->dev, "%s: GPWRDN_DISCONN_DET\n", __func__);
+-
+- /* Switch-on voltage to the core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable Power Down Clamp */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Deassert reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable PMU interrupt */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- /* De-assert Wakeup Logic */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUACTV;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- hsotg->hibernated = 0;
+-
+- if (gpwrdn & GPWRDN_IDSTS) {
+- hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hsotg_core_init_disconnected(hsotg, false);
+- dwc2_hsotg_core_connect(hsotg);
+- } else {
+- hsotg->op_state = OTG_STATE_A_HOST;
+-
+- /* Initialize the Core for Host mode */
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hcd_start(hsotg);
+- }
+- }
+-
+- if ((gpwrdn & GPWRDN_LNSTSCHG) &&
+- (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
++ /*
++ * Call disconnect detect function to exit from
++ * hibernation
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
++ } else if ((gpwrdn & GPWRDN_LNSTSCHG) &&
++ (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_LNSTSCHG\n", __func__);
+ if (hsotg->hw_params.hibernation &&
+ hsotg->hibernated) {
+@@ -749,24 +764,21 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+ dwc2_exit_hibernation(hsotg, 1, 0, 1);
+ }
+ }
+- }
+- if ((gpwrdn & GPWRDN_RST_DET) && (gpwrdn & GPWRDN_RST_DET_MSK)) {
++ } else if ((gpwrdn & GPWRDN_RST_DET) &&
++ (gpwrdn & GPWRDN_RST_DET_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_RST_DET\n", __func__);
+ if (!linestate && (gpwrdn & GPWRDN_BSESSVLD))
+ dwc2_exit_hibernation(hsotg, 0, 1, 0);
+- }
+- if ((gpwrdn & GPWRDN_STS_CHGINT) &&
+- (gpwrdn & GPWRDN_STS_CHGINT_MSK) && linestate) {
++ } else if ((gpwrdn & GPWRDN_STS_CHGINT) &&
++ (gpwrdn & GPWRDN_STS_CHGINT_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_STS_CHGINT\n", __func__);
+- if (hsotg->hw_params.hibernation &&
+- hsotg->hibernated) {
+- if (gpwrdn & GPWRDN_IDSTS) {
+- dwc2_exit_hibernation(hsotg, 0, 0, 0);
+- call_gadget(hsotg, resume);
+- } else {
+- dwc2_exit_hibernation(hsotg, 1, 0, 1);
+- }
+- }
++ /*
++ * As GPWRDN_STS_CHGINT exit from hibernation flow is
++ * the same as in GPWRDN_DISCONN_DET flow. Call
++ * disconnect detect helper function to exit from
++ * hibernation.
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9689afad5f0a033a0df3357889bcf107e71f3117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 16:47:06 +0400
+Subject: usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+[ Upstream commit c2db8d7b9568b10e014af83b3c15e39929e3579e ]
+
+Added setting "port_connect_status_change" flag to "1" in order
+to re-enumerate, because after exit from hibernation port
+connection status is not detected.
+
+Fixes: c5c403dc4336 ("usb: dwc2: Add host/device hibernation functions")
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210416124707.5EEC2A005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 1a9789ec5847..6af1dcbc3656 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5580,7 +5580,15 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup,
+ return ret;
+ }
+
+- dwc2_hcd_rem_wakeup(hsotg);
++ if (rem_wakeup) {
++ dwc2_hcd_rem_wakeup(hsotg);
++ /*
++ * Change "port_connect_status_change" flag to re-enumerate,
++ * because after exit from hibernation port connection status
++ * is not detected.
++ */
++ hsotg->flags.b.port_connect_status_change = 1;
++ }
+
+ hsotg->hibernated = 0;
+ hsotg->bus_suspended = 0;
+--
+2.30.2
+
--- /dev/null
+From 919317b27125d53c4ebb62e93cc216f6212c1e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 21:58:31 -0700
+Subject: usb: gadget: aspeed: fix dma map failure
+
+From: Tao Ren <rentao.bupt@gmail.com>
+
+[ Upstream commit bd4d607044b961cecbf8c4c2f3bb5da4fb156993 ]
+
+Currently the virtual port_dev device is passed to DMA API, and this is
+wrong because the device passed to DMA API calls must be the actual
+hardware device performing the DMA.
+
+The patch replaces usb_gadget_map_request/usb_gadget_unmap_request APIs
+with usb_gadget_map_request_by_dev/usb_gadget_unmap_request_by_dev APIs
+so the DMA capable platform device can be passed to the DMA APIs.
+
+The patch fixes below backtrace detected on Facebook AST2500 OpenBMC
+platforms:
+
+[<80106550>] show_stack+0x20/0x24
+[<80106868>] dump_stack+0x28/0x30
+[<80823540>] __warn+0xfc/0x110
+[<8011ac30>] warn_slowpath_fmt+0xb0/0xc0
+[<8011ad44>] dma_map_page_attrs+0x24c/0x314
+[<8016a27c>] usb_gadget_map_request_by_dev+0x100/0x1e4
+[<805cedd8>] usb_gadget_map_request+0x1c/0x20
+[<805cefbc>] ast_vhub_epn_queue+0xa0/0x1d8
+[<7f02f710>] usb_ep_queue+0x48/0xc4
+[<805cd3e8>] ecm_do_notify+0xf8/0x248
+[<7f145920>] ecm_set_alt+0xc8/0x1d0
+[<7f145c34>] composite_setup+0x680/0x1d30
+[<7f00deb8>] ast_vhub_ep0_handle_setup+0xa4/0x1bc
+[<7f02ee94>] ast_vhub_dev_irq+0x58/0x84
+[<7f0309e0>] ast_vhub_irq+0xb0/0x1c8
+[<7f02e118>] __handle_irq_event_percpu+0x50/0x19c
+[<8015e5bc>] handle_irq_event_percpu+0x38/0x8c
+[<8015e758>] handle_irq_event+0x38/0x4c
+
+Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
+Link: https://lore.kernel.org/r/20210331045831.28700-1-rentao.bupt@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/aspeed-vhub/core.c | 3 ++-
+ drivers/usb/gadget/udc/aspeed-vhub/epn.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/core.c b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+index be7bb64e3594..d11d3d14313f 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/core.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+@@ -36,6 +36,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+ int status)
+ {
+ bool internal = req->internal;
++ struct ast_vhub *vhub = ep->vhub;
+
+ EPVDBG(ep, "completing request @%p, status %d\n", req, status);
+
+@@ -46,7 +47,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+
+ if (req->req.dma) {
+ if (!WARN_ON(!ep->dev))
+- usb_gadget_unmap_request(&ep->dev->gadget,
++ usb_gadget_unmap_request_by_dev(&vhub->pdev->dev,
+ &req->req, ep->epn.is_in);
+ req->req.dma = 0;
+ }
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+index 02d8bfae58fb..cb164c615e6f 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -376,7 +376,7 @@ static int ast_vhub_epn_queue(struct usb_ep* u_ep, struct usb_request *u_req,
+ if (ep->epn.desc_mode ||
+ ((((unsigned long)u_req->buf & 7) == 0) &&
+ (ep->epn.is_in || !(u_req->length & (u_ep->maxpacket - 1))))) {
+- rc = usb_gadget_map_request(&ep->dev->gadget, u_req,
++ rc = usb_gadget_map_request_by_dev(&vhub->pdev->dev, u_req,
+ ep->epn.is_in);
+ if (rc) {
+ dev_warn(&vhub->pdev->dev,
+--
+2.30.2
+
--- /dev/null
+From b8342ca41a583f6278778e9fe56b9e1059d1eebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:22 +0200
+Subject: usb: gadget: pch_udc: Check for DMA mapping error
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ]
+
+DMA mapping might fail, we have to check it with dma_mapping_error().
+Otherwise DMA-API is not happy:
+
+ DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single]
+
+Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index b46e9bdc720f..29e89ed6aad5 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -2955,7 +2955,7 @@ static int init_dma_pools(struct pch_udc_dev *dev)
+ dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf,
+ UDC_EP0OUT_BUFF_SIZE * 4,
+ DMA_FROM_DEVICE);
+- return 0;
++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr);
+ }
+
+ static int pch_udc_start(struct usb_gadget *g,
+--
+2.30.2
+
--- /dev/null
+From fd104f43ae614e3fcfaca52e6c2f1f5aeb507a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:21 +0200
+Subject: usb: gadget: pch_udc: Check if driver is present before calling
+ ->setup()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ]
+
+Since we have a separate routine for VBUS sense, the interrupt may occur
+before gadget driver is present. Hence, ->setup() call may oops the kernel:
+
+[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010
+...
+[ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f
+...
+[ 55.245843] <IRQ>
+[ 55.245843] ? pch_udc_svc_data_out+0x160/0x160
+
+Check if driver is present before calling ->setup().
+
+Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index f6f8965c4f8c..b46e9bdc720f 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -2307,6 +2307,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
+ pch_udc_set_dma(dev, DMA_DIR_RX);
+ }
+
++static int pch_udc_gadget_setup(struct pch_udc_dev *dev)
++ __must_hold(&dev->lock)
++{
++ int rc;
++
++ /* In some cases we can get an interrupt before driver gets setup */
++ if (!dev->driver)
++ return -ESHUTDOWN;
++
++ spin_unlock(&dev->lock);
++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data);
++ spin_lock(&dev->lock);
++ return rc;
++}
++
+ /**
+ * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts
+ * @dev: Reference to the device structure
+@@ -2378,15 +2393,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
+ dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
+ else /* OUT */
+ dev->gadget.ep0 = &ep->ep;
+- spin_lock(&dev->lock);
+ /* If Mass storage Reset */
+ if ((dev->setup_data.bRequestType == 0x21) &&
+ (dev->setup_data.bRequest == 0xFF))
+ dev->prot_stall = 0;
+ /* call gadget with setup data received */
+- setup_supported = dev->driver->setup(&dev->gadget,
+- &dev->setup_data);
+- spin_unlock(&dev->lock);
++ setup_supported = pch_udc_gadget_setup(dev);
+
+ if (dev->setup_data.bRequestType & USB_DIR_IN) {
+ ep->td_data->status = (ep->td_data->status &
+@@ -2634,9 +2646,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
+ dev->ep[i].halted = 0;
+ }
+ dev->stall = 0;
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+@@ -2671,9 +2681,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
+ dev->stall = 0;
+
+ /* call gadget zero with setup data received */
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 96ea8d45d66bb0f983e882bcfc25e42035057c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:25 +0200
+Subject: usb: gadget: pch_udc: Initialize device pointer before use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 971d080212be4ce2b91047d25a657f46d3e39635 ]
+
+During conversion to use GPIO descriptors the device pointer,
+which is applied to devm_gpiod_get(), is not yet initialized.
+
+Move initialization in the ->probe() in order to have it set before use.
+
+Fixes: e20849a8c883 ("usb: gadget: pch_udc: Convert to use GPIO descriptors")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-6-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 29e89ed6aad5..a39122f01cdb 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -1369,6 +1369,7 @@ static irqreturn_t pch_vbus_gpio_irq(int irq, void *data)
+ */
+ static int pch_vbus_gpio_init(struct pch_udc_dev *dev)
+ {
++ struct device *d = &dev->pdev->dev;
+ int err;
+ int irq_num = 0;
+ struct gpio_desc *gpiod;
+@@ -1377,7 +1378,7 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev)
+ dev->vbus_gpio.intr = 0;
+
+ /* Retrieve the GPIO line from the USB gadget device */
+- gpiod = devm_gpiod_get(dev->gadget.dev.parent, NULL, GPIOD_IN);
++ gpiod = devm_gpiod_get(d, NULL, GPIOD_IN);
+ if (IS_ERR(gpiod))
+ return PTR_ERR(gpiod);
+ gpiod_set_consumer_name(gpiod, "pch_vbus");
+@@ -3080,6 +3081,7 @@ static int pch_udc_probe(struct pci_dev *pdev,
+ if (retval)
+ return retval;
+
++ dev->pdev = pdev;
+ pci_set_drvdata(pdev, dev);
+
+ /* Determine BAR based on PCI ID */
+@@ -3121,7 +3123,6 @@ static int pch_udc_probe(struct pci_dev *pdev,
+
+ /* device struct setup */
+ spin_lock_init(&dev->lock);
+- dev->pdev = pdev;
+ dev->gadget.ops = &pch_udc_ops;
+
+ retval = init_dma_pools(dev);
+--
+2.30.2
+
--- /dev/null
+From 3bda6a99bdd74544273cf69fbb485cb1475895c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:26 +0200
+Subject: usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard
+ (v1)
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 049d3db625a652e23488db88b6104de4d5b62f16 ]
+
+Intel Minnowboard (v1) uses SCH GPIO line SUS7 (i.e. 12)
+for VBUS sense. Provide a DMI based quirk to have it's being used.
+
+Fixes: e20849a8c883 ("usb: gadget: pch_udc: Convert to use GPIO descriptors")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-7-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 71 +++++++++++++++++++++++++-------
+ 1 file changed, 57 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index a39122f01cdb..fd3656d0f760 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -7,12 +7,14 @@
+ #include <linux/module.h>
+ #include <linux/pci.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/errno.h>
++#include <linux/gpio/consumer.h>
++#include <linux/gpio/machine.h>
+ #include <linux/list.h>
+ #include <linux/interrupt.h>
+ #include <linux/usb/ch9.h>
+ #include <linux/usb/gadget.h>
+-#include <linux/gpio/consumer.h>
+ #include <linux/irq.h>
+
+ #define PCH_VBUS_PERIOD 3000 /* VBUS polling period (msec) */
+@@ -1359,6 +1361,43 @@ static irqreturn_t pch_vbus_gpio_irq(int irq, void *data)
+ return IRQ_HANDLED;
+ }
+
++static struct gpiod_lookup_table minnowboard_udc_gpios = {
++ .dev_id = "0000:02:02.4",
++ .table = {
++ GPIO_LOOKUP("sch_gpio.33158", 12, NULL, GPIO_ACTIVE_HIGH),
++ {}
++ },
++};
++
++static const struct dmi_system_id pch_udc_gpio_dmi_table[] = {
++ {
++ .ident = "MinnowBoard",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "MinnowBoard"),
++ },
++ .driver_data = &minnowboard_udc_gpios,
++ },
++ { }
++};
++
++static void pch_vbus_gpio_remove_table(void *table)
++{
++ gpiod_remove_lookup_table(table);
++}
++
++static int pch_vbus_gpio_add_table(struct pch_udc_dev *dev)
++{
++ struct device *d = &dev->pdev->dev;
++ const struct dmi_system_id *dmi;
++
++ dmi = dmi_first_match(pch_udc_gpio_dmi_table);
++ if (!dmi)
++ return 0;
++
++ gpiod_add_lookup_table(dmi->driver_data);
++ return devm_add_action_or_reset(d, pch_vbus_gpio_remove_table, dmi->driver_data);
++}
++
+ /**
+ * pch_vbus_gpio_init() - This API initializes GPIO port detecting VBUS.
+ * @dev: Reference to the driver structure
+@@ -1377,8 +1416,12 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev)
+ dev->vbus_gpio.port = NULL;
+ dev->vbus_gpio.intr = 0;
+
++ err = pch_vbus_gpio_add_table(dev);
++ if (err)
++ return err;
++
+ /* Retrieve the GPIO line from the USB gadget device */
+- gpiod = devm_gpiod_get(d, NULL, GPIOD_IN);
++ gpiod = devm_gpiod_get_optional(d, NULL, GPIOD_IN);
+ if (IS_ERR(gpiod))
+ return PTR_ERR(gpiod);
+ gpiod_set_consumer_name(gpiod, "pch_vbus");
+@@ -2888,14 +2931,20 @@ static void pch_udc_pcd_reinit(struct pch_udc_dev *dev)
+ * @dev: Reference to the driver structure
+ *
+ * Return codes:
+- * 0: Success
++ * 0: Success
++ * -%ERRNO: All kind of errors when retrieving VBUS GPIO
+ */
+ static int pch_udc_pcd_init(struct pch_udc_dev *dev)
+ {
++ int ret;
++
+ pch_udc_init(dev);
+ pch_udc_pcd_reinit(dev);
+- pch_vbus_gpio_init(dev);
+- return 0;
++
++ ret = pch_vbus_gpio_init(dev);
++ if (ret)
++ pch_udc_exit(dev);
++ return ret;
+ }
+
+ /**
+@@ -3097,16 +3146,10 @@ static int pch_udc_probe(struct pci_dev *pdev,
+
+ dev->base_addr = pcim_iomap_table(pdev)[bar];
+
+- /*
+- * FIXME: add a GPIO descriptor table to pdev.dev using
+- * gpiod_add_descriptor_table() from <linux/gpio/machine.h> based on
+- * the PCI subsystem ID. The system-dependent GPIO is necessary for
+- * VBUS operation.
+- */
+-
+ /* initialize the hardware */
+- if (pch_udc_pcd_init(dev))
+- return -ENODEV;
++ retval = pch_udc_pcd_init(dev);
++ if (retval)
++ return retval;
+
+ pci_enable_msi(pdev);
+
+--
+2.30.2
+
--- /dev/null
+From 02790856d092fc0397f37db5ea5c84c7ec92b5bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:20 +0200
+Subject: usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ]
+
+Either way ~0 will be in the correct byte order, hence
+replace cpu_to_le32() by lower_32_bits(). Moreover,
+it makes sparse happy, otherwise it complains:
+
+.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types)
+.../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr
+.../pch_udc.c:1813:27: got restricted __le32 [usertype]
+
+Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 931a09fdbf6d..f6f8965c4f8c 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -1765,7 +1765,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep,
+ }
+ /* prevent from using desc. - set HOST BUSY */
+ dma_desc->status |= PCH_UDC_BS_HST_BSY;
+- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID);
++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID);
+ req->td_data = dma_desc;
+ req->td_data_last = dma_desc;
+ req->chain_len = 1;
+--
+2.30.2
+
--- /dev/null
+From 6078e7406f92bbe22cd0dd09a92aa3011ddf6599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 19:45:10 +0100
+Subject: usb: gadget: r8a66597: Add missing null check on return from
+ platform_get_resource
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ]
+
+The call to platform_get_resource can potentially return a NULL pointer
+on failure, so add this check and return -EINVAL if it fails.
+
+Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Addresses-Coverity: ("Dereference null return")
+Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
+index 896c1a016d55..65cae4883454 100644
+--- a/drivers/usb/gadget/udc/r8a66597-udc.c
++++ b/drivers/usb/gadget/udc/r8a66597-udc.c
+@@ -1849,6 +1849,8 @@ static int r8a66597_probe(struct platform_device *pdev)
+ return PTR_ERR(reg);
+
+ ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++ if (!ires)
++ return -EINVAL;
+ irq = ires->start;
+ irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
+
+--
+2.30.2
+
--- /dev/null
+From 7af15df09899971584674888640273a23120eb2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 08:36:50 +0100
+Subject: usb: gadget: s3c: Fix incorrect resources releasing
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 42067ccd9eb2077979ac3ce8b7b95c694bd09e14 ]
+
+Since commit 188db4435ac6 ("usb: gadget: s3c: use platform resources"),
+'request_mem_region()' and 'ioremap()' are no more used, so they don't need
+to be undone in the error handling path of the probe and in the remove
+function.
+
+Remove these calls and the unneeded 'rsrc_start' and 'rsrc_len' global
+variables.
+
+Fixes: 188db4435ac6 ("usb: gadget: s3c: use platform resources")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/b317638464f188159bd8eea44427dd359e480625.1616830026.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/s3c2410_udc.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
+index 1d3ebb07ccd4..b81979b3bdb6 100644
+--- a/drivers/usb/gadget/udc/s3c2410_udc.c
++++ b/drivers/usb/gadget/udc/s3c2410_udc.c
+@@ -54,8 +54,6 @@ static struct clk *udc_clock;
+ static struct clk *usb_bus_clock;
+ static void __iomem *base_addr;
+ static int irq_usbd;
+-static u64 rsrc_start;
+-static u64 rsrc_len;
+ static struct dentry *s3c2410_udc_debugfs_root;
+
+ static inline u32 udc_read(u32 reg)
+@@ -1775,7 +1773,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ base_addr = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(base_addr)) {
+ retval = PTR_ERR(base_addr);
+- goto err_mem;
++ goto err;
+ }
+
+ the_controller = udc;
+@@ -1793,7 +1791,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ if (retval != 0) {
+ dev_err(dev, "cannot get irq %i, err %d\n", irq_usbd, retval);
+ retval = -EBUSY;
+- goto err_map;
++ goto err;
+ }
+
+ dev_dbg(dev, "got irq %i\n", irq_usbd);
+@@ -1864,10 +1862,7 @@ err_gpio_claim:
+ gpio_free(udc_info->vbus_pin);
+ err_int:
+ free_irq(irq_usbd, udc);
+-err_map:
+- iounmap(base_addr);
+-err_mem:
+- release_mem_region(rsrc_start, rsrc_len);
++err:
+
+ return retval;
+ }
+@@ -1899,9 +1894,6 @@ static int s3c2410_udc_remove(struct platform_device *pdev)
+
+ free_irq(irq_usbd, udc);
+
+- iounmap(base_addr);
+- release_mem_region(rsrc_start, rsrc_len);
+-
+ if (!IS_ERR(udc_clock) && udc_clock != NULL) {
+ clk_disable_unprepare(udc_clock);
+ clk_put(udc_clock);
+--
+2.30.2
+
--- /dev/null
+From a8fea44484f14d55d1c10e63b3f814fd002a987e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 08:38:53 +0100
+Subject: usb: gadget: s3c: Fix the error handling path in
+ 's3c2410_udc_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e5242861ec6a0bce25b4cd10af0fc8a508fd067d ]
+
+Some 'clk_prepare_enable()' and 'clk_get()' must be undone in the error
+handling path of the probe function, as already done in the remove
+function.
+
+Fixes: 3fc154b6b813 ("USB Gadget driver for Samsung s3c2410 ARM SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/2bee52e4ce968f48b4c32545cf8f3b2ab825ba82.1616830026.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/s3c2410_udc.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
+index b81979b3bdb6..b154b62abefa 100644
+--- a/drivers/usb/gadget/udc/s3c2410_udc.c
++++ b/drivers/usb/gadget/udc/s3c2410_udc.c
+@@ -1750,7 +1750,8 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ udc_clock = clk_get(NULL, "usb-device");
+ if (IS_ERR(udc_clock)) {
+ dev_err(dev, "failed to get udc clock source\n");
+- return PTR_ERR(udc_clock);
++ retval = PTR_ERR(udc_clock);
++ goto err_usb_bus_clk;
+ }
+
+ clk_prepare_enable(udc_clock);
+@@ -1773,7 +1774,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ base_addr = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(base_addr)) {
+ retval = PTR_ERR(base_addr);
+- goto err;
++ goto err_udc_clk;
+ }
+
+ the_controller = udc;
+@@ -1791,7 +1792,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ if (retval != 0) {
+ dev_err(dev, "cannot get irq %i, err %d\n", irq_usbd, retval);
+ retval = -EBUSY;
+- goto err;
++ goto err_udc_clk;
+ }
+
+ dev_dbg(dev, "got irq %i\n", irq_usbd);
+@@ -1862,7 +1863,14 @@ err_gpio_claim:
+ gpio_free(udc_info->vbus_pin);
+ err_int:
+ free_irq(irq_usbd, udc);
+-err:
++err_udc_clk:
++ clk_disable_unprepare(udc_clock);
++ clk_put(udc_clock);
++ udc_clock = NULL;
++err_usb_bus_clk:
++ clk_disable_unprepare(usb_bus_clock);
++ clk_put(usb_bus_clock);
++ usb_bus_clock = NULL;
+
+ return retval;
+ }
+--
+2.30.2
+
--- /dev/null
+From e074ccbe8d86d3306f51491b0c8a08d2432a525e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 21:01:59 +0800
+Subject: USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 2e3d055bf27d70204cae349335a62a4f9b7c165a ]
+
+IS_ERR() and PTR_ERR() use wrong pointer, it should be
+udc->virt_addr, fix it.
+
+Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210330130159.1051979-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/snps_udc_plat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c
+index 32f1d3e90c26..99805d60a7ab 100644
+--- a/drivers/usb/gadget/udc/snps_udc_plat.c
++++ b/drivers/usb/gadget/udc/snps_udc_plat.c
+@@ -114,8 +114,8 @@ static int udc_plat_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ udc->virt_addr = devm_ioremap_resource(dev, res);
+- if (IS_ERR(udc->regs))
+- return PTR_ERR(udc->regs);
++ if (IS_ERR(udc->virt_addr))
++ return PTR_ERR(udc->virt_addr);
+
+ /* udc csr registers base */
+ udc->csr = udc->virt_addr + UDC_CSR_ADDR;
+--
+2.30.2
+
--- /dev/null
+From b67bbf98705a8334d48c2e956fd4aae50d930603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Mar 2021 18:19:15 +0300
+Subject: usb: host: ehci-tegra: Select USB_GADGET Kconfig option
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 0b9828763aeafa5e527b9d98b8789bdb34937fbc ]
+
+Select USB_GADGET Kconfig option in order to fix build failure which
+happens because ChipIdea driver has a build dependency on both USB_GADGET
+and USB_EHCI_HCD, while USB_EHCI_TEGRA force-selects the ChipIdea driver
+without taking into account the tristate USB_GADGET dependency. It's not
+possible to do anything about the cyclic dependency of the Kconfig
+options, but USB_EHCI_TEGRA is now a deprecated option that isn't used
+by defconfigs and USB_GADGET is wanted on Tegra by default, hence it's
+okay to have a bit clunky workaround for it.
+
+Fixes: c3590c7656fb ("usb: host: ehci-tegra: Remove the driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210320151915.7566-2-digetx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
+index b94f2a070c05..df9428f1dc5e 100644
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -272,6 +272,7 @@ config USB_EHCI_TEGRA
+ select USB_CHIPIDEA
+ select USB_CHIPIDEA_HOST
+ select USB_CHIPIDEA_TEGRA
++ select USB_GADGET
+ help
+ This option is deprecated now and the driver was removed, use
+ USB_CHIPIDEA_TEGRA instead.
+--
+2.30.2
+
--- /dev/null
+From e40a4621345c621b4dec261b4da890e628ed5670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 09:48:39 +0000
+Subject: usb: typec: stusb160x: fix return value check in stusb160x_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit f2d90e07b5df2c7745ae66d2d48cc350d3f1c7d2 ]
+
+In case of error, the function device_get_named_child_node() returns
+NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check
+should be replaced with NULL test.
+
+Fixes: da0cb6310094 ("usb: typec: add support for STUSB160x Type-C controller family")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20210308094839.3586773-1-weiyongjun1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/stusb160x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c
+index d21750bbbb44..6eaeba9b096e 100644
+--- a/drivers/usb/typec/stusb160x.c
++++ b/drivers/usb/typec/stusb160x.c
+@@ -682,8 +682,8 @@ static int stusb160x_probe(struct i2c_client *client)
+ }
+
+ fwnode = device_get_named_child_node(chip->dev, "connector");
+- if (IS_ERR(fwnode))
+- return PTR_ERR(fwnode);
++ if (!fwnode)
++ return -ENODEV;
+
+ /*
+ * When both VDD and VSYS power supplies are present, the low power
+--
+2.30.2
+
--- /dev/null
+From 5c0b4cbfcf2c59f93c5fdd82b394df05a5ec7766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 23:09:31 -0800
+Subject: usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ]
+
+While interpreting CC_STATUS, ROLE_CONTROL has to be read to make
+sure that CC1/CC2 is not forced presenting Rp/Rd.
+
+>From the TCPCI spec:
+
+4.4.5.2 ROLE_CONTROL (Normative):
+The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes
+to control the Rp/Rd directly instead of having the TCPC perform
+DRP toggling autonomously. When controlling Rp/Rd directly, the
+TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the
+CC1/CC2 values. This control is used for TCPM-TCPC implementing
+Source or Sink only as well as when a connection has been detected
+via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk.
+
+Table 4-22. CC_STATUS Register Definition:
+If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1)
+00b: SNK.Open (Below maximum vRa)
+01b: SNK.Default (Above minimum vRd-Connect)
+10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A
+11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A
+
+If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1)
+00b: SNK.Open (Below maximum vRa)
+01b: SNK.Default (Above minimum vRd-Connect)
+10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A
+11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A
+
+Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20210304070931.1947316-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/tcpci.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
+index a27deb0b5f03..027afd7dfdce 100644
+--- a/drivers/usb/typec/tcpm/tcpci.c
++++ b/drivers/usb/typec/tcpm/tcpci.c
+@@ -24,6 +24,15 @@
+ #define AUTO_DISCHARGE_PD_HEADROOM_MV 850
+ #define AUTO_DISCHARGE_PPS_HEADROOM_MV 1250
+
++#define tcpc_presenting_cc1_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT)))
++#define tcpc_presenting_cc2_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT)))
++
+ struct tcpci {
+ struct device *dev;
+
+@@ -178,19 +187,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc,
+ enum typec_cc_status *cc1, enum typec_cc_status *cc2)
+ {
+ struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
+- unsigned int reg;
++ unsigned int reg, role_control;
+ int ret;
+
++ ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control);
++ if (ret < 0)
++ return ret;
++
+ ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, ®);
+ if (ret < 0)
+ return ret;
+
+ *cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) &
+ TCPC_CC_STATUS_CC1_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc1_rd(role_control));
+ *cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) &
+ TCPC_CC_STATUS_CC2_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc2_rd(role_control));
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From a287f51c428ad152f7c1ee1690fb4434fd3641bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 19:39:58 -0700
+Subject: usb: typec: tcpm: Honour pSnkStdby requirement during negotiation
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+[ Upstream commit 123086843372bc93d26f52edfb71dbf951cd2f17 ]
+
+>From PD Spec:
+The Sink Shall transition to Sink Standby before a positive or
+negative voltage transition of VBUS. During Sink Standby
+the Sink Shall reduce its power draw to pSnkStdby. This allows
+the Source to manage the voltage transition as well as
+supply sufficient operating current to the Sink to maintain PD
+operation during the transition. The Sink Shall
+complete this transition to Sink Standby within tSnkStdby
+after evaluating the Accept Message from the Source. The
+transition when returning to Sink operation from Sink Standby
+Shall be completed within tSnkNewPower. The
+pSnkStdby requirement Shall only apply if the Sink power draw
+is higher than this level.
+
+The above requirement needs to be met to prevent hard resets
+from port partner.
+
+Without the patch: (5V/3A during SNK_DISCOVERY all the way through
+explicit contract)
+[ 95.711984] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected]
+[ 95.712007] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS]
+[ 95.712017] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS]
+[ 95.837190] VBUS on
+[ 95.882075] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms]
+[ 95.882082] state change SNK_DEBOUNCED -> SNK_ATTACHED [rev3 NONE_AMS]
+[ 95.882086] polarity 1
+[ 95.883151] set_auto_vbus_discharge_threshold mode:0 pps_active:n vbus:5000 ret:0
+[ 95.883441] enable vbus discharge ret:0
+[ 95.883445] Requesting mux state 1, usb-role 2, orientation 2
+[ 95.883776] state change SNK_ATTACHED -> SNK_STARTUP [rev3 NONE_AMS]
+[ 95.883879] pending state change SNK_STARTUP -> SNK_DISCOVERY @ 500 ms [rev3 NONE_AMS]
+[ 96.038960] VBUS on
+[ 96.383939] state change SNK_STARTUP -> SNK_DISCOVERY [delayed 500 ms]
+[ 96.383946] Setting voltage/current limit 5000 mV 3000 mA
+[ 96.383961] vbus=0 charge:=1
+[ 96.386044] state change SNK_DISCOVERY -> SNK_WAIT_CAPABILITIES [rev3 NONE_AMS]
+[ 96.386309] pending state change SNK_WAIT_CAPABILITIES -> HARD_RESET_SEND @ 450 ms [rev3 NONE_AMS]
+[ 96.394404] PD RX, header: 0x2161 [1]
+[ 96.394408] PDO 0: type 0, 5000 mV, 3000 mA [E]
+[ 96.394410] PDO 1: type 0, 9000 mV, 2000 mA []
+[ 96.394412] state change SNK_WAIT_CAPABILITIES -> SNK_NEGOTIATE_CAPABILITIES [rev2 POWER_NEGOTIATION]
+[ 96.394416] Setting usb_comm capable false
+[ 96.395083] cc=0 cc1=0 cc2=5 vbus=0 vconn=sink polarity=1
+[ 96.395089] Requesting PDO 1: 9000 mV, 2000 mA
+[ 96.395093] PD TX, header: 0x1042
+[ 96.397404] PD TX complete, status: 0
+[ 96.397424] pending state change SNK_NEGOTIATE_CAPABILITIES -> HARD_RESET_SEND @ 60 ms [rev2 POWER_NEGOTIATION]
+[ 96.400826] PD RX, header: 0x363 [1]
+[ 96.400829] state change SNK_NEGOTIATE_CAPABILITIES -> SNK_TRANSITION_SINK [rev2 POWER_NEGOTIATION]
+[ 96.400832] pending state change SNK_TRANSITION_SINK -> HARD_RESET_SEND @ 500 ms [rev2 POWER_NEGOTIATION]
+[ 96.577315] PD RX, header: 0x566 [1]
+[ 96.577321] Setting voltage/current limit 9000 mV 2000 mA
+[ 96.578363] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:9000 ret:0
+[ 96.578370] state change SNK_TRANSITION_SINK -> SNK_READY [rev2 POWER_NEGOTIATION]
+
+With the patch:
+[ 168.398573] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected]
+[ 168.398605] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS]
+[ 168.398619] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS]
+[ 168.522348] VBUS on
+[ 168.568676] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms]
+[ 168.568684] state change SNK_DEBOUNCED -> SNK_ATTACHED [rev3 NONE_AMS]
+[ 168.568688] polarity 1
+[ 168.569867] set_auto_vbus_discharge_threshold mode:0 pps_active:n vbus:5000 ret:0
+[ 168.570158] enable vbus discharge ret:0
+[ 168.570161] Requesting mux state 1, usb-role 2, orientation 2
+[ 168.570504] state change SNK_ATTACHED -> SNK_STARTUP [rev3 NONE_AMS]
+[ 168.570634] pending state change SNK_STARTUP -> SNK_DISCOVERY @ 500 ms [rev3 NONE_AMS]
+[ 169.070689] state change SNK_STARTUP -> SNK_DISCOVERY [delayed 500 ms]
+[ 169.070695] Setting voltage/current limit 5000 mV 3000 mA
+[ 169.070702] vbus=0 charge:=1
+[ 169.072719] state change SNK_DISCOVERY -> SNK_WAIT_CAPABILITIES [rev3 NONE_AMS]
+[ 169.073145] pending state change SNK_WAIT_CAPABILITIES -> HARD_RESET_SEND @ 450 ms [rev3 NONE_AMS]
+[ 169.077162] PD RX, header: 0x2161 [1]
+[ 169.077172] PDO 0: type 0, 5000 mV, 3000 mA [E]
+[ 169.077178] PDO 1: type 0, 9000 mV, 2000 mA []
+[ 169.077183] state change SNK_WAIT_CAPABILITIES -> SNK_NEGOTIATE_CAPABILITIES [rev2 POWER_NEGOTIATION]
+[ 169.077191] Setting usb_comm capable false
+[ 169.077753] cc=0 cc1=0 cc2=5 vbus=0 vconn=sink polarity=1
+[ 169.077759] Requesting PDO 1: 9000 mV, 2000 mA
+[ 169.077762] PD TX, header: 0x1042
+[ 169.079990] PD TX complete, status: 0
+[ 169.080013] pending state change SNK_NEGOTIATE_CAPABILITIES -> HARD_RESET_SEND @ 60 ms [rev2 POWER_NEGOTIATION]
+[ 169.083183] VBUS on
+[ 169.084195] PD RX, header: 0x363 [1]
+[ 169.084200] state change SNK_NEGOTIATE_CAPABILITIES -> SNK_TRANSITION_SINK [rev2 POWER_NEGOTIATION]
+[ 169.084206] Setting standby current 5000 mV @ 500 mA
+[ 169.084209] Setting voltage/current limit 5000 mV 500 mA
+[ 169.084220] pending state change SNK_TRANSITION_SINK -> HARD_RESET_SEND @ 500 ms [rev2 POWER_NEGOTIATION]
+[ 169.260222] PD RX, header: 0x566 [1]
+[ 169.260227] Setting voltage/current limit 9000 mV 2000 mA
+[ 169.261315] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:9000 ret:0
+[ 169.261321] state change SNK_TRANSITION_SINK -> SNK_READY [rev2 POWER_NEGOTIATION]
+[ 169.261570] AMS POWER_NEGOTIATION finished
+
+Fixes: f0690a25a140b ("staging: typec: USB Type-C Port Manager (tcpm)")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20210414024000.4175263-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 17 +++++++++++++++++
+ include/linux/usb/pd.h | 2 ++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
+index b1040f00c2ba..1a086ba254d2 100644
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4134,6 +4134,23 @@ static void run_state_machine(struct tcpm_port *port)
+ }
+ break;
+ case SNK_TRANSITION_SINK:
++ /* From the USB PD spec:
++ * "The Sink Shall transition to Sink Standby before a positive or
++ * negative voltage transition of VBUS. During Sink Standby
++ * the Sink Shall reduce its power draw to pSnkStdby."
++ *
++ * This is not applicable to PPS though as the port can continue
++ * to draw negotiated power without switching to standby.
++ */
++ if (port->supply_voltage != port->req_supply_voltage && !port->pps_data.active &&
++ port->current_limit * port->supply_voltage / 1000 > PD_P_SNK_STDBY_MW) {
++ u32 stdby_ma = PD_P_SNK_STDBY_MW * 1000 / port->supply_voltage;
++
++ tcpm_log(port, "Setting standby current %u mV @ %u mA",
++ port->supply_voltage, stdby_ma);
++ tcpm_set_current_limit(port, stdby_ma, port->supply_voltage);
++ }
++ fallthrough;
+ case SNK_TRANSITION_SINK_VBUS:
+ tcpm_set_state(port, hard_reset_state(port),
+ PD_T_PS_TRANSITION);
+diff --git a/include/linux/usb/pd.h b/include/linux/usb/pd.h
+index 70d681918d01..bf00259493e0 100644
+--- a/include/linux/usb/pd.h
++++ b/include/linux/usb/pd.h
+@@ -493,4 +493,6 @@ static inline unsigned int rdo_max_power(u32 rdo)
+ #define PD_N_CAPS_COUNT (PD_T_NO_RESPONSE / PD_T_SEND_SOURCE_CAP)
+ #define PD_N_HARD_RESET_COUNT 2
+
++#define PD_P_SNK_STDBY_MW 2500 /* 2500 mW */
++
+ #endif /* __LINUX_USB_PD_H */
+--
+2.30.2
+
--- /dev/null
+From 2030ba437b8db11690947732d9eaa314b8a586b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 02:11:04 -0800
+Subject: usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+[ Upstream commit 3287f58bcba6c6fa6167624b443a668782fac26d ]
+
+When vbus auto discharge is enabled, TCPM can sometimes be faster than
+the TCPC i.e. TCPM can go ahead and move the port to unattached state
+(involves disabling vbus auto discharge) before TCPC could effectively
+discharge vbus to VSAFE0V. This leaves vbus with residual charge and
+increases the decay time which prevents tsafe0v from being met.
+This change makes TCPM waits for a maximum of tSafe0V(max) for vbus
+to discharge to VSAFE0V before transitioning to unattached state
+and re-enable toggling. If vbus discharges to vsafe0v sooner, then,
+transition to unattached state
+happens right away.
+
+Also, while in SNK_READY, when auto discharge is enabled, drive
+disconnect based on vbus turning off instead of Rp disappearing on
+CC pins. Rp disappearing on CC pins is almost instanteous compared
+to vbus decay.
+
+Sink detach:
+[ 541.703058] CC1: 3 -> 0, CC2: 0 -> 0 [state SNK_READY, polarity 0, disconnected]
+[ 541.703331] Setting voltage/current limit 5000 mV 0 mA
+[ 541.727235] VBUS on
+[ 541.749650] VBUS off
+[ 541.749653] pending state change SNK_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
+[ 541.749944] VBUS VSAFE0V
+[ 541.749945] state change SNK_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
+[ 541.750806] Disable vbus discharge ret:0
+[ 541.907345] Start toggling
+[ 541.922799] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
+
+Source detach:
+[ 2555.310414] state change SRC_SEND_CAPABILITIES -> SRC_READY [rev3 POWER_NEGOTIATION]
+[ 2555.310675] AMS POWER_NEGOTIATION finished
+[ 2555.310679] cc:=3
+[ 2593.645886] CC1: 0 -> 0, CC2: 2 -> 0 [state SRC_READY, polarity 1, disconnected]
+[ 2593.645919] pending state change SRC_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
+[ 2593.648419] VBUS off
+[ 2593.648960] VBUS VSAFE0V
+[ 2593.648965] state change SRC_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
+[ 2593.649962] Disable vbus discharge ret:0
+[ 2593.890322] Start toggling
+[ 2593.925663] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0,
+
+Fixes: f321a02caebd ("usb: typec: tcpm: Implement enabling Auto Discharge disconnect support")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20210225101104.1680697-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 75 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 65 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
+index de214da4363e..b1040f00c2ba 100644
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -456,6 +456,9 @@ struct tcpm_port {
+ enum tcpm_ams next_ams;
+ bool in_ams;
+
++ /* Auto vbus discharge status */
++ bool auto_vbus_discharge_enabled;
++
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *dentry;
+ struct mutex logbuffer_lock; /* log buffer access lock */
+@@ -525,6 +528,9 @@ static const char * const pd_rev[] = {
+ (tcpm_port_is_sink(port) && \
+ ((port)->cc1 == TYPEC_CC_RP_3_0 || (port)->cc2 == TYPEC_CC_RP_3_0))
+
++#define tcpm_wait_for_discharge(port) \
++ (((port)->auto_vbus_discharge_enabled && !(port)->vbus_vsafe0v) ? PD_T_SAFE_0V : 0)
++
+ static enum tcpm_state tcpm_default_state(struct tcpm_port *port)
+ {
+ if (port->port_type == TYPEC_PORT_DRP) {
+@@ -3439,6 +3445,8 @@ static int tcpm_src_attach(struct tcpm_port *port)
+ if (port->tcpc->enable_auto_vbus_discharge) {
+ ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
+ tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
++ if (!ret)
++ port->auto_vbus_discharge_enabled = true;
+ }
+
+ ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port));
+@@ -3521,6 +3529,8 @@ static void tcpm_reset_port(struct tcpm_port *port)
+ if (port->tcpc->enable_auto_vbus_discharge) {
+ ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, false);
+ tcpm_log_force(port, "Disable vbus discharge ret:%d", ret);
++ if (!ret)
++ port->auto_vbus_discharge_enabled = false;
+ }
+ port->in_ams = false;
+ port->ams = NONE_AMS;
+@@ -3593,6 +3603,8 @@ static int tcpm_snk_attach(struct tcpm_port *port)
+ tcpm_set_auto_vbus_discharge_threshold(port, TYPEC_PWR_MODE_USB, false, VSAFE5V);
+ ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
+ tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
++ if (!ret)
++ port->auto_vbus_discharge_enabled = true;
+ }
+
+ ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port));
+@@ -4695,9 +4707,9 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
+ if (tcpm_port_is_disconnected(port) ||
+ !tcpm_port_is_source(port)) {
+ if (port->port_type == TYPEC_PORT_SRC)
+- tcpm_set_state(port, SRC_UNATTACHED, 0);
++ tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
+ else
+- tcpm_set_state(port, SNK_UNATTACHED, 0);
++ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
+ }
+ break;
+ case SNK_UNATTACHED:
+@@ -4728,7 +4740,23 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
+ tcpm_set_state(port, SNK_DEBOUNCED, 0);
+ break;
+ case SNK_READY:
+- if (tcpm_port_is_disconnected(port))
++ /*
++ * EXIT condition is based primarily on vbus disconnect and CC is secondary.
++ * "A port that has entered into USB PD communications with the Source and
++ * has seen the CC voltage exceed vRd-USB may monitor the CC pin to detect
++ * cable disconnect in addition to monitoring VBUS.
++ *
++ * A port that is monitoring the CC voltage for disconnect (but is not in
++ * the process of a USB PD PR_Swap or USB PD FR_Swap) shall transition to
++ * Unattached.SNK within tSinkDisconnect after the CC voltage remains below
++ * vRd-USB for tPDDebounce."
++ *
++ * When set_auto_vbus_discharge_threshold is enabled, CC pins go
++ * away before vbus decays to disconnect threshold. Allow
++ * disconnect to be driven by vbus disconnect when auto vbus
++ * discharge is enabled.
++ */
++ if (!port->auto_vbus_discharge_enabled && tcpm_port_is_disconnected(port))
+ tcpm_set_state(port, unattached_state(port), 0);
+ else if (!port->pd_capable &&
+ (cc1 != old_cc1 || cc2 != old_cc2))
+@@ -4827,9 +4855,13 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
+ * Ignore CC changes here.
+ */
+ break;
+-
+ default:
+- if (tcpm_port_is_disconnected(port))
++ /*
++ * While acting as sink and auto vbus discharge is enabled, Allow disconnect
++ * to be driven by vbus disconnect.
++ */
++ if (tcpm_port_is_disconnected(port) && !(port->pwr_role == TYPEC_SINK &&
++ port->auto_vbus_discharge_enabled))
+ tcpm_set_state(port, unattached_state(port), 0);
+ break;
+ }
+@@ -4993,8 +5025,16 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
+ case SRC_TRANSITION_SUPPLY:
+ case SRC_READY:
+ case SRC_WAIT_NEW_CAPABILITIES:
+- /* Force to unattached state to re-initiate connection */
+- tcpm_set_state(port, SRC_UNATTACHED, 0);
++ /*
++ * Force to unattached state to re-initiate connection.
++ * DRP port should move to Unattached.SNK instead of Unattached.SRC if
++ * sink removed. Although sink removal here is due to source's vbus collapse,
++ * treat it the same way for consistency.
++ */
++ if (port->port_type == TYPEC_PORT_SRC)
++ tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
++ else
++ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
+ break;
+
+ case PORT_RESET:
+@@ -5013,9 +5053,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
+ break;
+
+ default:
+- if (port->pwr_role == TYPEC_SINK &&
+- port->attached)
+- tcpm_set_state(port, SNK_UNATTACHED, 0);
++ if (port->pwr_role == TYPEC_SINK && port->attached)
++ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
+ break;
+ }
+ }
+@@ -5037,7 +5076,23 @@ static void _tcpm_pd_vbus_vsafe0v(struct tcpm_port *port)
+ tcpm_set_state(port, tcpm_try_snk(port) ? SNK_TRY : SRC_ATTACHED,
+ PD_T_CC_DEBOUNCE);
+ break;
++ case SRC_STARTUP:
++ case SRC_SEND_CAPABILITIES:
++ case SRC_SEND_CAPABILITIES_TIMEOUT:
++ case SRC_NEGOTIATE_CAPABILITIES:
++ case SRC_TRANSITION_SUPPLY:
++ case SRC_READY:
++ case SRC_WAIT_NEW_CAPABILITIES:
++ if (port->auto_vbus_discharge_enabled) {
++ if (port->port_type == TYPEC_PORT_SRC)
++ tcpm_set_state(port, SRC_UNATTACHED, 0);
++ else
++ tcpm_set_state(port, SNK_UNATTACHED, 0);
++ }
++ break;
+ default:
++ if (port->pwr_role == TYPEC_SINK && port->auto_vbus_discharge_enabled)
++ tcpm_set_state(port, SNK_UNATTACHED, 0);
+ break;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 8692beaf91a85a97b9dbecbb9abbf0b9cb574e77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 09:48:41 +0000
+Subject: usb: typec: tps6598x: Fix return value check in tps6598x_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 604c75893a01c8a3b5bd6dac55535963cd44c3f5 ]
+
+In case of error, the function device_get_named_child_node() returns
+NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check
+should be replaced with NULL test.
+
+Fixes: 18a6c866bb19 ("usb: typec: tps6598x: Add USB role switching logic")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20210308094841.3587751-1-weiyongjun1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tps6598x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
+index 29bd1c5a283c..4038104568f5 100644
+--- a/drivers/usb/typec/tps6598x.c
++++ b/drivers/usb/typec/tps6598x.c
+@@ -614,8 +614,8 @@ static int tps6598x_probe(struct i2c_client *client)
+ return ret;
+
+ fwnode = device_get_named_child_node(&client->dev, "connector");
+- if (IS_ERR(fwnode))
+- return PTR_ERR(fwnode);
++ if (!fwnode)
++ return -ENODEV;
+
+ tps->role_sw = fwnode_usb_role_switch_get(fwnode);
+ if (IS_ERR(tps->role_sw)) {
+--
+2.30.2
+
--- /dev/null
+From 4d6dfb413043f190b0ba0da641a845fae0a22654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 19:23:05 +0800
+Subject: usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 1d08ed588c6a85a35a24c82eb4cf0807ec2b366a ]
+
+Add the missing unlock before return from function usbip_sockfd_store()
+in the error handling case.
+
+Fixes: bd8b82042269 ("usbip: vudc synchronize sysfs code paths")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20210408112305.1022247-1-yebin10@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vudc_sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index f7633ee655a1..d1cf6b51bf85 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -156,12 +156,14 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+ tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx");
+ if (IS_ERR(tcp_rx)) {
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+ tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx");
+ if (IS_ERR(tcp_tx)) {
+ kthread_stop(tcp_rx);
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 409e39b9d6ed0c77f5ffcce8390e193886bf09e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 09:53:06 -0600
+Subject: vfio/fsl-mc: Re-order vfio_fsl_mc_probe()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 2b1fe162e584a88ec7f12a651a2a50f94dd8cfac ]
+
+vfio_add_group_dev() must be called only after all of the private data in
+vdev is fully setup and ready, otherwise there could be races with user
+space instantiating a device file descriptor and starting to call ops.
+
+For instance vfio_fsl_mc_reflck_attach() sets vdev->reflck and
+vfio_fsl_mc_open(), called by fops open, unconditionally derefs it, which
+will crash if things get out of order.
+
+This driver started life with the right sequence, but two commits added
+stuff after vfio_add_group_dev().
+
+Fixes: 2e0d29561f59 ("vfio/fsl-mc: Add irq infrastructure for fsl-mc devices")
+Fixes: f2ba7e8c947b ("vfio/fsl-mc: Added lock support in preparation for interrupt handling")
+Co-developed-by: Diana Craciun OSS <diana.craciun@oss.nxp.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Message-Id: <5-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/fsl-mc/vfio_fsl_mc.c | 74 ++++++++++++++++++++-----------
+ 1 file changed, 47 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
+index f27e25112c40..8722f5effacd 100644
+--- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c
++++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
+@@ -568,23 +568,39 @@ static int vfio_fsl_mc_init_device(struct vfio_fsl_mc_device *vdev)
+ dev_err(&mc_dev->dev, "VFIO_FSL_MC: Failed to setup DPRC (%d)\n", ret);
+ goto out_nc_unreg;
+ }
++ return 0;
++
++out_nc_unreg:
++ bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb);
++ return ret;
++}
+
++static int vfio_fsl_mc_scan_container(struct fsl_mc_device *mc_dev)
++{
++ int ret;
++
++ /* non dprc devices do not scan for other devices */
++ if (!is_fsl_mc_bus_dprc(mc_dev))
++ return 0;
+ ret = dprc_scan_container(mc_dev, false);
+ if (ret) {
+- dev_err(&mc_dev->dev, "VFIO_FSL_MC: Container scanning failed (%d)\n", ret);
+- goto out_dprc_cleanup;
++ dev_err(&mc_dev->dev,
++ "VFIO_FSL_MC: Container scanning failed (%d)\n", ret);
++ dprc_remove_devices(mc_dev, NULL, 0);
++ return ret;
+ }
+-
+ return 0;
++}
++
++static void vfio_fsl_uninit_device(struct vfio_fsl_mc_device *vdev)
++{
++ struct fsl_mc_device *mc_dev = vdev->mc_dev;
++
++ if (!is_fsl_mc_bus_dprc(mc_dev))
++ return;
+
+-out_dprc_cleanup:
+- dprc_remove_devices(mc_dev, NULL, 0);
+ dprc_cleanup(mc_dev);
+-out_nc_unreg:
+ bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb);
+- vdev->nb.notifier_call = NULL;
+-
+- return ret;
+ }
+
+ static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev)
+@@ -607,29 +623,39 @@ static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev)
+ }
+
+ vdev->mc_dev = mc_dev;
+-
+- ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev);
+- if (ret) {
+- dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n");
+- goto out_group_put;
+- }
++ mutex_init(&vdev->igate);
+
+ ret = vfio_fsl_mc_reflck_attach(vdev);
+ if (ret)
+- goto out_group_dev;
++ goto out_group_put;
+
+ ret = vfio_fsl_mc_init_device(vdev);
+ if (ret)
+ goto out_reflck;
+
+- mutex_init(&vdev->igate);
++ ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev);
++ if (ret) {
++ dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n");
++ goto out_device;
++ }
+
++ /*
++ * This triggers recursion into vfio_fsl_mc_probe() on another device
++ * and the vfio_fsl_mc_reflck_attach() must succeed, which relies on the
++ * vfio_add_group_dev() above. It has no impact on this vdev, so it is
++ * safe to be after the vfio device is made live.
++ */
++ ret = vfio_fsl_mc_scan_container(mc_dev);
++ if (ret)
++ goto out_group_dev;
+ return 0;
+
+-out_reflck:
+- vfio_fsl_mc_reflck_put(vdev->reflck);
+ out_group_dev:
+ vfio_del_group_dev(dev);
++out_device:
++ vfio_fsl_uninit_device(vdev);
++out_reflck:
++ vfio_fsl_mc_reflck_put(vdev->reflck);
+ out_group_put:
+ vfio_iommu_group_put(group, dev);
+ return ret;
+@@ -646,16 +672,10 @@ static int vfio_fsl_mc_remove(struct fsl_mc_device *mc_dev)
+
+ mutex_destroy(&vdev->igate);
+
++ dprc_remove_devices(mc_dev, NULL, 0);
++ vfio_fsl_uninit_device(vdev);
+ vfio_fsl_mc_reflck_put(vdev->reflck);
+
+- if (is_fsl_mc_bus_dprc(mc_dev)) {
+- dprc_remove_devices(mc_dev, NULL, 0);
+- dprc_cleanup(mc_dev);
+- }
+-
+- if (vdev->nb.notifier_call)
+- bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb);
+-
+ vfio_iommu_group_put(mc_dev->dev.iommu_group, dev);
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 77f87f8a2d0099a69bec38ba43821cef3493c37a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 16:40:25 -0300
+Subject: vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ]
+
+There is a small race where the parent is NULL even though the kobj has
+already been made visible in sysfs.
+
+For instance the attribute_group is made visible in sysfs_create_files()
+and the mdev_type_attr_show() does:
+
+ ret = attr->show(kobj, type->parent->dev, buf);
+
+Which will crash on NULL parent. Move the parent setup to before the type
+pointer leaves the stack frame.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Message-Id: <2-v2-d36939638fc6+d54-vfio2_jgg@nvidia.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index 917fd84c1c6f..367ff5412a38 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -105,6 +105,7 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ return ERR_PTR(-ENOMEM);
+
+ type->kobj.kset = parent->mdev_types_kset;
++ type->parent = parent;
+
+ ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL,
+ "%s-%s", dev_driver_string(parent->dev),
+@@ -132,7 +133,6 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ }
+
+ type->group = group;
+- type->parent = parent;
+ return type;
+
+ attrs_failed:
+--
+2.30.2
+
--- /dev/null
+From 83ee6b407936b29d377fcb3a77a3141b305eae8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 09:53:06 -0600
+Subject: vfio/pci: Move VGA and VF initialization to functions
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 61e90817482871b614133c0f20feb1aba2faec86 ]
+
+vfio_pci_probe() is quite complicated, with optional VF and VGA sub
+components. Move these into clear init/uninit functions and have a linear
+flow in probe/remove.
+
+This fixes a few little buglets:
+ - vfio_pci_remove() is in the wrong order, vga_client_register() removes
+ a notifier and is after kfree(vdev), but the notifier refers to vdev,
+ so it can use after free in a race.
+ - vga_client_register() can fail but was ignored
+
+Organize things so destruction order is the reverse of creation order.
+
+Fixes: ecaa1f6a0154 ("vfio-pci: Add VGA arbiter client")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Message-Id: <7-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 116 +++++++++++++++++++++++-------------
+ 1 file changed, 74 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 5023e23db3bc..b73144a6804a 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1924,6 +1924,68 @@ static int vfio_pci_bus_notifier(struct notifier_block *nb,
+ return 0;
+ }
+
++static int vfio_pci_vf_init(struct vfio_pci_device *vdev)
++{
++ struct pci_dev *pdev = vdev->pdev;
++ int ret;
++
++ if (!pdev->is_physfn)
++ return 0;
++
++ vdev->vf_token = kzalloc(sizeof(*vdev->vf_token), GFP_KERNEL);
++ if (!vdev->vf_token)
++ return -ENOMEM;
++
++ mutex_init(&vdev->vf_token->lock);
++ uuid_gen(&vdev->vf_token->uuid);
++
++ vdev->nb.notifier_call = vfio_pci_bus_notifier;
++ ret = bus_register_notifier(&pci_bus_type, &vdev->nb);
++ if (ret) {
++ kfree(vdev->vf_token);
++ return ret;
++ }
++ return 0;
++}
++
++static void vfio_pci_vf_uninit(struct vfio_pci_device *vdev)
++{
++ if (!vdev->vf_token)
++ return;
++
++ bus_unregister_notifier(&pci_bus_type, &vdev->nb);
++ WARN_ON(vdev->vf_token->users);
++ mutex_destroy(&vdev->vf_token->lock);
++ kfree(vdev->vf_token);
++}
++
++static int vfio_pci_vga_init(struct vfio_pci_device *vdev)
++{
++ struct pci_dev *pdev = vdev->pdev;
++ int ret;
++
++ if (!vfio_pci_is_vga(pdev))
++ return 0;
++
++ ret = vga_client_register(pdev, vdev, NULL, vfio_pci_set_vga_decode);
++ if (ret)
++ return ret;
++ vga_set_legacy_decoding(pdev, vfio_pci_set_vga_decode(vdev, false));
++ return 0;
++}
++
++static void vfio_pci_vga_uninit(struct vfio_pci_device *vdev)
++{
++ struct pci_dev *pdev = vdev->pdev;
++
++ if (!vfio_pci_is_vga(pdev))
++ return;
++ vga_client_register(pdev, NULL, NULL, NULL);
++ vga_set_legacy_decoding(pdev, VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM |
++ VGA_RSRC_LEGACY_IO |
++ VGA_RSRC_LEGACY_MEM);
++}
++
+ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ struct vfio_pci_device *vdev;
+@@ -1977,28 +2039,12 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ ret = vfio_pci_reflck_attach(vdev);
+ if (ret)
+ goto out_del_group_dev;
+-
+- if (pdev->is_physfn) {
+- vdev->vf_token = kzalloc(sizeof(*vdev->vf_token), GFP_KERNEL);
+- if (!vdev->vf_token) {
+- ret = -ENOMEM;
+- goto out_reflck;
+- }
+-
+- mutex_init(&vdev->vf_token->lock);
+- uuid_gen(&vdev->vf_token->uuid);
+-
+- vdev->nb.notifier_call = vfio_pci_bus_notifier;
+- ret = bus_register_notifier(&pci_bus_type, &vdev->nb);
+- if (ret)
+- goto out_vf_token;
+- }
+-
+- if (vfio_pci_is_vga(pdev)) {
+- vga_client_register(pdev, vdev, NULL, vfio_pci_set_vga_decode);
+- vga_set_legacy_decoding(pdev,
+- vfio_pci_set_vga_decode(vdev, false));
+- }
++ ret = vfio_pci_vf_init(vdev);
++ if (ret)
++ goto out_reflck;
++ ret = vfio_pci_vga_init(vdev);
++ if (ret)
++ goto out_vf;
+
+ vfio_pci_probe_power_state(vdev);
+
+@@ -2018,8 +2064,8 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ return ret;
+
+-out_vf_token:
+- kfree(vdev->vf_token);
++out_vf:
++ vfio_pci_vf_uninit(vdev);
+ out_reflck:
+ vfio_pci_reflck_put(vdev->reflck);
+ out_del_group_dev:
+@@ -2041,33 +2087,19 @@ static void vfio_pci_remove(struct pci_dev *pdev)
+ if (!vdev)
+ return;
+
+- if (vdev->vf_token) {
+- WARN_ON(vdev->vf_token->users);
+- mutex_destroy(&vdev->vf_token->lock);
+- kfree(vdev->vf_token);
+- }
+-
+- if (vdev->nb.notifier_call)
+- bus_unregister_notifier(&pci_bus_type, &vdev->nb);
+-
++ vfio_pci_vf_uninit(vdev);
+ vfio_pci_reflck_put(vdev->reflck);
++ vfio_pci_vga_uninit(vdev);
+
+ vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev);
+- kfree(vdev->region);
+- mutex_destroy(&vdev->ioeventfds_lock);
+
+ if (!disable_idle_d3)
+ vfio_pci_set_power_state(vdev, PCI_D0);
+
++ mutex_destroy(&vdev->ioeventfds_lock);
++ kfree(vdev->region);
+ kfree(vdev->pm_save);
+ kfree(vdev);
+-
+- if (vfio_pci_is_vga(pdev)) {
+- vga_client_register(pdev, NULL, NULL, NULL);
+- vga_set_legacy_decoding(pdev,
+- VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM |
+- VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM);
+- }
+ }
+
+ static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev,
+--
+2.30.2
+
--- /dev/null
+From ea8c25b649f35687876fe6b4a136a24375331337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 09:53:06 -0600
+Subject: vfio/pci: Re-order vfio_pci_probe()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 4aeec3984ddc853f7c65903bde472ffdef738bae ]
+
+vfio_add_group_dev() must be called only after all of the private data in
+vdev is fully setup and ready, otherwise there could be races with user
+space instantiating a device file descriptor and starting to call ops.
+
+For instance vfio_pci_reflck_attach() sets vdev->reflck and
+vfio_pci_open(), called by fops open, unconditionally derefs it, which
+will crash if things get out of order.
+
+Fixes: cc20d7999000 ("vfio/pci: Introduce VF token")
+Fixes: e309df5b0c9e ("vfio/pci: Parallelize device open and release")
+Fixes: 6eb7018705de ("vfio-pci: Move idle devices to D3hot power state")
+Fixes: ecaa1f6a0154 ("vfio-pci: Add VGA arbiter client")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Message-Id: <8-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index b73144a6804a..cb7f2dc09e9d 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -2032,13 +2032,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ INIT_LIST_HEAD(&vdev->vma_list);
+ init_rwsem(&vdev->memory_lock);
+
+- ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
+- if (ret)
+- goto out_free;
+-
+ ret = vfio_pci_reflck_attach(vdev);
+ if (ret)
+- goto out_del_group_dev;
++ goto out_free;
+ ret = vfio_pci_vf_init(vdev);
+ if (ret)
+ goto out_reflck;
+@@ -2062,15 +2058,20 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ vfio_pci_set_power_state(vdev, PCI_D3hot);
+ }
+
+- return ret;
++ ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
++ if (ret)
++ goto out_power;
++ return 0;
+
++out_power:
++ if (!disable_idle_d3)
++ vfio_pci_set_power_state(vdev, PCI_D0);
+ out_vf:
+ vfio_pci_vf_uninit(vdev);
+ out_reflck:
+ vfio_pci_reflck_put(vdev->reflck);
+-out_del_group_dev:
+- vfio_del_group_dev(&pdev->dev);
+ out_free:
++ kfree(vdev->pm_save);
+ kfree(vdev);
+ out_group_put:
+ vfio_iommu_group_put(group, &pdev->dev);
+--
+2.30.2
+
--- /dev/null
+From 388ddbadb9d9bfe96d7db7f7fd4b36f1147f3f6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 13:07:27 +0200
+Subject: vsock/virtio: free queued packets when closing socket
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 8432b8114957235f42e070a16118a7f750de9d39 ]
+
+As reported by syzbot [1], there is a memory leak while closing the
+socket. We partially solved this issue with commit ac03046ece2b
+("vsock/virtio: free packets during the socket release"), but we
+forgot to drain the RX queue when the socket is definitely closed by
+the scheduled work.
+
+To avoid future issues, let's use the new virtio_transport_remove_sock()
+to drain the RX queue before removing the socket from the af_vsock lists
+calling vsock_remove_sock().
+
+[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9
+
+Fixes: ac03046ece2b ("vsock/virtio: free packets during the socket release")
+Reported-and-tested-by: syzbot+24452624fc4c571eedd9@syzkaller.appspotmail.com
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport_common.c | 28 +++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index e4370b1b7494..902cb6dd710b 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -733,6 +733,23 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t,
+ return t->send_pkt(reply);
+ }
+
++/* This function should be called with sk_lock held and SOCK_DONE set */
++static void virtio_transport_remove_sock(struct vsock_sock *vsk)
++{
++ struct virtio_vsock_sock *vvs = vsk->trans;
++ struct virtio_vsock_pkt *pkt, *tmp;
++
++ /* We don't need to take rx_lock, as the socket is closing and we are
++ * removing it.
++ */
++ list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) {
++ list_del(&pkt->list);
++ virtio_transport_free_pkt(pkt);
++ }
++
++ vsock_remove_sock(vsk);
++}
++
+ static void virtio_transport_wait_close(struct sock *sk, long timeout)
+ {
+ if (timeout) {
+@@ -765,7 +782,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk,
+ (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) {
+ vsk->close_work_scheduled = false;
+
+- vsock_remove_sock(vsk);
++ virtio_transport_remove_sock(vsk);
+
+ /* Release refcnt obtained when we scheduled the timeout */
+ sock_put(sk);
+@@ -828,22 +845,15 @@ static bool virtio_transport_close(struct vsock_sock *vsk)
+
+ void virtio_transport_release(struct vsock_sock *vsk)
+ {
+- struct virtio_vsock_sock *vvs = vsk->trans;
+- struct virtio_vsock_pkt *pkt, *tmp;
+ struct sock *sk = &vsk->sk;
+ bool remove_sock = true;
+
+ if (sk->sk_type == SOCK_STREAM)
+ remove_sock = virtio_transport_close(vsk);
+
+- list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) {
+- list_del(&pkt->list);
+- virtio_transport_free_pkt(pkt);
+- }
+-
+ if (remove_sock) {
+ sock_set_flag(sk, SOCK_DONE);
+- vsock_remove_sock(vsk);
++ virtio_transport_remove_sock(vsk);
+ }
+ }
+ EXPORT_SYMBOL_GPL(virtio_transport_release);
+--
+2.30.2
+
--- /dev/null
+From d64c9d9003dc28167b5bec551fdb492816a4949d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 12:44:16 +0200
+Subject: vsock/vmci: log once the failed queue pair allocation
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]
+
+VMCI feature is not supported in conjunction with the vSphere Fault
+Tolerance (FT) feature.
+
+VMware Tools can repeatedly try to create a vsock connection. If FT is
+enabled the kernel logs is flooded with the following messages:
+
+ qp_alloc_hypercall result = -20
+ Could not attach to queue pair with -20
+
+"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307
+("VMCI: Stop log spew when qp allocation isn't possible"), but "Could
+not attach to queue pair with -20" is still there flooding the log.
+
+Since the error message can be useful in some cases, print it only once.
+
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 8b65323207db..1c9ecb18b8e6 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -568,8 +568,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
+ peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
+ out:
+ if (err < 0) {
+- pr_err("Could not attach to queue pair with %d\n",
+- err);
++ pr_err_once("Could not attach to queue pair with %d\n", err);
+ err = vmci_transport_error_to_vsock_error(err);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d0250ffe7a4fa12ead66a76e2658f8df4d598e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 17:37:06 +0100
+Subject: wilc1000: write value to WILC_INTR2_ENABLE register
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit e21b6e5a54628cd3935f200049d4430c25c54e03 ]
+
+Write the value instead of reading it twice.
+
+Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210224163706.519658-1-marcus.folkesson@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/sdio.c b/drivers/net/wireless/microchip/wilc1000/sdio.c
+index 351ff909ab1c..e14b9fc2c67a 100644
+--- a/drivers/net/wireless/microchip/wilc1000/sdio.c
++++ b/drivers/net/wireless/microchip/wilc1000/sdio.c
+@@ -947,7 +947,7 @@ static int wilc_sdio_sync_ext(struct wilc *wilc, int nint)
+ for (i = 0; (i < 3) && (nint > 0); i++, nint--)
+ reg |= BIT(i);
+
+- ret = wilc_sdio_read_reg(wilc, WILC_INTR2_ENABLE, ®);
++ ret = wilc_sdio_write_reg(wilc, WILC_INTR2_ENABLE, reg);
+ if (ret) {
+ dev_err(&func->dev,
+ "Failed write reg (%08x)...\n",
+--
+2.30.2
+
--- /dev/null
+From 4c9ec06da58772075b7811a0242f3b300c4d4d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 15:14:05 +0100
+Subject: wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ]
+
+The size of the buffer than can be written to is currently incorrect, it is
+always the size of the entire buffer even though the snprintf is writing
+as position pos into the buffer. Fix this by setting the buffer size to be
+the number of bytes left in the buffer, namely sizeof(buf) - pos.
+
+Addresses-Coverity: ("Out-of-bounds access")
+Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210419141405.180582-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wlcore/debugfs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
+index 715edfa5f89f..a9e13e6d65c5 100644
+--- a/drivers/net/wireless/ti/wlcore/debugfs.h
++++ b/drivers/net/wireless/ti/wlcore/debugfs.h
+@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file, \
+ wl1271_debugfs_update_stats(wl); \
+ \
+ for (i = 0; i < len && pos < sizeof(buf); i++) \
+- pos += snprintf(buf + pos, sizeof(buf), \
++ pos += snprintf(buf + pos, sizeof(buf) - pos, \
+ "[%d] = %d\n", i, stats->sub.name[i]); \
+ \
+ return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \
+--
+2.30.2
+
--- /dev/null
+From 1f21dc79103ce4234821bec96acab937654b1a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 13:57:14 +0100
+Subject: wlcore: fix overlapping snprintf arguments in debugfs
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7b0e2c4f6be3ec68bf807c84e985e81c21404cd1 ]
+
+gcc complains about undefined behavior in calling snprintf()
+with the same buffer as input and output:
+
+drivers/net/wireless/ti/wl18xx/debugfs.c: In function 'diversity_num_of_packets_per_ant_read':
+drivers/net/wireless/ti/wl18xx/../wlcore/debugfs.h:86:3: error: 'snprintf' argument 4 overlaps destination object 'buf' [-Werror=restrict]
+ 86 | snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 87 | buf, i, stats->sub.name[i]); \
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/wireless/ti/wl18xx/debugfs.c:24:2: note: in expansion of macro 'DEBUGFS_FWSTATS_FILE_ARRAY'
+ 24 | DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/wireless/ti/wl18xx/debugfs.c:159:1: note: in expansion of macro 'WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY'
+ 159 | WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(diversity, num_of_packets_per_ant,
+
+There are probably other ways of handling the debugfs file, without
+using on-stack buffers, but a simple workaround here is to remember the
+current position in the buffer and just keep printing in there.
+
+Fixes: bcca1bbdd412 ("wlcore: add debugfs macro to help print fw statistics arrays")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210323125723.1961432-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wlcore/boot.c | 13 ++++++++-----
+ drivers/net/wireless/ti/wlcore/debugfs.h | 7 ++++---
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
+index e14d88e558f0..85abd0a2d1c9 100644
+--- a/drivers/net/wireless/ti/wlcore/boot.c
++++ b/drivers/net/wireless/ti/wlcore/boot.c
+@@ -72,6 +72,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
+ unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_MULTI) ?
+ wl->min_mr_fw_ver : wl->min_sr_fw_ver;
+ char min_fw_str[32] = "";
++ int off = 0;
+ int i;
+
+ /* the chip must be exactly equal */
+@@ -105,13 +106,15 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
+ return 0;
+
+ fail:
+- for (i = 0; i < NUM_FW_VER; i++)
++ for (i = 0; i < NUM_FW_VER && off < sizeof(min_fw_str); i++)
+ if (min_ver[i] == WLCORE_FW_VER_IGNORE)
+- snprintf(min_fw_str, sizeof(min_fw_str),
+- "%s*.", min_fw_str);
++ off += snprintf(min_fw_str + off,
++ sizeof(min_fw_str) - off,
++ "*.");
+ else
+- snprintf(min_fw_str, sizeof(min_fw_str),
+- "%s%u.", min_fw_str, min_ver[i]);
++ off += snprintf(min_fw_str + off,
++ sizeof(min_fw_str) - off,
++ "%u.", min_ver[i]);
+
+ wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n"
+ "Please use at least FW %s\n"
+diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
+index b143293e694f..715edfa5f89f 100644
+--- a/drivers/net/wireless/ti/wlcore/debugfs.h
++++ b/drivers/net/wireless/ti/wlcore/debugfs.h
+@@ -78,13 +78,14 @@ static ssize_t sub## _ ##name## _read(struct file *file, \
+ struct wl1271 *wl = file->private_data; \
+ struct struct_type *stats = wl->stats.fw_stats; \
+ char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = ""; \
++ int pos = 0; \
+ int i; \
+ \
+ wl1271_debugfs_update_stats(wl); \
+ \
+- for (i = 0; i < len; i++) \
+- snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \
+- buf, i, stats->sub.name[i]); \
++ for (i = 0; i < len && pos < sizeof(buf); i++) \
++ pos += snprintf(buf + pos, sizeof(buf), \
++ "[%d] = %d\n", i, stats->sub.name[i]); \
+ \
+ return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \
+ } \
+--
+2.30.2
+
--- /dev/null
+From fc92ce80de024bd5225651c002c24059aef4b220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 17:11:11 -0700
+Subject: x86/events/amd/iommu: Fix sysfs type mismatch
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ]
+
+dev_attr_show() calls _iommu_event_show() via an indirect call but
+_iommu_event_show()'s type does not currently match the type of the
+show() member in 'struct device_attribute', resulting in a Control Flow
+Integrity violation.
+
+$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit
+csource=0x0a
+
+$ dmesg | grep "CFI failure"
+[ 3526.735140] CFI failure (target: _iommu_event_show...):
+
+Change _iommu_event_show() and 'struct amd_iommu_event_desc' to
+'struct device_attribute' so that there is no more CFI violation.
+
+Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
+index be50ef8572cc..6a98a7651621 100644
+--- a/arch/x86/events/amd/iommu.c
++++ b/arch/x86/events/amd/iommu.c
+@@ -81,12 +81,12 @@ static struct attribute_group amd_iommu_events_group = {
+ };
+
+ struct amd_iommu_event_desc {
+- struct kobj_attribute attr;
++ struct device_attribute attr;
+ const char *event;
+ };
+
+-static ssize_t _iommu_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf)
++static ssize_t _iommu_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct amd_iommu_event_desc *event =
+ container_of(attr, struct amd_iommu_event_desc, attr);
+--
+2.30.2
+
--- /dev/null
+From 38476dcee231d81a4cd88662dbe5a345699890c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 19:08:31 +0900
+Subject: x86/kprobes: Fix to check non boostable prefixes correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ]
+
+There are 2 bugs in the can_boost() function because of using
+x86 insn decoder. Since the insn->opcode never has a prefix byte,
+it can not find CS override prefix in it. And the insn->attr is
+the attribute of the opcode, thus inat_is_address_size_prefix(
+insn->attr) always returns false.
+
+Fix those by checking each prefix bytes with for_each_insn_prefix
+loop and getting the correct attribute for each prefix byte.
+Also, this removes unlikely, because this is a slow path.
+
+Fixes: a8d11cd0714f ("kprobes/x86: Consolidate insn decoder users for copying code")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/161666691162.1120877.2808435205294352583.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 08674e7a5d7b..0bb9fe021bbe 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -139,6 +139,8 @@ NOKPROBE_SYMBOL(synthesize_relcall);
+ int can_boost(struct insn *insn, void *addr)
+ {
+ kprobe_opcode_t opcode;
++ insn_byte_t prefix;
++ int i;
+
+ if (search_exception_tables((unsigned long)addr))
+ return 0; /* Page fault may occur on this address. */
+@@ -151,9 +153,14 @@ int can_boost(struct insn *insn, void *addr)
+ if (insn->opcode.nbytes != 1)
+ return 0;
+
+- /* Can't boost Address-size override prefix */
+- if (unlikely(inat_is_address_size_prefix(insn->attr)))
+- return 0;
++ for_each_insn_prefix(insn, i, prefix) {
++ insn_attr_t attr;
++
++ attr = inat_get_opcode_attribute(prefix);
++ /* Can't boost Address-size override prefix and CS override prefix */
++ if (prefix == 0x2e || inat_is_address_size_prefix(attr))
++ return 0;
++ }
+
+ opcode = insn->opcode.bytes[0];
+
+@@ -178,8 +185,8 @@ int can_boost(struct insn *insn, void *addr)
+ /* clear and set flags are boostable */
+ return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));
+ default:
+- /* CS override prefix and call are not boostable */
+- return (opcode != 0x2e && opcode != 0x9a);
++ /* call is not boostable */
++ return opcode != 0x9a;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 328bcc7b5a049f553d75502122f944dcb1ff848e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 00:25:24 +0900
+Subject: x86/kprobes: Retrieve correct opcode for group instruction
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit d60ad3d46f1d04a282c56159f1deb675c12733fd ]
+
+Since the opcodes start from 0xff are group5 instruction group which is
+not 2 bytes opcode but the extended opcode determined by the MOD/RM byte.
+
+The commit abd82e533d88 ("x86/kprobes: Do not decode opcode in resume_execution()")
+used insn->opcode.bytes[1], but that is not correct. We have to refer
+the insn->modrm.bytes[1] instead.
+
+Fixes: abd82e533d88 ("x86/kprobes: Do not decode opcode in resume_execution()")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/161469872400.49483.18214724458034233166.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index df776cdca327..08674e7a5d7b 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -448,7 +448,11 @@ static void set_resume_flags(struct kprobe *p, struct insn *insn)
+ break;
+ #endif
+ case 0xff:
+- opcode = insn->opcode.bytes[1];
++ /*
++ * Since the 0xff is an extended group opcode, the instruction
++ * is determined by the MOD/RM byte.
++ */
++ opcode = insn->modrm.bytes[0];
+ if ((opcode & 0x30) == 0x10) {
+ /*
+ * call absolute, indirect
+--
+2.30.2
+
--- /dev/null
+From d47425ac6699504128587b1b9236082985005386 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 09:55:15 -0700
+Subject: x86/microcode: Check for offline CPUs before requesting new microcode
+
+From: Otavio Pontes <otavio.pontes@intel.com>
+
+[ Upstream commit 7189b3c11903667808029ec9766a6e96de5012a5 ]
+
+Currently, the late microcode loading mechanism checks whether any CPUs
+are offlined, and, in such a case, aborts the load attempt.
+
+However, this must be done before the kernel caches new microcode from
+the filesystem. Otherwise, when offlined CPUs are onlined later, those
+cores are going to be updated through the CPU hotplug notifier callback
+with the new microcode, while CPUs previously onine will continue to run
+with the older microcode.
+
+For example:
+
+Turn off one core (2 threads):
+
+ echo 0 > /sys/devices/system/cpu/cpu3/online
+ echo 0 > /sys/devices/system/cpu/cpu1/online
+
+Install the ucode fails because a primary SMT thread is offline:
+
+ cp intel-ucode/06-8e-09 /lib/firmware/intel-ucode/
+ echo 1 > /sys/devices/system/cpu/microcode/reload
+ bash: echo: write error: Invalid argument
+
+Turn the core back on
+
+ echo 1 > /sys/devices/system/cpu/cpu3/online
+ echo 1 > /sys/devices/system/cpu/cpu1/online
+ cat /proc/cpuinfo |grep microcode
+ microcode : 0x30
+ microcode : 0xde
+ microcode : 0x30
+ microcode : 0xde
+
+The rationale for why the update is aborted when at least one primary
+thread is offline is because even if that thread is soft-offlined
+and idle, it will still have to participate in broadcasted MCE's
+synchronization dance or enter SMM, and in both examples it will execute
+instructions so it better have the same microcode revision as the other
+cores.
+
+ [ bp: Heavily edit and extend commit message with the reasoning behind all
+ this. ]
+
+Fixes: 30ec26da9967 ("x86/microcode: Do not upload microcode if CPUs are offline")
+Signed-off-by: Otavio Pontes <otavio.pontes@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Ashok Raj <ashok.raj@intel.com>
+Link: https://lkml.kernel.org/r/20210319165515.9240-2-otavio.pontes@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/microcode/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index b935e1b5f115..6a6318e9590c 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -629,16 +629,16 @@ static ssize_t reload_store(struct device *dev,
+ if (val != 1)
+ return size;
+
+- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
+- if (tmp_ret != UCODE_NEW)
+- return size;
+-
+ get_online_cpus();
+
+ ret = check_online_cpus();
+ if (ret)
+ goto put;
+
++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
++ if (tmp_ret != UCODE_NEW)
++ goto put;
++
+ mutex_lock(µcode_mutex);
+ ret = microcode_reload_late();
+ mutex_unlock(µcode_mutex);
+--
+2.30.2
+
--- /dev/null
+From 2dd6b5994cad682c76fae1385a77e6b2fc478cb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 09:47:42 +0200
+Subject: x86/platform/uv: Fix !KEXEC build failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit c2209ea55612efac75de0a58ef5f7394fae7fa0f ]
+
+When KEXEC is disabled, the UV build fails:
+
+ arch/x86/platform/uv/uv_nmi.c:875:14: error: ‘uv_nmi_kexec_failed’ undeclared (first use in this function)
+
+Since uv_nmi_kexec_failed is only defined in the KEXEC_CORE #ifdef branch,
+this code cannot ever have been build tested:
+
+ if (main)
+ pr_err("UV: NMI kdump: KEXEC not supported in this kernel\n");
+ atomic_set(&uv_nmi_kexec_failed, 1);
+
+Nor is this use possible in uv_handle_nmi():
+
+ atomic_set(&uv_nmi_kexec_failed, 0);
+
+These bugs were introduced in this commit:
+
+ d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails")
+
+Which added the uv_nmi_kexec_failed assignments to !KEXEC code, while making the
+definition KEXEC-only - apparently without testing the !KEXEC case.
+
+Instead of complicating the #ifdef maze, simplify the code by requiring X86_UV
+to depend on KEXEC_CORE. This pattern is present in other architectures as well.
+
+( We'll remove the untested, 7 years old !KEXEC complications from the file in a
+ separate commit. )
+
+Fixes: d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Mike Travis <travis@sgi.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 268b7d5c9835..861b1b794697 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -571,6 +571,7 @@ config X86_UV
+ depends on X86_EXTENDED_PLATFORM
+ depends on NUMA
+ depends on EFI
++ depends on KEXEC_CORE
+ depends on X86_X2APIC
+ depends on PCI
+ help
+--
+2.30.2
+
--- /dev/null
+From 73902128ee034e52c690cfb8bcc6a74164d077c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 10:28:53 -0600
+Subject: x86/platform/uv: Set section block size for hubless architectures
+
+From: Mike Travis <mike.travis@hpe.com>
+
+[ Upstream commit 6840a150b9daf35e4d21ab9780d0a03b4ed74a5b ]
+
+Commit
+
+ bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function")
+
+added a call to set the block size value that is needed by the kernel
+to set the boundaries in the section list. This was done for UV Hubbed
+systems but missed in the UV Hubless setup. Fix that mistake by adding
+that same set call for hubless systems, which support the same NVRAMs
+and Intel BIOS, thus the same problem occurs.
+
+ [ bp: Massage commit message. ]
+
+Fixes: bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function")
+Signed-off-by: Mike Travis <mike.travis@hpe.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Steve Wahl <steve.wahl@hpe.com>
+Reviewed-by: Russ Anderson <rja@hpe.com>
+Link: https://lkml.kernel.org/r/20210305162853.299892-1-mike.travis@hpe.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 52bc217ca8c3..c9ddd233e32f 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -1671,6 +1671,9 @@ static __init int uv_system_init_hubless(void)
+ if (rc < 0)
+ return rc;
+
++ /* Set section block size for current node memory */
++ set_block_size();
++
+ /* Create user access node */
+ if (rc >= 0)
+ uv_setup_proc_files(1);
+--
+2.30.2
+
--- /dev/null
+From bd5e75622da1576aa3a79b03ee01635cc4eb7e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 07:43:57 +0100
+Subject: x86/vdso: Use proper modifier for len's format specifier in extract()
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit 70c9d959226b7c5c48c119e2c1cfc1424f87b023 ]
+
+Commit
+
+ 8382c668ce4f ("x86/vdso: Add support for exception fixup in vDSO functions")
+
+prints length "len" which is size_t.
+
+Compilers now complain when building on a 32-bit host:
+
+ HOSTCC arch/x86/entry/vdso/vdso2c
+ ...
+ In file included from arch/x86/entry/vdso/vdso2c.c:162:
+ arch/x86/entry/vdso/vdso2c.h: In function 'extract64':
+ arch/x86/entry/vdso/vdso2c.h:38:52: warning: format '%lu' expects argument of \
+ type 'long unsigned int', but argument 4 has type 'size_t' {aka 'unsigned int'}
+
+So use proper modifier (%zu) for size_t.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 8382c668ce4f ("x86/vdso: Add support for exception fixup in vDSO functions")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://lkml.kernel.org/r/20210303064357.17056-1-jslaby@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vdso/vdso2c.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h
+index 1c7cfac7e64a..5264daa8859f 100644
+--- a/arch/x86/entry/vdso/vdso2c.h
++++ b/arch/x86/entry/vdso/vdso2c.h
+@@ -35,7 +35,7 @@ static void BITSFUNC(extract)(const unsigned char *data, size_t data_len,
+ if (offset + len > data_len)
+ fail("section to extract overruns input data");
+
+- fprintf(outfile, "static const unsigned char %s[%lu] = {", name, len);
++ fprintf(outfile, "static const unsigned char %s[%zu] = {", name, len);
+ BITSFUNC(copy)(outfile, data + offset, len);
+ fprintf(outfile, "\n};\n\n");
+ }
+--
+2.30.2
+
--- /dev/null
+From aa71a3f159a2dfafd6c0cb5158365e5b5dfc8f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:56:59 +0000
+Subject: xen-blkback: fix compatibility bug with single page rings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Durrant <pdurrant@amazon.com>
+
+[ Upstream commit d75e7f63b7c95c527cde42efb5d410d7f961498f ]
+
+Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid
+inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the
+behaviour of xen-blkback when connecting to a frontend was:
+
+- read 'ring-page-order'
+- if not present then expect a single page ring specified by 'ring-ref'
+- else expect a ring specified by 'ring-refX' where X is between 0 and
+ 1 << ring-page-order
+
+This was correct behaviour, but was broken by the afforementioned commit to
+become:
+
+- read 'ring-page-order'
+- if not present then expect a single page ring (i.e. ring-page-order = 0)
+- expect a ring specified by 'ring-refX' where X is between 0 and
+ 1 << ring-page-order
+- if that didn't work then see if there's a single page ring specified by
+ 'ring-ref'
+
+This incorrect behaviour works most of the time but fails when a frontend
+that sets 'ring-page-order' is unloaded and replaced by one that does not
+because, instead of reading 'ring-ref', xen-blkback will read the stale
+'ring-ref0' left around by the previous frontend will try to map the wrong
+grant reference.
+
+This patch restores the original behaviour.
+
+Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront")
+Signed-off-by: Paul Durrant <pdurrant@amazon.com>
+Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>
+Reviewed-by: "Roger Pau Monné" <roger.pau@citrix.com>
+Link: https://lore.kernel.org/r/20210202175659.18452-1-paul@xen.org
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/xen-blkback/common.h | 1 +
+ drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++-----------------
+ 2 files changed, 17 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
+index b0c71d3a81a0..bda5c815e441 100644
+--- a/drivers/block/xen-blkback/common.h
++++ b/drivers/block/xen-blkback/common.h
+@@ -313,6 +313,7 @@ struct xen_blkif {
+
+ struct work_struct free_work;
+ unsigned int nr_ring_pages;
++ bool multi_ref;
+ /* All rings for this device. */
+ struct xen_blkif_ring *rings;
+ unsigned int nr_rings;
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index c2aaf690352c..125b22205d38 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -998,14 +998,17 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ for (i = 0; i < nr_grefs; i++) {
+ char ring_ref_name[RINGREF_NAME_LEN];
+
+- snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
++ if (blkif->multi_ref)
++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
++ else {
++ WARN_ON(i != 0);
++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref");
++ }
++
+ err = xenbus_scanf(XBT_NIL, dir, ring_ref_name,
+ "%u", &ring_ref[i]);
+
+ if (err != 1) {
+- if (nr_grefs == 1)
+- break;
+-
+ err = -EINVAL;
+ xenbus_dev_fatal(dev, err, "reading %s/%s",
+ dir, ring_ref_name);
+@@ -1013,18 +1016,6 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ }
+ }
+
+- if (err != 1) {
+- WARN_ON(nr_grefs != 1);
+-
+- err = xenbus_scanf(XBT_NIL, dir, "ring-ref", "%u",
+- &ring_ref[0]);
+- if (err != 1) {
+- err = -EINVAL;
+- xenbus_dev_fatal(dev, err, "reading %s/ring-ref", dir);
+- return err;
+- }
+- }
+-
+ err = -ENOMEM;
+ for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+@@ -1129,10 +1120,15 @@ static int connect_ring(struct backend_info *be)
+ blkif->nr_rings, blkif->blk_protocol, protocol,
+ blkif->vbd.feature_gnt_persistent ? "persistent grants" : "");
+
+- ring_page_order = xenbus_read_unsigned(dev->otherend,
+- "ring-page-order", 0);
+-
+- if (ring_page_order > xen_blkif_max_ring_order) {
++ err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-page-order", "%u",
++ &ring_page_order);
++ if (err != 1) {
++ blkif->nr_ring_pages = 1;
++ blkif->multi_ref = false;
++ } else if (ring_page_order <= xen_blkif_max_ring_order) {
++ blkif->nr_ring_pages = 1 << ring_page_order;
++ blkif->multi_ref = true;
++ } else {
+ err = -EINVAL;
+ xenbus_dev_fatal(dev, err,
+ "requested ring page order %d exceed max:%d",
+@@ -1141,8 +1137,6 @@ static int connect_ring(struct backend_info *be)
+ return err;
+ }
+
+- blkif->nr_ring_pages = 1 << ring_page_order;
+-
+ if (blkif->nr_rings == 1)
+ return read_per_ring_refs(&blkif->rings[0], dev->otherend);
+ else {
+--
+2.30.2
+
--- /dev/null
+From e1c77405e06703c70a95eeb4b11119a1f8d0c364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 10:27:34 -0700
+Subject: xfs: fix return of uninitialized value in variable error
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 3b6dd9a9aeeada19d0c820ff68e979243a888bb6 ]
+
+A previous commit removed a call to xfs_attr3_leaf_read that
+assigned an error return code to variable error. We now have
+a few early error return paths to label 'out' that return
+error if error is set; however error now is uninitialized
+so potentially garbage is being returned. Fix this by setting
+error to zero to restore the original behaviour where error
+was zero at the label 'restart'.
+
+Addresses-Coverity: ("Uninitialized scalar variable")
+Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_attr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
+index 472b3039eabb..902e5f7e6642 100644
+--- a/fs/xfs/libxfs/xfs_attr.c
++++ b/fs/xfs/libxfs/xfs_attr.c
+@@ -928,6 +928,7 @@ restart:
+ * Search to see if name already exists, and get back a pointer
+ * to where it should go.
+ */
++ error = 0;
+ retval = xfs_attr_node_hasname(args, &state);
+ if (retval != -ENOATTR && retval != -EEXIST)
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From 048283b25537f87663983e4d242d8c19fe1cf88c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 20:50:31 +0000
+Subject: xsk: Respect device's headroom and tailroom on generic xmit path
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 3914d88f7608e6c2e80e344474fa289370c32451 ]
+
+xsk_generic_xmit() allocates a new skb and then queues it for
+xmitting. The size of new skb's headroom is desc->len, so it comes
+to the driver/device with no reserved headroom and/or tailroom.
+Lots of drivers need some headroom (and sometimes tailroom) to
+prepend (and/or append) some headers or data, e.g. CPU tags,
+device-specific headers/descriptors (LSO, TLS etc.), and if case
+of no available space skb_cow_head() will reallocate the skb.
+Reallocations are unwanted on fast-path, especially when it comes
+to XDP, so generic XSK xmit should reserve the spaces declared in
+dev->needed_headroom and dev->needed tailroom to avoid them.
+
+Note on max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom)):
+
+Usually, output functions reserve LL_RESERVED_SPACE(dev), which
+consists of dev->hard_header_len + dev->needed_headroom, aligned
+by 16.
+
+However, on XSK xmit hard header is already here in the chunk, so
+hard_header_len is not needed. But it'd still be better to align
+data up to cacheline, while reserving no less than driver requests
+for headroom. NET_SKB_PAD here is to double-insure there will be
+no reallocations even when the driver advertises no needed_headroom,
+but in fact need it (not so rare case).
+
+Fixes: 35fcde7f8deb ("xsk: support for Tx")
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20210218204908.5455-5-alobakin@pm.me
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 4faabd1ecfd1..143979ea4165 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -454,12 +454,16 @@ static int xsk_generic_xmit(struct sock *sk)
+ struct sk_buff *skb;
+ unsigned long flags;
+ int err = 0;
++ u32 hr, tr;
+
+ mutex_lock(&xs->mutex);
+
+ if (xs->queue_id >= xs->dev->real_num_tx_queues)
+ goto out;
+
++ hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(xs->dev->needed_headroom));
++ tr = xs->dev->needed_tailroom;
++
+ while (xskq_cons_peek_desc(xs->tx, &desc, xs->pool)) {
+ char *buffer;
+ u64 addr;
+@@ -471,11 +475,13 @@ static int xsk_generic_xmit(struct sock *sk)
+ }
+
+ len = desc.len;
+- skb = sock_alloc_send_skb(sk, len, 1, &err);
++ skb = sock_alloc_send_skb(sk, hr + len + tr, 1, &err);
+ if (unlikely(!skb))
+ goto out;
+
++ skb_reserve(skb, hr);
+ skb_put(skb, len);
++
+ addr = desc.addr;
+ buffer = xsk_buff_raw_get_data(xs->pool, addr);
+ err = skb_store_bits(skb, 0, buffer, len);
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
