--- /dev/null
+From 0e5fd5a9d8d168dd269dbd563ca410a96f005afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 16:28:27 +0200
+Subject: ARM: dts: at91: use the right property for shutdown controller
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 818c4593434e81c9971b8fc278215121622c755e ]
+
+The wrong property "atmel,shdwc-debouncer" was used to specify the
+debounce delay for the shutdown controler. Replace it with the
+documented and implemented property "debounce-delay-us", as mentioned
+in v4 driver submission. See:
+https://lore.kernel.org/r/1458134390-23847-3-git-send-email-nicolas.ferre@atmel.com/
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Reported-by: Clément Léger <clement.leger@bootlin.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20210730172729.28093-1-nicolas.ferre@microchip.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-kizbox3_common.dtsi | 2 +-
+ arch/arm/boot/dts/at91-sam9x60ek.dts | 2 +-
+ arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 2 +-
+ arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 2 +-
+ arch/arm/boot/dts/at91-sama5d2_icp.dts | 2 +-
+ arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 2 +-
+ arch/arm/boot/dts/at91-sama5d2_xplained.dts | 2 +-
+ 7 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91-kizbox3_common.dtsi b/arch/arm/boot/dts/at91-kizbox3_common.dtsi
+index c4b3750495da..abe27adfa4d6 100644
+--- a/arch/arm/boot/dts/at91-kizbox3_common.dtsi
++++ b/arch/arm/boot/dts/at91-kizbox3_common.dtsi
+@@ -336,7 +336,7 @@ &pwm0 {
+ };
+
+ &shutdown_controller {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ atmel,wakeup-rtc-timer;
+
+ input@0 {
+diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
+index ebbc9b23aef1..b1068cca4228 100644
+--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
+@@ -662,7 +662,7 @@ &rtt {
+ };
+
+ &shutdown_controller {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ status = "okay";
+
+ input@0 {
+diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+index a9e6fee55a2a..8034e5dacc80 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+@@ -138,7 +138,7 @@ i2c3: i2c@600 {
+ };
+
+ shdwc@f8048010 {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ atmel,wakeup-rtc-timer;
+
+ input@0 {
+diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
+index ff83967fd008..c145c4e5ef58 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
+@@ -205,7 +205,7 @@ &sdmmc0 {
+ };
+
+ &shutdown_controller {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ atmel,wakeup-rtc-timer;
+
+ input@0 {
+diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts
+index bd64721fa23c..34faca597c35 100644
+--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts
+@@ -693,7 +693,7 @@ &sdmmc0 {
+ };
+
+ &shutdown_controller {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ atmel,wakeup-rtc-timer;
+
+ input@0 {
+diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+index dfd150eb0fd8..3f972a4086c3 100644
+--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+@@ -203,7 +203,7 @@ i2c2: i2c@600 {
+ };
+
+ shdwc@f8048010 {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+
+ input@0 {
+ reg = <0>;
+diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+index 509c732a0d8b..627b7bf88d83 100644
+--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+@@ -347,7 +347,7 @@ i2c2: i2c@600 {
+ };
+
+ shdwc@f8048010 {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ atmel,wakeup-rtc-timer;
+
+ input@0 {
+--
+2.30.2
+
--- /dev/null
+From 5a3cbe19077e2430e49eda861b9fa4f674562958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 19:23:08 +0200
+Subject: ARM: dts: imx53-ppd: Fix ACHC entry
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit cd7cd5b716d594e27a933c12f026d4f2426d7bf4 ]
+
+PPD has only one ACHC device, which effectively is a Kinetis
+microcontroller. It has one SPI interface used for normal
+communication. Additionally it's possible to flash the device
+firmware using NXP's EzPort protocol by correctly driving a
+second chip select pin and the device reset pin.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20210802172309.164365-3-sebastian.reichel@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-ppd.dts | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index 5a5fa6190a52..37d0cffea99c 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -70,6 +70,12 @@ cko2_11M: sgtl-clock-cko2 {
+ clock-frequency = <11289600>;
+ };
+
++ achc_24M: achc-clock {
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ clock-frequency = <24000000>;
++ };
++
+ sgtlsound: sound {
+ compatible = "fsl,imx53-cpuvo-sgtl5000",
+ "fsl,imx-audio-sgtl5000";
+@@ -314,16 +320,13 @@ &gpio4 11 GPIO_ACTIVE_LOW
+ &gpio4 12 GPIO_ACTIVE_LOW>;
+ status = "okay";
+
+- spidev0: spi@0 {
+- compatible = "ge,achc";
+- reg = <0>;
+- spi-max-frequency = <1000000>;
+- };
+-
+- spidev1: spi@1 {
+- compatible = "ge,achc";
+- reg = <1>;
+- spi-max-frequency = <1000000>;
++ spidev0: spi@1 {
++ compatible = "ge,achc", "nxp,kinetis-k20";
++ reg = <1>, <0>;
++ vdd-supply = <®_3v3>;
++ vdda-supply = <®_3v3>;
++ clocks = <&achc_24M>;
++ reset-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
+ };
+
+ gpioxra0: gpio@2 {
+--
+2.30.2
+
--- /dev/null
+From ba6c2eceb1e28e6837b921325e2f769e7c106031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 10:39:34 +0200
+Subject: ARM: dts: ixp4xx: Fix up bad interrupt flags
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit f775d2150cb48bece63270fdefc2a0c69cf17f0f ]
+
+The PCI hosts had bad IRQ semantics, these are all active low.
+Use the proper define and fix all in-tree users.
+
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/intel-ixp42x-linksys-nslu2.dts | 24 +++++-----
+ .../dts/intel-ixp43x-gateworks-gw2358.dts | 48 +++++++++----------
+ 2 files changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/arch/arm/boot/dts/intel-ixp42x-linksys-nslu2.dts b/arch/arm/boot/dts/intel-ixp42x-linksys-nslu2.dts
+index 5b8dcc19deee..b9a5268fe7ad 100644
+--- a/arch/arm/boot/dts/intel-ixp42x-linksys-nslu2.dts
++++ b/arch/arm/boot/dts/intel-ixp42x-linksys-nslu2.dts
+@@ -124,20 +124,20 @@ pci@c0000000 {
+ */
+ interrupt-map =
+ /* IDSEL 1 */
+- <0x0800 0 0 1 &gpio0 11 3>, /* INT A on slot 1 is irq 11 */
+- <0x0800 0 0 2 &gpio0 10 3>, /* INT B on slot 1 is irq 10 */
+- <0x0800 0 0 3 &gpio0 9 3>, /* INT C on slot 1 is irq 9 */
+- <0x0800 0 0 4 &gpio0 8 3>, /* INT D on slot 1 is irq 8 */
++ <0x0800 0 0 1 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 1 is irq 11 */
++ <0x0800 0 0 2 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 1 is irq 10 */
++ <0x0800 0 0 3 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 1 is irq 9 */
++ <0x0800 0 0 4 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 1 is irq 8 */
+ /* IDSEL 2 */
+- <0x1000 0 0 1 &gpio0 10 3>, /* INT A on slot 2 is irq 10 */
+- <0x1000 0 0 2 &gpio0 9 3>, /* INT B on slot 2 is irq 9 */
+- <0x1000 0 0 3 &gpio0 11 3>, /* INT C on slot 2 is irq 11 */
+- <0x1000 0 0 4 &gpio0 8 3>, /* INT D on slot 2 is irq 8 */
++ <0x1000 0 0 1 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 2 is irq 10 */
++ <0x1000 0 0 2 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 2 is irq 9 */
++ <0x1000 0 0 3 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 2 is irq 11 */
++ <0x1000 0 0 4 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 2 is irq 8 */
+ /* IDSEL 3 */
+- <0x1800 0 0 1 &gpio0 9 3>, /* INT A on slot 3 is irq 9 */
+- <0x1800 0 0 2 &gpio0 11 3>, /* INT B on slot 3 is irq 11 */
+- <0x1800 0 0 3 &gpio0 10 3>, /* INT C on slot 3 is irq 10 */
+- <0x1800 0 0 4 &gpio0 8 3>; /* INT D on slot 3 is irq 8 */
++ <0x1800 0 0 1 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 3 is irq 9 */
++ <0x1800 0 0 2 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 3 is irq 11 */
++ <0x1800 0 0 3 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 3 is irq 10 */
++ <0x1800 0 0 4 &gpio0 8 IRQ_TYPE_LEVEL_LOW>; /* INT D on slot 3 is irq 8 */
+ };
+
+ ethernet@c8009000 {
+diff --git a/arch/arm/boot/dts/intel-ixp43x-gateworks-gw2358.dts b/arch/arm/boot/dts/intel-ixp43x-gateworks-gw2358.dts
+index 60a1228a970f..f5fe309f7762 100644
+--- a/arch/arm/boot/dts/intel-ixp43x-gateworks-gw2358.dts
++++ b/arch/arm/boot/dts/intel-ixp43x-gateworks-gw2358.dts
+@@ -108,35 +108,35 @@ pci@c0000000 {
+ */
+ interrupt-map =
+ /* IDSEL 1 */
+- <0x0800 0 0 1 &gpio0 11 3>, /* INT A on slot 1 is irq 11 */
+- <0x0800 0 0 2 &gpio0 10 3>, /* INT B on slot 1 is irq 10 */
+- <0x0800 0 0 3 &gpio0 9 3>, /* INT C on slot 1 is irq 9 */
+- <0x0800 0 0 4 &gpio0 8 3>, /* INT D on slot 1 is irq 8 */
++ <0x0800 0 0 1 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 1 is irq 11 */
++ <0x0800 0 0 2 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 1 is irq 10 */
++ <0x0800 0 0 3 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 1 is irq 9 */
++ <0x0800 0 0 4 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 1 is irq 8 */
+ /* IDSEL 2 */
+- <0x1000 0 0 1 &gpio0 10 3>, /* INT A on slot 2 is irq 10 */
+- <0x1000 0 0 2 &gpio0 9 3>, /* INT B on slot 2 is irq 9 */
+- <0x1000 0 0 3 &gpio0 8 3>, /* INT C on slot 2 is irq 8 */
+- <0x1000 0 0 4 &gpio0 11 3>, /* INT D on slot 2 is irq 11 */
++ <0x1000 0 0 1 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 2 is irq 10 */
++ <0x1000 0 0 2 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 2 is irq 9 */
++ <0x1000 0 0 3 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 2 is irq 8 */
++ <0x1000 0 0 4 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 2 is irq 11 */
+ /* IDSEL 3 */
+- <0x1800 0 0 1 &gpio0 9 3>, /* INT A on slot 3 is irq 9 */
+- <0x1800 0 0 2 &gpio0 8 3>, /* INT B on slot 3 is irq 8 */
+- <0x1800 0 0 3 &gpio0 11 3>, /* INT C on slot 3 is irq 11 */
+- <0x1800 0 0 4 &gpio0 10 3>, /* INT D on slot 3 is irq 10 */
++ <0x1800 0 0 1 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 3 is irq 9 */
++ <0x1800 0 0 2 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 3 is irq 8 */
++ <0x1800 0 0 3 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 3 is irq 11 */
++ <0x1800 0 0 4 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 3 is irq 10 */
+ /* IDSEL 4 */
+- <0x2000 0 0 1 &gpio0 8 3>, /* INT A on slot 3 is irq 8 */
+- <0x2000 0 0 2 &gpio0 11 3>, /* INT B on slot 3 is irq 11 */
+- <0x2000 0 0 3 &gpio0 10 3>, /* INT C on slot 3 is irq 10 */
+- <0x2000 0 0 4 &gpio0 9 3>, /* INT D on slot 3 is irq 9 */
++ <0x2000 0 0 1 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 3 is irq 8 */
++ <0x2000 0 0 2 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 3 is irq 11 */
++ <0x2000 0 0 3 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 3 is irq 10 */
++ <0x2000 0 0 4 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 3 is irq 9 */
+ /* IDSEL 6 */
+- <0x3000 0 0 1 &gpio0 10 3>, /* INT A on slot 3 is irq 10 */
+- <0x3000 0 0 2 &gpio0 9 3>, /* INT B on slot 3 is irq 9 */
+- <0x3000 0 0 3 &gpio0 8 3>, /* INT C on slot 3 is irq 8 */
+- <0x3000 0 0 4 &gpio0 11 3>, /* INT D on slot 3 is irq 11 */
++ <0x3000 0 0 1 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 3 is irq 10 */
++ <0x3000 0 0 2 &gpio0 9 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 3 is irq 9 */
++ <0x3000 0 0 3 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 3 is irq 8 */
++ <0x3000 0 0 4 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT D on slot 3 is irq 11 */
+ /* IDSEL 15 */
+- <0x7800 0 0 1 &gpio0 8 3>, /* INT A on slot 3 is irq 8 */
+- <0x7800 0 0 2 &gpio0 11 3>, /* INT B on slot 3 is irq 11 */
+- <0x7800 0 0 3 &gpio0 10 3>, /* INT C on slot 3 is irq 10 */
+- <0x7800 0 0 4 &gpio0 9 3>; /* INT D on slot 3 is irq 9 */
++ <0x7800 0 0 1 &gpio0 8 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 3 is irq 8 */
++ <0x7800 0 0 2 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT B on slot 3 is irq 11 */
++ <0x7800 0 0 3 &gpio0 10 IRQ_TYPE_LEVEL_LOW>, /* INT C on slot 3 is irq 10 */
++ <0x7800 0 0 4 &gpio0 9 IRQ_TYPE_LEVEL_LOW>; /* INT D on slot 3 is irq 9 */
+ };
+
+ ethernet@c800a000 {
+--
+2.30.2
+
--- /dev/null
+From 37c5eac26ce0d159435b8a12f0428e8f403ac890 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 15:14:53 +0200
+Subject: ARM: dts: qcom: apq8064: correct clock names
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 0dc6c59892ead17a9febd11202c9f6794aac1895 ]
+
+Since new code doesn't take old clk names in account, it does fixes
+error:
+
+msm_dsi 4700000.mdss_dsi: dev_pm_opp_set_clkname: Couldn't find clock: -2
+
+and following kernel oops introduced by
+b0530eb1191 ("drm/msm/dpu: Use OPP API to set clk/perf state").
+
+Also removes warning about deprecated clock names.
+
+Tested against linux-5.10.y LTS on Nexus 7 2013.
+
+Reviewed-by: Brian Masney <masneyb@onstation.org>
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Link: https://lore.kernel.org/r/20210707131453.24041-1-david@ixit.cz
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 2687c4e890ba..e36d590e8373 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1262,9 +1262,9 @@ dsi0: mdss_dsi@4700000 {
+ <&mmcc DSI1_BYTE_CLK>,
+ <&mmcc DSI_PIXEL_CLK>,
+ <&mmcc DSI1_ESC_CLK>;
+- clock-names = "iface_clk", "bus_clk", "core_mmss_clk",
+- "src_clk", "byte_clk", "pixel_clk",
+- "core_clk";
++ clock-names = "iface", "bus", "core_mmss",
++ "src", "byte", "pixel",
++ "core";
+
+ assigned-clocks = <&mmcc DSI1_BYTE_SRC>,
+ <&mmcc DSI1_ESC_SRC>,
+--
+2.30.2
+
--- /dev/null
+From 36432a6b346ea9301ccbd6a706ea417d25922f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jun 2021 17:02:41 +0200
+Subject: ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit a79e78c391dc074742c855dc0108a88f781d56a3 ]
+
+Fix the following dtbs_check warning:
+arch/arm/boot/dts/stm32mp157c-dhcom-pdk2.dt.yaml: codec@a: port:endpoint@0:frame-master: True is not of type 'array'
+arch/arm/boot/dts/stm32mp157c-dhcom-pdk2.dt.yaml: codec@a: port:endpoint@0:bitclock-master: True is not of type 'array'
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: kernel@dh-electronics.com
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+index 6cf1c8b4c6e2..c9577ba2973d 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+@@ -172,15 +172,15 @@ sgtl5000_port: port {
+ sgtl5000_tx_endpoint: endpoint@0 {
+ reg = <0>;
+ remote-endpoint = <&sai2a_endpoint>;
+- frame-master;
+- bitclock-master;
++ frame-master = <&sgtl5000_tx_endpoint>;
++ bitclock-master = <&sgtl5000_tx_endpoint>;
+ };
+
+ sgtl5000_rx_endpoint: endpoint@1 {
+ reg = <1>;
+ remote-endpoint = <&sai2b_endpoint>;
+- frame-master;
+- bitclock-master;
++ frame-master = <&sgtl5000_rx_endpoint>;
++ bitclock-master = <&sgtl5000_rx_endpoint>;
+ };
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 48c0f8d04581820c7e168491193c2a29f9605e08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jun 2021 17:03:06 +0200
+Subject: ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 8aec45d7884f16cc21d668693c5b88bff8df0f02 ]
+
+Fix the following dtbs_check warning:
+cs42l51@4a: port:endpoint@0:frame-master: True is not of type 'array'
+cs42l51@4a: port:endpoint@0:bitclock-master: True is not of type 'array'
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+index 59f18846cf5d..586aac8a998c 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+@@ -220,15 +220,15 @@ cs42l51_port: port {
+ cs42l51_tx_endpoint: endpoint@0 {
+ reg = <0>;
+ remote-endpoint = <&sai2a_endpoint>;
+- frame-master;
+- bitclock-master;
++ frame-master = <&cs42l51_tx_endpoint>;
++ bitclock-master = <&cs42l51_tx_endpoint>;
+ };
+
+ cs42l51_rx_endpoint: endpoint@1 {
+ reg = <1>;
+ remote-endpoint = <&sai2b_endpoint>;
+- frame-master;
+- bitclock-master;
++ frame-master = <&cs42l51_rx_endpoint>;
++ bitclock-master = <&cs42l51_rx_endpoint>;
+ };
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 2822199e16e0cd4989423f07628c8ed8aa3db80d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Jun 2021 23:24:31 +0200
+Subject: ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 1e6bc5987a5252948e3411e5a2dbb434fd1ea107 ]
+
+Swap reg and reg-names order and drop adi,input-justification
+and adi,input-style to fix the following dtbs_check warnings:
+arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: adi,input-justification: False schema does not allow ['evenly']
+arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: adi,input-style: False schema does not allow [[1]]
+arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: reg-names:1: 'edid' was expected
+arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: reg-names:2: 'cec' was expected
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+index 64dca5b7f748..6885948f3024 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+@@ -220,8 +220,8 @@ &i2c2 { /* X6 I2C2 */
+ &i2c4 {
+ hdmi-transmitter@3d {
+ compatible = "adi,adv7513";
+- reg = <0x3d>, <0x2d>, <0x4d>, <0x5d>;
+- reg-names = "main", "cec", "edid", "packet";
++ reg = <0x3d>, <0x4d>, <0x2d>, <0x5d>;
++ reg-names = "main", "edid", "cec", "packet";
+ clocks = <&cec_clock>;
+ clock-names = "cec";
+
+@@ -239,8 +239,6 @@ hdmi-transmitter@3d {
+ adi,input-depth = <8>;
+ adi,input-colorspace = "rgb";
+ adi,input-clock = "1x";
+- adi,input-style = <1>;
+- adi,input-justification = "evenly";
+
+ ports {
+ #address-cells = <1>;
+--
+2.30.2
+
--- /dev/null
+From 16cd78a040161333f7f34091ab95a0850219670e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 00:19:43 +0300
+Subject: ARM: tegra: acer-a500: Remove bogus USB VBUS regulators
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 70e740ad55e5f93a19493720f4105555fade4a73 ]
+
+The configuration of USB VBUS regulators was borrowed from downstream
+kernel, which is incorrect because the corresponding GPIOs are connected
+to PROX_EN (A501 3G model) and LED_EN pins in accordance to the board
+schematics. USB works fine with both GPIOs being disabled, so remove the
+bogus USB VBUS regulators. The USB VBUS of USB3 is supplied from the fixed
+5v system regulator and device-mode USB1 doesn't have VBUS switches.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/tegra20-acer-a500-picasso.dts | 25 +------------------
+ 1 file changed, 1 insertion(+), 24 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
+index 1976c383912a..05bd0add258c 100644
+--- a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
++++ b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
+@@ -719,7 +719,6 @@ usb-phy@c5000000 {
+ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+- vbus-supply = <&vdd_vbus1>;
+ };
+
+ usb@c5008000 {
+@@ -731,7 +730,7 @@ usb-phy@c5008000 {
+ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+- vbus-supply = <&vdd_vbus3>;
++ vbus-supply = <&vdd_5v0_sys>;
+ };
+
+ brcm_wifi_pwrseq: wifi-pwrseq {
+@@ -991,28 +990,6 @@ vdd_pnl: regulator@3 {
+ vin-supply = <&vdd_5v0_sys>;
+ };
+
+- vdd_vbus1: regulator@4 {
+- compatible = "regulator-fixed";
+- regulator-name = "vdd_usb1_vbus";
+- regulator-min-microvolt = <5000000>;
+- regulator-max-microvolt = <5000000>;
+- regulator-always-on;
+- gpio = <&gpio TEGRA_GPIO(D, 0) GPIO_ACTIVE_HIGH>;
+- enable-active-high;
+- vin-supply = <&vdd_5v0_sys>;
+- };
+-
+- vdd_vbus3: regulator@5 {
+- compatible = "regulator-fixed";
+- regulator-name = "vdd_usb3_vbus";
+- regulator-min-microvolt = <5000000>;
+- regulator-max-microvolt = <5000000>;
+- regulator-always-on;
+- gpio = <&gpio TEGRA_GPIO(D, 3) GPIO_ACTIVE_HIGH>;
+- enable-active-high;
+- vin-supply = <&vdd_5v0_sys>;
+- };
+-
+ sound {
+ compatible = "nvidia,tegra-audio-wm8903-picasso",
+ "nvidia,tegra-audio-wm8903";
+--
+2.30.2
+
--- /dev/null
+From 72b773bc767919835ba07e9cdba9f585e3e8e463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 16:42:26 +0200
+Subject: ARM: tegra: tamonten: Fix UART pad setting
+
+From: Andreas Obergschwandtner <andreas.obergschwandtner@gmail.com>
+
+[ Upstream commit 2270ad2f4e123336af685ecedd1618701cb4ca1e ]
+
+This patch fixes the tristate and pullup configuration for UART 1 to 3
+on the Tamonten SOM.
+
+Signed-off-by: Andreas Obergschwandtner <andreas.obergschwandtner@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index 95e6bccdb4f6..dd4d506683de 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -185,8 +185,9 @@ conf_ata {
+ nvidia,pins = "ata", "atb", "atc", "atd", "ate",
+ "cdev1", "cdev2", "dap1", "dtb", "gma",
+ "gmb", "gmc", "gmd", "gme", "gpu7",
+- "gpv", "i2cp", "pta", "rm", "slxa",
+- "slxk", "spia", "spib", "uac";
++ "gpv", "i2cp", "irrx", "irtx", "pta",
++ "rm", "slxa", "slxk", "spia", "spib",
++ "uac";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+@@ -211,7 +212,7 @@ conf_crtp {
+ conf_ddc {
+ nvidia,pins = "ddc", "dta", "dtd", "kbca",
+ "kbcb", "kbcc", "kbcd", "kbce", "kbcf",
+- "sdc";
++ "sdc", "uad", "uca";
+ nvidia,pull = <TEGRA_PIN_PULL_UP>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+@@ -221,10 +222,9 @@ conf_hdint {
+ "lvp0", "owc", "sdb";
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ };
+- conf_irrx {
+- nvidia,pins = "irrx", "irtx", "sdd", "spic",
+- "spie", "spih", "uaa", "uab", "uad",
+- "uca", "ucb";
++ conf_sdd {
++ nvidia,pins = "sdd", "spic", "spie", "spih",
++ "uaa", "uab", "ucb";
+ nvidia,pull = <TEGRA_PIN_PULL_UP>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ };
+--
+2.30.2
+
--- /dev/null
+From 1c3dbbf854a6dbd4fc54eb423f3d75d58df83dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 18:12:18 +0200
+Subject: arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 7ab1f6539762946de06ca14d7401ae123821bc40 ]
+
+Regulator node names don't reflect class of the device. Fix that by
+prefixing names with "regulator-".
+
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210722161220.51181-2-jernej.skrabec@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
+index be81330db14f..02641191682e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
+@@ -32,14 +32,14 @@ hdmi_con_in: endpoint {
+ };
+ };
+
+- reg_vcc3v3: vcc3v3 {
++ reg_vcc3v3: regulator-vcc3v3 {
+ compatible = "regulator-fixed";
+ regulator-name = "vcc3v3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ };
+
+- reg_vdd_cpu_gpu: vdd-cpu-gpu {
++ reg_vdd_cpu_gpu: regulator-vdd-cpu-gpu {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd-cpu-gpu";
+ regulator-min-microvolt = <1135000>;
+--
+2.30.2
+
--- /dev/null
+From c047f4de494badbefd6c92da18e070d60f7cfa81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 09:10:58 -0700
+Subject: arm64: dts: imx8mm-venice-gw700x: fix invalid pmic pin config
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit 500659f3b401fe6ffd1d63f2449d16d8a4204db7 ]
+
+The GW700x PMIC does not have an interrupt. Remove the invalid pin
+config.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
+index 11dda79cc46b..00f86cada30d 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
+@@ -278,8 +278,6 @@ rtc@68 {
+
+ pmic@69 {
+ compatible = "mps,mp5416";
+- pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_pmic>;
+ reg = <0x69>;
+
+ regulators {
+@@ -444,12 +442,6 @@ MX8MM_IOMUXC_I2C2_SDA_I2C2_SDA 0x400001c3
+ >;
+ };
+
+- pinctrl_pmic: pmicgrp {
+- fsl,pins = <
+- MX8MM_IOMUXC_GPIO1_IO03_GPIO1_IO3 0x41
+- >;
+- };
+-
+ pinctrl_uart2: uart2grp {
+ fsl,pins = <
+ MX8MM_IOMUXC_UART2_RXD_UART2_DCE_RX 0x140
+--
+2.30.2
+
--- /dev/null
+From dcb4b67f0cd58ae71989244c8395eb779ec18e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 09:10:57 -0700
+Subject: arm64: dts: imx8mm-venice-gw700x: fix mp5416 pmic config
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit 092cd75e527044050ea76bf774e7d730709b7e8b ]
+
+Fix various MP5416 PMIC configurations:
+ - Update regulator names per dt-bindings
+ - ensure values fit among valid register values
+ - add required regulator-max-microamp property
+ - add regulator-always-on prop
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-venice-gw700x.dtsi | 56 ++++++++++++-------
+ 1 file changed, 37 insertions(+), 19 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
+index c769fadbd008..11dda79cc46b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
+@@ -283,65 +283,83 @@ pmic@69 {
+ reg = <0x69>;
+
+ regulators {
++ /* vdd_0p95: DRAM/GPU/VPU */
+ buck1 {
+- regulator-name = "vdd_0p95";
+- regulator-min-microvolt = <805000>;
++ regulator-name = "buck1";
++ regulator-min-microvolt = <800000>;
+ regulator-max-microvolt = <1000000>;
+- regulator-max-microamp = <2500000>;
++ regulator-min-microamp = <3800000>;
++ regulator-max-microamp = <6800000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* vdd_soc */
+ buck2 {
+- regulator-name = "vdd_soc";
+- regulator-min-microvolt = <805000>;
++ regulator-name = "buck2";
++ regulator-min-microvolt = <800000>;
+ regulator-max-microvolt = <900000>;
+- regulator-max-microamp = <1000000>;
++ regulator-min-microamp = <2200000>;
++ regulator-max-microamp = <5200000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* vdd_arm */
+ buck3_reg: buck3 {
+- regulator-name = "vdd_arm";
+- regulator-min-microvolt = <805000>;
++ regulator-name = "buck3";
++ regulator-min-microvolt = <800000>;
+ regulator-max-microvolt = <1000000>;
+- regulator-max-microamp = <2200000>;
+- regulator-boot-on;
++ regulator-min-microamp = <3800000>;
++ regulator-max-microamp = <6800000>;
++ regulator-always-on;
+ };
+
++ /* vdd_1p8 */
+ buck4 {
+- regulator-name = "vdd_1p8";
++ regulator-name = "buck4";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+- regulator-max-microamp = <500000>;
++ regulator-min-microamp = <2200000>;
++ regulator-max-microamp = <5200000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* nvcc_snvs_1p8 */
+ ldo1 {
+- regulator-name = "nvcc_snvs_1p8";
++ regulator-name = "ldo1";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+- regulator-max-microamp = <300000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* vdd_snvs_0p8 */
+ ldo2 {
+- regulator-name = "vdd_snvs_0p8";
++ regulator-name = "ldo2";
+ regulator-min-microvolt = <800000>;
+ regulator-max-microvolt = <800000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* vdd_0p9 */
+ ldo3 {
+- regulator-name = "vdd_0p95";
+- regulator-min-microvolt = <800000>;
+- regulator-max-microvolt = <800000>;
++ regulator-name = "ldo3";
++ regulator-min-microvolt = <900000>;
++ regulator-max-microvolt = <900000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+
++ /* vdd_1p8 */
+ ldo4 {
+- regulator-name = "vdd_1p8";
++ regulator-name = "ldo4";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-boot-on;
++ regulator-always-on;
+ };
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 8f5e4673264184ec830da4019bf9bc98d69a3ab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 09:10:59 -0700
+Subject: arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit bd306fdb4e60bcb1d7ea5431a74092803d3784a6 ]
+
+The GW71xx has a USB Type-C connector with USB 2.0 signaling. GPIO1_12
+is the power-enable to the TPS25821 Source controller and power switch
+responsible for monitoring the CC pins and enabling VBUS. Therefore
+GPIO1_12 must always be enabled and the vbus output enable from the
+IMX8MM can be ignored.
+
+To fix USB OTG VBUS enable a pull-up on GPIO1_12 to always power the
+TPS25821 and change the regulator output to GPIO1_10 which is
+unconnected.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+index 905b68a3daa5..8e4a0ce99790 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+@@ -46,7 +46,7 @@ reg_usb_otg1_vbus: regulator-usb-otg1 {
+ pinctrl-0 = <&pinctrl_reg_usb1_en>;
+ compatible = "regulator-fixed";
+ regulator-name = "usb_otg1_vbus";
+- gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+@@ -156,7 +156,8 @@ MX8MM_IOMUXC_GPIO1_IO15_GPIO1_IO15 0x41
+
+ pinctrl_reg_usb1_en: regusb1grp {
+ fsl,pins = <
+- MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12 0x41
++ MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10 0x41
++ MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12 0x141
+ MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC 0x41
+ >;
+ };
+--
+2.30.2
+
--- /dev/null
+From f96b72143894a3007f23528e37b8618081e8a5b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 00:54:45 +0530
+Subject: arm64: dts: ls1046a: fix eeprom entries
+
+From: Raag Jadav <raagjadav@gmail.com>
+
+[ Upstream commit c1a6018d1839c9cb8f807dc863a50102a1a5c412 ]
+
+ls1046afrwy and ls1046ardb boards have CAT24C04[1] and CAT24C05[2]
+eeproms respectively. Both are 4Kb (512 bytes) in size,
+and compatible with AT24C04[3].
+Remove multi-address entries, as both the boards have a single chip each.
+
+[1] https://www.onsemi.com/pdf/datasheet/cat24c01-d.pdf
+[2] https://www.onsemi.com/pdf/datasheet/cat24c03-d.pdf
+[3] https://ww1.microchip.com/downloads/en/DeviceDoc/doc0180.pdf
+
+Signed-off-by: Raag Jadav <raagjadav@gmail.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts | 8 +-------
+ arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 7 +------
+ 2 files changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
+index db3d303093f6..6d22efbd645c 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
+@@ -83,15 +83,9 @@ rtc@51 {
+ };
+
+ eeprom@52 {
+- compatible = "atmel,24c512";
++ compatible = "onnn,cat24c04", "atmel,24c04";
+ reg = <0x52>;
+ };
+-
+- eeprom@53 {
+- compatible = "atmel,24c512";
+- reg = <0x53>;
+- };
+-
+ };
+ };
+ };
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+index 60acdf0b689e..7025aad8ae89 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+@@ -59,14 +59,9 @@ temp-sensor@4c {
+ };
+
+ eeprom@52 {
+- compatible = "atmel,24c512";
++ compatible = "onnn,cat24c05", "atmel,24c04";
+ reg = <0x52>;
+ };
+-
+- eeprom@53 {
+- compatible = "atmel,24c512";
+- reg = <0x53>;
+- };
+ };
+
+ &i2c3 {
+--
+2.30.2
+
--- /dev/null
+From 3a2cfc68229a1420e465644fd3f59d04f558cf42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jun 2021 17:16:16 +0530
+Subject: arm64: dts: qcom: Fix usb entries for SA8155p adp board
+
+From: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+
+[ Upstream commit 12dd4ebda47abd5e3907da386b6fe1d8181ad179 ]
+
+SA8155p adp board has two USB A-type receptacles called
+USB-portB and USB-portC respectively.
+
+While USB-portB is a USB High-Speed connector/interface, the
+USB-portC one is a USB 3.1 Super-Speed connector/interface.
+
+Also the USB-portB is used as the USB emergency
+download port (for image download purposes).
+
+Enable both the ports on the board in USB Host mode (since all
+the USB interfaces are brought out to USB Type A
+connectors).
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org>
+Link: https://lore.kernel.org/r/20210627114616.717101-4-bhupesh.sharma@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 60 ++++++++++++++++++++----
+ 1 file changed, 51 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
+index 0da7a3b8d1bf..5ae2ddc65f7e 100644
+--- a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
++++ b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
+@@ -307,10 +307,6 @@ &qupv3_id_1 {
+ status = "okay";
+ };
+
+-&tlmm {
+- gpio-reserved-ranges = <0 4>;
+-};
+-
+ &uart2 {
+ status = "okay";
+ };
+@@ -337,6 +333,16 @@ &ufs_mem_phy {
+ vdda-pll-max-microamp = <18300>;
+ };
+
++&usb_1 {
++ status = "okay";
++};
++
++&usb_1_dwc3 {
++ dr_mode = "host";
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb2phy_ac_en1_default>;
++};
+
+ &usb_1_hsphy {
+ status = "okay";
+@@ -346,15 +352,51 @@ &usb_1_hsphy {
+ };
+
+ &usb_1_qmpphy {
++ status = "disabled";
++};
++
++&usb_2 {
+ status = "okay";
+- vdda-phy-supply = <&vreg_l8c_1p2>;
+- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
+ };
+
+-&usb_1 {
++&usb_2_dwc3 {
++ dr_mode = "host";
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb2phy_ac_en2_default>;
++};
++
++&usb_2_hsphy {
+ status = "okay";
++ vdda-pll-supply = <&vdd_usb_hs_core>;
++ vdda33-supply = <&vdda_usb_hs_3p1>;
++ vdda18-supply = <&vdda_usb_hs_1p8>;
+ };
+
+-&usb_1_dwc3 {
+- dr_mode = "peripheral";
++&usb_2_qmpphy {
++ status = "okay";
++ vdda-phy-supply = <&vreg_l8c_1p2>;
++ vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
++};
++
++&tlmm {
++ gpio-reserved-ranges = <0 4>;
++
++ usb2phy_ac_en1_default: usb2phy_ac_en1_default {
++ mux {
++ pins = "gpio113";
++ function = "usb2phy_ac";
++ bias-disable;
++ drive-strength = <2>;
++ };
++ };
++
++ usb2phy_ac_en2_default: usb2phy_ac_en2_default {
++ mux {
++ pins = "gpio123";
++ function = "usb2phy_ac";
++ bias-disable;
++ drive-strength = <2>;
++ };
++ };
+ };
+--
+2.30.2
+
--- /dev/null
+From d193ee98bfe4033030a0e696a8a1c1a13e578766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:26 +0530
+Subject: arm64: dts: qcom: ipq6018: drop '0x' from unit address
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 1b91b8ef60e9a67141e66af3cca532c00f4605fe ]
+
+Nodes need not contain '0x' for the unit address. Drop it to fix the
+below warning:
+
+arch/arm64/boot/dts/qcom/ipq6018-cp01-c1.dt.yaml: reserved-memory:
+'memory@0x60000' does not match any of the regexes
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-19-vkoul@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 9fa5b028e4f3..23ee1bfa4318 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -151,7 +151,7 @@ reserved-memory {
+ #size-cells = <2>;
+ ranges;
+
+- rpm_msg_ram: memory@0x60000 {
++ rpm_msg_ram: memory@60000 {
+ reg = <0x0 0x60000 0x0 0x6000>;
+ no-map;
+ };
+--
+2.30.2
+
--- /dev/null
+From 29c26aba99919ae12f7d88b0200ffe99e5b0d02e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:24 +0530
+Subject: arm64: dts: qcom: ipq8074: fix pci node reg property
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 52c9887fba71fc8f12d343833fc595c762aac8c7 ]
+
+reg property should be array of values, here it is a single array,
+leading to below warning:
+
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:reg:0: [268435456, 3869, 268439328, 168, 557056, 8192, 269484032, 4096] is too long
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:ranges: 'oneOf' conditional failed, one must be fixed:
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:ranges: 'oneOf' conditional failed, one must be fixed:
+[[2164260864, 0, 270532608, 270532608, 0, 1048576, 2181038080, 0, 271581184, 271581184, 0, 13631488]] is not of type 'null'
+[2164260864, 0, 270532608, 270532608, 0, 1048576, 2181038080, 0, 271581184, 271581184, 0, 13631488] is too long
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:reg:0: [536870912, 3869, 536874784, 168, 524288, 8192, 537919488, 4096] is too long
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:ranges: 'oneOf' conditional failed, one must be fixed:
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:ranges: 'oneOf' conditional failed, one must be fixed:
+[[2164260864, 0, 538968064, 538968064, 0, 1048576, 2181038080, 0, 540016640, 540016640, 0, 13631488]] is not of type 'null'
+[2164260864, 0, 538968064, 538968064, 0, 1048576, 2181038080, 0, 540016640, 540016640, 0, 13631488] is too long
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-17-vkoul@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index f39bc10cc5bd..d64a6e81d1a5 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -583,10 +583,10 @@ frame@b128000 {
+
+ pcie1: pci@10000000 {
+ compatible = "qcom,pcie-ipq8074";
+- reg = <0x10000000 0xf1d
+- 0x10000f20 0xa8
+- 0x00088000 0x2000
+- 0x10100000 0x1000>;
++ reg = <0x10000000 0xf1d>,
++ <0x10000f20 0xa8>,
++ <0x00088000 0x2000>,
++ <0x10100000 0x1000>;
+ reg-names = "dbi", "elbi", "parf", "config";
+ device_type = "pci";
+ linux,pci-domain = <1>;
+@@ -645,10 +645,10 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
+
+ pcie0: pci@20000000 {
+ compatible = "qcom,pcie-ipq8074";
+- reg = <0x20000000 0xf1d
+- 0x20000f20 0xa8
+- 0x00080000 0x2000
+- 0x20100000 0x1000>;
++ reg = <0x20000000 0xf1d>,
++ <0x20000f20 0xa8>,
++ <0x00080000 0x2000>,
++ <0x20100000 0x1000>;
+ reg-names = "dbi", "elbi", "parf", "config";
+ device_type = "pci";
+ linux,pci-domain = <0>;
+--
+2.30.2
+
--- /dev/null
+From bb11af2bcc9ea761b412ec0d82a85a72e85025eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:16 +0530
+Subject: arm64: dts: qcom: msm8994: don't use underscore in node name
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 8c678beca7ed3fa8a2c6d86f6603bc23400f9ad8 ]
+
+We have underscore (_) in node name leading to warning:
+arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon-cityman.dt.yaml: clocks: xo_board: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[19200000]], 'phandle': [[26]]}
+arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon-cityman.dt.yaml: clocks: sleep_clk: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[32768]]}
+
+Fix this by changing node name to use dash (-)
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-9-vkoul@kernel.org
+[bjorn: Added clock-output-names to satisfy parent_names]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index f9f0b5aa6a26..87a3217e88ef 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -15,16 +15,18 @@ / {
+ chosen { };
+
+ clocks {
+- xo_board: xo_board {
++ xo_board: xo-board {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <19200000>;
++ clock-output-names = "xo_board";
+ };
+
+- sleep_clk: sleep_clk {
++ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <32768>;
++ clock-output-names = "sleep_clk";
+ };
+ };
+
+--
+2.30.2
+
--- /dev/null
+From bc7e24bc4c0dab4ba244796784f796c4f5dc2588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:17 +0530
+Subject: arm64: dts: qcom: msm8996: don't use underscore in node name
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 84f3efbe5b4654077608bc2fc027177fe4592321 ]
+
+We have underscore (_) in node name leading to warning:
+
+arch/arm64/boot/dts/qcom/apq8096-db820c.dt.yaml: clocks: $nodename:0: 'clocks' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
+arch/arm64/boot/dts/qcom/apq8096-db820c.dt.yaml: clocks: xo_board: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[19200000]], 'clock-output-names': ['xo_board'], 'phandle': [[115]]}
+
+Fix this by changing node name to use dash (-)
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-10-vkoul@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 78c55ca10ba9..77bc233f8380 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -19,14 +19,14 @@ / {
+ chosen { };
+
+ clocks {
+- xo_board: xo_board {
++ xo_board: xo-board {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <19200000>;
+ clock-output-names = "xo_board";
+ };
+
+- sleep_clk: sleep_clk {
++ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <32764>;
+--
+2.30.2
+
--- /dev/null
+From 9a49f72cbf48625e9022450a38378c9c4eea3330 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:18 +0530
+Subject: arm64: dts: qcom: sdm630: don't use underscore in node name
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 639dfdbecd88ec05bda87b1d5d419afad50af21c ]
+
+We have underscore (_) in node name so fix that up as well.
+
+Fix this by changing node name to use dash (-)
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-11-vkoul@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm630.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+index 5b73659f2a75..06a0ae773ad5 100644
+--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+@@ -17,14 +17,14 @@ / {
+ chosen { };
+
+ clocks {
+- xo_board: xo_board {
++ xo_board: xo-board {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <19200000>;
+ clock-output-names = "xo_board";
+ };
+
+- sleep_clk: sleep_clk {
++ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <32764>;
+--
+2.30.2
+
--- /dev/null
+From 1e617bb20c0c044c7a1d6697ab5d340ab88cc0e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 00:25:11 +0200
+Subject: arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 36a0d47aee6a8cfd3c6cf4274732d8ef994a25b4 ]
+
+Previous pinctrl configuration was wrong. Fix it and clean up how
+multi-pin states are described.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20210728222542.54269-9-konrad.dybcio@somainline.org
+[bjorn: Polished the commit message]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm630.dtsi | 212 ++++++++++++++++++---------
+ 1 file changed, 139 insertions(+), 73 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+index 5ea3884b3ccb..5b73659f2a75 100644
+--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+@@ -522,14 +522,18 @@ tcsr_mutex_regs: syscon@1f40000 {
+ reg = <0x01f40000 0x20000>;
+ };
+
+- tlmm: pinctrl@3000000 {
++ tlmm: pinctrl@3100000 {
+ compatible = "qcom,sdm630-pinctrl";
+- reg = <0x03000000 0xc00000>;
++ reg = <0x03100000 0x400000>,
++ <0x03500000 0x400000>,
++ <0x03900000 0x400000>;
++ reg-names = "south", "center", "north";
+ interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+ gpio-controller;
+- #gpio-cells = <0x2>;
++ gpio-ranges = <&tlmm 0 0 114>;
++ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <0x2>;
++ #interrupt-cells = <2>;
+
+ blsp1_uart1_default: blsp1-uart1-default {
+ pins = "gpio0", "gpio1", "gpio2", "gpio3";
+@@ -549,40 +553,48 @@ blsp1_uart2_default: blsp1-uart2-default {
+ bias-disable;
+ };
+
+- blsp2_uart1_tx_active: blsp2-uart1-tx-active {
+- pins = "gpio16";
+- drive-strength = <2>;
+- bias-disable;
+- };
+-
+- blsp2_uart1_tx_sleep: blsp2-uart1-tx-sleep {
+- pins = "gpio16";
+- drive-strength = <2>;
+- bias-pull-up;
+- };
++ blsp2_uart1_default: blsp2-uart1-active {
++ tx-rts {
++ pins = "gpio16", "gpio19";
++ function = "blsp_uart5";
++ drive-strength = <2>;
++ bias-disable;
++ };
+
+- blsp2_uart1_rxcts_active: blsp2-uart1-rxcts-active {
+- pins = "gpio17", "gpio18";
+- drive-strength = <2>;
+- bias-disable;
+- };
++ rx {
++ /*
++ * Avoid garbage data while BT module
++ * is powered off or not driving signal
++ */
++ pins = "gpio17";
++ function = "blsp_uart5";
++ drive-strength = <2>;
++ bias-pull-up;
++ };
+
+- blsp2_uart1_rxcts_sleep: blsp2-uart1-rxcts-sleep {
+- pins = "gpio17", "gpio18";
+- drive-strength = <2>;
+- bias-no-pull;
++ cts {
++ /* Match the pull of the BT module */
++ pins = "gpio18";
++ function = "blsp_uart5";
++ drive-strength = <2>;
++ bias-pull-down;
++ };
+ };
+
+- blsp2_uart1_rfr_active: blsp2-uart1-rfr-active {
+- pins = "gpio19";
+- drive-strength = <2>;
+- bias-disable;
+- };
++ blsp2_uart1_sleep: blsp2-uart1-sleep {
++ tx {
++ pins = "gpio16";
++ function = "gpio";
++ drive-strength = <2>;
++ bias-pull-up;
++ };
+
+- blsp2_uart1_rfr_sleep: blsp2-uart1-rfr-sleep {
+- pins = "gpio19";
+- drive-strength = <2>;
+- bias-no-pull;
++ rx-cts-rts {
++ pins = "gpio17", "gpio18", "gpio19";
++ function = "gpio";
++ drive-strength = <2>;
++ bias-no-pull;
++ };
+ };
+
+ i2c1_default: i2c1-default {
+@@ -681,50 +693,106 @@ i2c8_sleep: i2c8-sleep {
+ bias-pull-up;
+ };
+
+- sdc1_clk_on: sdc1-clk-on {
+- pins = "sdc1_clk";
+- bias-disable;
+- drive-strength = <16>;
+- };
++ sdc1_state_on: sdc1-on {
++ clk {
++ pins = "sdc1_clk";
++ bias-disable;
++ drive-strength = <16>;
++ };
+
+- sdc1_clk_off: sdc1-clk-off {
+- pins = "sdc1_clk";
+- bias-disable;
+- drive-strength = <2>;
+- };
++ cmd {
++ pins = "sdc1_cmd";
++ bias-pull-up;
++ drive-strength = <10>;
++ };
+
+- sdc1_cmd_on: sdc1-cmd-on {
+- pins = "sdc1_cmd";
+- bias-pull-up;
+- drive-strength = <10>;
+- };
++ data {
++ pins = "sdc1_data";
++ bias-pull-up;
++ drive-strength = <10>;
++ };
+
+- sdc1_cmd_off: sdc1-cmd-off {
+- pins = "sdc1_cmd";
+- bias-pull-up;
+- drive-strength = <2>;
++ rclk {
++ pins = "sdc1_rclk";
++ bias-pull-down;
++ };
+ };
+
+- sdc1_data_on: sdc1-data-on {
+- pins = "sdc1_data";
+- bias-pull-up;
+- drive-strength = <8>;
+- };
++ sdc1_state_off: sdc1-off {
++ clk {
++ pins = "sdc1_clk";
++ bias-disable;
++ drive-strength = <2>;
++ };
+
+- sdc1_data_off: sdc1-data-off {
+- pins = "sdc1_data";
+- bias-pull-up;
+- drive-strength = <2>;
++ cmd {
++ pins = "sdc1_cmd";
++ bias-pull-up;
++ drive-strength = <2>;
++ };
++
++ data {
++ pins = "sdc1_data";
++ bias-pull-up;
++ drive-strength = <2>;
++ };
++
++ rclk {
++ pins = "sdc1_rclk";
++ bias-pull-down;
++ };
+ };
+
+- sdc1_rclk_on: sdc1-rclk-on {
+- pins = "sdc1_rclk";
+- bias-pull-down;
++ sdc2_state_on: sdc2-on {
++ clk {
++ pins = "sdc2_clk";
++ bias-disable;
++ drive-strength = <16>;
++ };
++
++ cmd {
++ pins = "sdc2_cmd";
++ bias-pull-up;
++ drive-strength = <10>;
++ };
++
++ data {
++ pins = "sdc2_data";
++ bias-pull-up;
++ drive-strength = <10>;
++ };
++
++ sd-cd {
++ pins = "gpio54";
++ bias-pull-up;
++ drive-strength = <2>;
++ };
+ };
+
+- sdc1_rclk_off: sdc1-rclk-off {
+- pins = "sdc1_rclk";
+- bias-pull-down;
++ sdc2_state_off: sdc2-off {
++ clk {
++ pins = "sdc2_clk";
++ bias-disable;
++ drive-strength = <2>;
++ };
++
++ cmd {
++ pins = "sdc2_cmd";
++ bias-pull-up;
++ drive-strength = <2>;
++ };
++
++ data {
++ pins = "sdc2_data";
++ bias-pull-up;
++ drive-strength = <2>;
++ };
++
++ sd-cd {
++ pins = "gpio54";
++ bias-disable;
++ drive-strength = <2>;
++ };
+ };
+ };
+
+@@ -818,8 +886,8 @@ sdhc_1: sdhci@c0c4000 {
+ clock-names = "core", "iface", "xo", "ice";
+
+ pinctrl-names = "default", "sleep";
+- pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+- pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
++ pinctrl-0 = <&sdc1_state_on>;
++ pinctrl-1 = <&sdc1_state_off>;
+
+ bus-width = <8>;
+ non-removable;
+@@ -964,10 +1032,8 @@ blsp2_uart1: serial@c1af000 {
+ dmas = <&blsp2_dma 0>, <&blsp2_dma 1>;
+ dma-names = "tx", "rx";
+ pinctrl-names = "default", "sleep";
+- pinctrl-0 = <&blsp2_uart1_tx_active &blsp2_uart1_rxcts_active
+- &blsp2_uart1_rfr_active>;
+- pinctrl-1 = <&blsp2_uart1_tx_sleep &blsp2_uart1_rxcts_sleep
+- &blsp2_uart1_rfr_sleep>;
++ pinctrl-0 = <&blsp2_uart1_default>;
++ pinctrl-1 = <&blsp2_uart1_sleep>;
+ status = "disabled";
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 46b5cc7bc5fdb9b23c0430552724c6db432b5593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 00:25:04 +0200
+Subject: arm64: dts: qcom: sdm630: Rewrite memory map
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 26e02c98a9ad63eb21b9be4ac92002f555130d3b ]
+
+The memory map was wrong. Fix it.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20210728222542.54269-2-konrad.dybcio@somainline.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm630.dtsi | 41 ++++++++++++----------------
+ 1 file changed, 18 insertions(+), 23 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+index f91a928466c3..5ea3884b3ccb 100644
+--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+@@ -343,10 +343,19 @@ wlan_msa_mem: wlan-msa-mem@85700000 {
+ };
+
+ qhee_code: qhee-code@85800000 {
+- reg = <0x0 0x85800000 0x0 0x3700000>;
++ reg = <0x0 0x85800000 0x0 0x600000>;
+ no-map;
+ };
+
++ rmtfs_mem: memory@85e00000 {
++ compatible = "qcom,rmtfs-mem";
++ reg = <0x0 0x85e00000 0x0 0x200000>;
++ no-map;
++
++ qcom,client-id = <1>;
++ qcom,vmid = <15>;
++ };
++
+ smem_region: smem-mem@86000000 {
+ reg = <0 0x86000000 0 0x200000>;
+ no-map;
+@@ -357,58 +366,44 @@ tz_mem: memory@86200000 {
+ no-map;
+ };
+
+- modem_fw_mem: modem-fw-region@8ac00000 {
++ mpss_region: mpss@8ac00000 {
+ reg = <0x0 0x8ac00000 0x0 0x7e00000>;
+ no-map;
+ };
+
+- adsp_fw_mem: adsp-fw-region@92a00000 {
++ adsp_region: adsp@92a00000 {
+ reg = <0x0 0x92a00000 0x0 0x1e00000>;
+ no-map;
+ };
+
+- pil_mba_mem: pil-mba-region@94800000 {
++ mba_region: mba@94800000 {
+ reg = <0x0 0x94800000 0x0 0x200000>;
+ no-map;
+ };
+
+- buffer_mem: buffer-region@94a00000 {
++ buffer_mem: tzbuffer@94a00000 {
+ reg = <0x0 0x94a00000 0x0 0x100000>;
+ no-map;
+ };
+
+- venus_fw_mem: venus-fw-region@9f800000 {
++ venus_region: venus@9f800000 {
+ reg = <0x0 0x9f800000 0x0 0x800000>;
+ no-map;
+ };
+
+- secure_region2: secure-region2@f7c00000 {
+- reg = <0x0 0xf7c00000 0x0 0x5c00000>;
+- no-map;
+- };
+-
+ adsp_mem: adsp-region@f6000000 {
+ reg = <0x0 0xf6000000 0x0 0x800000>;
+ no-map;
+ };
+
+- qseecom_ta_mem: qseecom-ta-region@fec00000 {
+- reg = <0x0 0xfec00000 0x0 0x1000000>;
+- no-map;
+- };
+-
+ qseecom_mem: qseecom-region@f6800000 {
+ reg = <0x0 0xf6800000 0x0 0x1400000>;
+ no-map;
+ };
+
+- secure_display_memory: secure-region@f5c00000 {
+- reg = <0x0 0xf5c00000 0x0 0x5c00000>;
+- no-map;
+- };
+-
+- cont_splash_mem: cont-splash-region@9d400000 {
+- reg = <0x0 0x9d400000 0x0 0x23ff000>;
++ zap_shader_region: gpu@fed00000 {
++ compatible = "shared-dma-pool";
++ reg = <0x0 0xfed00000 0x0 0xa00000>;
+ no-map;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 65eff7907efbf8c116fc0b4235cc219381cbd8be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:38:25 +0530
+Subject: arm64: dts: qcom: sdm660: use reg value for memory node
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit c81210e38966cfa1c784364e4035081c3227cf5b ]
+
+memory node like other node should be node@reg, which is missing in this
+case, so fix it up
+
+arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 1073741824, 0, 536870912]]}
+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210308060826.3074234-18-vkoul@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+index e8c37a1693d3..cc08dc4eb56a 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+@@ -20,7 +20,7 @@ chosen {
+ stdout-path = "serial0";
+ };
+
+- memory {
++ memory@40000000 {
+ device_type = "memory";
+ reg = <0x0 0x40000000 0x0 0x20000000>;
+ };
+--
+2.30.2
+
--- /dev/null
+From 4a6d3ee5aa639b62b81144ecbc55a22019b82abc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 21:36:37 +0200
+Subject: arm64: dts: qcom: sm8250: Fix epss_l3 unit address
+
+From: Georgi Djakov <georgi.djakov@linaro.org>
+
+[ Upstream commit 77b53d65dc1e54321ec841912f06bcb558a079c0 ]
+
+The unit address of the epss_l3 node is incorrect and does not match
+the address of its "reg" property. Let's fix it.
+
+Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210211193637.9737-1-georgi.djakov@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 9a6eff1813a6..7f7c8f467bfc 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -3955,7 +3955,7 @@ apps_bcm_voter: bcm_voter {
+ };
+ };
+
+- epss_l3: interconnect@18591000 {
++ epss_l3: interconnect@18590000 {
+ compatible = "qcom,sm8250-epss-l3";
+ reg = <0 0x18590000 0 0x1000>;
+
+--
+2.30.2
+
--- /dev/null
+From 3cb5ee295a26f9123c3786a662eb3ec3b9356a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 15:44:22 +0200
+Subject: arm64: tegra: Fix compatible string for Tegra132 CPUs
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit f865d0292ff3c0ca09414436510eb4c815815509 ]
+
+The documented compatible string for the CPUs found on Tegra132 is
+"nvidia,tegra132-denver", rather than the previously used compatible
+string "nvidia,denver".
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra132.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+index 9928a87f593a..b0bcda8cc51f 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+@@ -1227,13 +1227,13 @@ cpus {
+
+ cpu@0 {
+ device_type = "cpu";
+- compatible = "nvidia,denver";
++ compatible = "nvidia,tegra132-denver";
+ reg = <0>;
+ };
+
+ cpu@1 {
+ device_type = "cpu";
+- compatible = "nvidia,denver";
++ compatible = "nvidia,tegra132-denver";
+ reg = <1>;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From c70794288b551d2ddc22ee763660f0da1f379cac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 00:20:55 +0530
+Subject: arm64: tegra: Fix Tegra194 PCIe EP compatible string
+
+From: Vidya Sagar <vidyas@nvidia.com>
+
+[ Upstream commit bf2942a8b7c38e8cc2d5157b4f0323d7f4e5ec71 ]
+
+The initialization sequence performed by the generic platform driver
+pcie-designware-plat.c for a DWC based implementation doesn't work for
+Tegra194. Tegra194 has a different initialization sequence requirement
+which can only be satisfied by the Tegra194 specific platform driver
+pcie-tegra194.c. So, remove the generic compatible string "snps,dw-pcie-ep"
+from Tegra194's endpoint controller nodes.
+
+Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index 5ba7a4519b95..c8250a3f7891 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -2122,7 +2122,7 @@ pcie@141a0000 {
+ };
+
+ pcie_ep@14160000 {
+- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ compatible = "nvidia,tegra194-pcie-ep";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
+ reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */
+ <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+@@ -2162,7 +2162,7 @@ pcie_ep@14160000 {
+ };
+
+ pcie_ep@14180000 {
+- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ compatible = "nvidia,tegra194-pcie-ep";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
+ reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */
+ <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+@@ -2202,7 +2202,7 @@ pcie_ep@14180000 {
+ };
+
+ pcie_ep@141a0000 {
+- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ compatible = "nvidia,tegra194-pcie-ep";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
+ reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */
+ <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */
+--
+2.30.2
+
--- /dev/null
+From 3000988da6c2915e5b69b2317ebc9ec1b2d593c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 14:47:52 -0700
+Subject: ASoC: atmel: ATMEL drivers don't need HAS_DMA
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6c5c659dfe3f02e08054a6c20019e3886618b512 ]
+
+On a config (such as arch/sh/) which does not set HAS_DMA when MMU
+is not set, several ATMEL ASoC drivers select symbols that cause
+kconfig warnings. There is one "depends on HAS_DMA" which is no longer
+needed. Dropping it eliminates the kconfig warnings and still builds
+with no problems reported.
+
+Fix the following kconfig warnings:
+
+WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_PDC
+ Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n]
+ Selected by [m]:
+ - SND_ATMEL_SOC_SSC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m]
+ - SND_ATMEL_SOC_SSC_PDC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
+
+WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_PDC
+ Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
+ Selected by [m]:
+ - SND_AT91_SOC_SAM9G20_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
+
+WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC
+ Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n]
+ Selected by [m]:
+ - SND_ATMEL_SOC_SSC_DMA [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
+
+WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_DMA
+ Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
+ Selected by [m]:
+ - SND_ATMEL_SOC_WM8904 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && I2C [=m]
+ - SND_AT91_SOC_SAM9X5_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210707214752.3831-1-rdunlap@infradead.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index ec04e3386bc0..8617793ed955 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -11,7 +11,6 @@ if SND_ATMEL_SOC
+
+ config SND_ATMEL_SOC_PDC
+ bool
+- depends on HAS_DMA
+
+ config SND_ATMEL_SOC_DMA
+ bool
+--
+2.30.2
+
--- /dev/null
+From f7e24c98c1a7c9bdcd13ae063178306c14f1a625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 16:24:56 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps
+ for the matching in-/output
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit dccd1dfd0770bfd494b68d1135b4547b2c602c42 ]
+
+Move the "Platform Clock" routes for the "Internal Mic" and "Speaker"
+routes to the intmic_*_map[] / *_spk_map[] arrays.
+
+This ensures that these "Platform Clock" routes do not get added when the
+BYT_RT5640_NO_INTERNAL_MIC_MAP / BYT_RT5640_NO_SPEAKERS quirks are used.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210802142501.991985-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 91a6d712eb58..c403fb672594 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -290,9 +290,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = {
+ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
+ {"Headphone", NULL, "Platform Clock"},
+ {"Headset Mic", NULL, "Platform Clock"},
+- {"Internal Mic", NULL, "Platform Clock"},
+- {"Speaker", NULL, "Platform Clock"},
+-
+ {"Headset Mic", NULL, "MICBIAS1"},
+ {"IN2P", NULL, "Headset Mic"},
+ {"Headphone", NULL, "HPOL"},
+@@ -300,19 +297,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"DMIC1", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"DMIC2", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"Internal Mic", NULL, "MICBIAS1"},
+ {"IN1P", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"Internal Mic", NULL, "MICBIAS1"},
+ {"IN3P", NULL, "Internal Mic"},
+ };
+@@ -354,6 +355,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
++ {"Speaker", NULL, "Platform Clock"},
+ {"Speaker", NULL, "SPOLP"},
+ {"Speaker", NULL, "SPOLN"},
+ {"Speaker", NULL, "SPORP"},
+@@ -361,6 +363,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = {
++ {"Speaker", NULL, "Platform Clock"},
+ {"Speaker", NULL, "SPOLP"},
+ {"Speaker", NULL, "SPOLN"},
+ };
+--
+2.30.2
+
--- /dev/null
+From 87facc6d4eb761bb4cf7b6c5a75495d822fd5570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 09:57:36 +0200
+Subject: ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit e4e0633bcadc950b4b4af06c7f1bb7f7e3e86321 ]
+
+KeyPhrasebuffer, Mixin and Mixout modules configuration is described by
+firmware's basic module configuration structure. There are no extended
+parameters required. Update functions taking part in building
+INIT_INSTANCE IPC payload to reflect that.
+
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Link: https://lore.kernel.org/r/20210818075742.1515155-6-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-messages.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
+index 476ef1897961..79c6cf2c14bf 100644
+--- a/sound/soc/intel/skylake/skl-messages.c
++++ b/sound/soc/intel/skylake/skl-messages.c
+@@ -802,9 +802,12 @@ static u16 skl_get_module_param_size(struct skl_dev *skl,
+
+ case SKL_MODULE_TYPE_BASE_OUTFMT:
+ case SKL_MODULE_TYPE_MIC_SELECT:
+- case SKL_MODULE_TYPE_KPB:
+ return sizeof(struct skl_base_outfmt_cfg);
+
++ case SKL_MODULE_TYPE_MIXER:
++ case SKL_MODULE_TYPE_KPB:
++ return sizeof(struct skl_base_cfg);
++
+ default:
+ /*
+ * return only base cfg when no specific module type is
+@@ -857,10 +860,14 @@ static int skl_set_module_format(struct skl_dev *skl,
+
+ case SKL_MODULE_TYPE_BASE_OUTFMT:
+ case SKL_MODULE_TYPE_MIC_SELECT:
+- case SKL_MODULE_TYPE_KPB:
+ skl_set_base_outfmt_format(skl, module_config, *param_data);
+ break;
+
++ case SKL_MODULE_TYPE_MIXER:
++ case SKL_MODULE_TYPE_KPB:
++ skl_set_base_module_format(skl, module_config, *param_data);
++ break;
++
+ default:
+ skl_set_base_module_format(skl, module_config, *param_data);
+ break;
+--
+2.30.2
+
--- /dev/null
+From f0d920d7d3c186c755291085f96c39f5025319c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 09:57:37 +0200
+Subject: ASoC: Intel: Skylake: Fix passing loadable flag for module
+
+From: Gustaw Lewandowski <gustaw.lewandowski@linux.intel.com>
+
+[ Upstream commit c5ed9c547cba1dc1238c6e8a0c290fd62ee6e127 ]
+
+skl_get_module_info() tries to set mconfig->module->loadable before
+mconfig->module has been assigned thus flag was always set to false
+and driver did not try to load module binaries.
+
+Signed-off-by: Gustaw Lewandowski <gustaw.lewandowski@linux.intel.com>
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Link: https://lore.kernel.org/r/20210818075742.1515155-7-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-pcm.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
+index b1ca64d2f7ea..031d5dc7e660 100644
+--- a/sound/soc/intel/skylake/skl-pcm.c
++++ b/sound/soc/intel/skylake/skl-pcm.c
+@@ -1317,21 +1317,6 @@ static int skl_get_module_info(struct skl_dev *skl,
+ return -EIO;
+ }
+
+- list_for_each_entry(module, &skl->uuid_list, list) {
+- if (guid_equal(uuid_mod, &module->uuid)) {
+- mconfig->id.module_id = module->id;
+- if (mconfig->module)
+- mconfig->module->loadable = module->is_loadable;
+- ret = 0;
+- break;
+- }
+- }
+-
+- if (ret)
+- return ret;
+-
+- uuid_mod = &module->uuid;
+- ret = -EIO;
+ for (i = 0; i < skl->nr_modules; i++) {
+ skl_module = skl->modules[i];
+ uuid_tplg = &skl_module->uuid;
+@@ -1341,10 +1326,18 @@ static int skl_get_module_info(struct skl_dev *skl,
+ break;
+ }
+ }
++
+ if (skl->nr_modules && ret)
+ return ret;
+
++ ret = -EIO;
+ list_for_each_entry(module, &skl->uuid_list, list) {
++ if (guid_equal(uuid_mod, &module->uuid)) {
++ mconfig->id.module_id = module->id;
++ mconfig->module->loadable = module->is_loadable;
++ ret = 0;
++ }
++
+ for (i = 0; i < MAX_IN_QUEUE; i++) {
+ pin_id = &mconfig->m_in_pin[i].id;
+ if (guid_equal(&pin_id->mod_uuid, &module->uuid))
+@@ -1358,7 +1351,7 @@ static int skl_get_module_info(struct skl_dev *skl,
+ }
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static int skl_populate_modules(struct skl_dev *skl)
+--
+2.30.2
+
--- /dev/null
+From 619faa42147a326232cba7538df6b252b6ec05ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 10:21:50 -0500
+Subject: ASoC: Intel: update sof_pcm512x quirks
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 22414cade8dfec25ab94df52b3a4f7aa8edb6120 ]
+
+The default SOF topology enables SSP capture and DMICs, even though
+both of these hardware capabilities are not always available in
+hardware (specific versions of HiFiberry and DMIC kit needed).
+
+For the SSP capture, this leads to annoying "SP5-Codec: ASoC: no
+backend capture" and "streamSSP5-Codec: ASoC: no users capture at
+close - state 0" errors.
+
+Update the quirks to match what the topology needs, which also allows
+for the ability to remove SSP capture and DMIC support.
+
+BugLink: https://github.com/thesofproject/linux/issues/3061
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Link: https://lore.kernel.org/r/20210802152151.15832-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_pcm512x.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_pcm512x.c b/sound/soc/intel/boards/sof_pcm512x.c
+index 2ec9c62366e2..6815204e58d5 100644
+--- a/sound/soc/intel/boards/sof_pcm512x.c
++++ b/sound/soc/intel/boards/sof_pcm512x.c
+@@ -26,11 +26,16 @@
+
+ #define SOF_PCM512X_SSP_CODEC(quirk) ((quirk) & GENMASK(3, 0))
+ #define SOF_PCM512X_SSP_CODEC_MASK (GENMASK(3, 0))
++#define SOF_PCM512X_ENABLE_SSP_CAPTURE BIT(4)
++#define SOF_PCM512X_ENABLE_DMIC BIT(5)
+
+ #define IDISP_CODEC_MASK 0x4
+
+ /* Default: SSP5 */
+-static unsigned long sof_pcm512x_quirk = SOF_PCM512X_SSP_CODEC(5);
++static unsigned long sof_pcm512x_quirk =
++ SOF_PCM512X_SSP_CODEC(5) |
++ SOF_PCM512X_ENABLE_SSP_CAPTURE |
++ SOF_PCM512X_ENABLE_DMIC;
+
+ static bool is_legacy_cpu;
+
+@@ -244,8 +249,9 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev,
+ links[id].dpcm_playback = 1;
+ /*
+ * capture only supported with specific versions of the Hifiberry DAC+
+- * links[id].dpcm_capture = 1;
+ */
++ if (sof_pcm512x_quirk & SOF_PCM512X_ENABLE_SSP_CAPTURE)
++ links[id].dpcm_capture = 1;
+ links[id].no_pcm = 1;
+ links[id].cpus = &cpus[id];
+ links[id].num_cpus = 1;
+@@ -380,6 +386,9 @@ static int sof_audio_probe(struct platform_device *pdev)
+
+ ssp_codec = sof_pcm512x_quirk & SOF_PCM512X_SSP_CODEC_MASK;
+
++ if (!(sof_pcm512x_quirk & SOF_PCM512X_ENABLE_DMIC))
++ dmic_be_num = 0;
++
+ /* compute number of dai links */
+ sof_audio_card_pcm512x.num_links = 1 + dmic_be_num + hdmi_num;
+
+--
+2.30.2
+
--- /dev/null
+From 4fb47685598d24f342958699cce0b1cd2500244e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 12:01:50 +0800
+Subject: ASoC: rockchip: i2s: Fix regmap_ops hang
+
+From: Sugar Zhang <sugar.zhang@rock-chips.com>
+
+[ Upstream commit 53ca9b9777b95cdd689181d7c547e38dc79adad0 ]
+
+API 'set_fmt' maybe called when PD is off, in the situation,
+any register access will hang the system. so, enable PD
+before r/w register.
+
+Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
+Link: https://lore.kernel.org/r/1629950520-14190-4-git-send-email-sugar.zhang@rock-chips.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index c7dc3509bceb..1fd47e56c77f 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -186,7 +186,9 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ {
+ struct rk_i2s_dev *i2s = to_info(cpu_dai);
+ unsigned int mask = 0, val = 0;
++ int ret = 0;
+
++ pm_runtime_get_sync(cpu_dai->dev);
+ mask = I2S_CKR_MSS_MASK;
+ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+ case SND_SOC_DAIFMT_CBS_CFS:
+@@ -199,7 +201,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ i2s->is_master_mode = false;
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
+@@ -213,7 +216,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ val = I2S_CKR_CKP_POS;
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
+@@ -236,7 +240,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_TXCR, mask, val);
+@@ -259,12 +264,16 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_RXCR, mask, val);
+
+- return 0;
++err_pm_put:
++ pm_runtime_put(cpu_dai->dev);
++
++ return ret;
+ }
+
+ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
+--
+2.30.2
+
--- /dev/null
+From c14a472f4cda6459ca41cdf7fa0ebc0ea8caafe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 12:02:36 +0800
+Subject: ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
+
+From: Xiaotan Luo <lxt@rock-chips.com>
+
+[ Upstream commit 1bf56843e664eef2525bdbfae6a561e98910f676 ]
+
+- DSP_A: PCM delay 1 bit mode, L data MSB after FRM LRC
+- DSP_B: PCM no delay mode, L data MSB during FRM LRC
+
+Signed-off-by: Xiaotan Luo <lxt@rock-chips.com>
+Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
+Link: https://lore.kernel.org/r/1629950562-14281-3-git-send-email-sugar.zhang@rock-chips.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 1fd47e56c77f..b65dfbc3545b 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -233,12 +233,12 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_I2S:
+ val = I2S_TXCR_IBM_NORMAL;
+ break;
+- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+- val = I2S_TXCR_TFS_PCM;
+- break;
+- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
++ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
+ val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
+ break;
++ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
++ val = I2S_TXCR_TFS_PCM;
++ break;
+ default:
+ ret = -EINVAL;
+ goto err_pm_put;
+@@ -257,12 +257,12 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_I2S:
+ val = I2S_RXCR_IBM_NORMAL;
+ break;
+- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+- val = I2S_RXCR_TFS_PCM;
+- break;
+- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
++ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
+ val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
+ break;
++ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
++ val = I2S_RXCR_TFS_PCM;
++ break;
+ default:
+ ret = -EINVAL;
+ goto err_pm_put;
+--
+2.30.2
+
--- /dev/null
+From 0e7391731ee3429bcf3a871143dc57c027c4cc69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 13:08:26 +0900
+Subject: ASoC: rsnd: adg: clearly handle clock error / NULL case
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit cc64c390b215b404524725a94857d6fb58d9a62a ]
+
+This driver is assuming that all adg->clk[i] is not NULL.
+Because of this prerequisites, for_each_rsnd_clk() is possible to work
+for all clk without checking NULL. In other words, all adg->clk[i]
+should not NULL.
+
+Some SoC might doesn't have clk_a/b/c/i. devm_clk_get() returns error in
+such case. This driver calls rsnd_adg_null_clk_get() and use null_clk
+instead of NULL in such cases.
+
+But devm_clk_get() might returns NULL even though such clocks exist, but
+it doesn't mean error (user deliberately chose to disable the feature).
+NULL clk itself is not error from clk point of view, but is error from
+this driver point of view because it is not assuming such case.
+
+But current code is using IS_ERR() which doesn't care NULL.
+This driver uses IS_ERR_OR_NULL() instead of IS_ERR() for clk check.
+And it uses ERR_CAST() to clarify null_clk error.
+
+One concern here is that it unconditionally uses null_clk if clk_a/b/c/i
+was error. It is correct if it doesn't exist, but is not correct if it
+returns error even though it exist.
+It needs to check "clock-names" from DT before calling devm_clk_get() to
+handling such case. But let's assume it is overkill so far.
+
+Link: https://lore.kernel.org/r/YMCmhfQUimHCSH/n@mwanda
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87v940wyf9.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/adg.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
+index 0ebee1ed06a9..5f1e72edfee0 100644
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -391,9 +391,9 @@ static struct clk *rsnd_adg_create_null_clk(struct rsnd_priv *priv,
+ struct clk *clk;
+
+ clk = clk_register_fixed_rate(dev, name, parent, 0, 0);
+- if (IS_ERR(clk)) {
++ if (IS_ERR_OR_NULL(clk)) {
+ dev_err(dev, "create null clk error\n");
+- return NULL;
++ return ERR_CAST(clk);
+ }
+
+ return clk;
+@@ -430,9 +430,9 @@ static int rsnd_adg_get_clkin(struct rsnd_priv *priv)
+ for (i = 0; i < CLKMAX; i++) {
+ clk = devm_clk_get(dev, clk_name[i]);
+
+- if (IS_ERR(clk))
++ if (IS_ERR_OR_NULL(clk))
+ clk = rsnd_adg_null_clk_get(priv);
+- if (IS_ERR(clk))
++ if (IS_ERR_OR_NULL(clk))
+ goto err;
+
+ adg->clk[i] = clk;
+@@ -582,7 +582,7 @@ static int rsnd_adg_get_clkout(struct rsnd_priv *priv)
+ if (!count) {
+ clk = clk_register_fixed_rate(dev, clkout_name[CLKOUT],
+ parent_clk_name, 0, req_rate[0]);
+- if (IS_ERR(clk))
++ if (IS_ERR_OR_NULL(clk))
+ goto err;
+
+ adg->clkout[CLKOUT] = clk;
+@@ -596,7 +596,7 @@ static int rsnd_adg_get_clkout(struct rsnd_priv *priv)
+ clk = clk_register_fixed_rate(dev, clkout_name[i],
+ parent_clk_name, 0,
+ req_rate[0]);
+- if (IS_ERR(clk))
++ if (IS_ERR_OR_NULL(clk))
+ goto err;
+
+ adg->clkout[i] = clk;
+--
+2.30.2
+
--- /dev/null
+From 5f09af832454f94dd29a979eae5e799961d9f0ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 11:40:53 -0500
+Subject: ASoC: soc-pcm: protect BE dailink state changes in trigger
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 0c75fc7193387776c10f7c7b440d93496e3d5e21 ]
+
+When more than one FE is connected to a BE, e.g. in a mixing use case,
+the BE can be triggered multiple times when the FE are opened/started
+concurrently. This race condition is problematic in the case of
+SoundWire BE dailinks, and this is not desirable in a general
+case. The code carefully checks when the BE can be stopped or
+hw_free'ed, but the trigger code does not use any mutual exclusion.
+
+Fix by using the same spinlock already used to check FE states, and
+set the state before the trigger. In case of errors, the initial
+state will be restored.
+
+This patch does not change how the triggers are handled, it only makes
+sure the states are handled in critical sections.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Message-Id: <20210817164054.250028-2-pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 103 ++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 85 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index d1c570ca21ea..b944f56a469a 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2001,6 +2001,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
+ struct snd_soc_pcm_runtime *be;
+ struct snd_soc_dpcm *dpcm;
+ int ret = 0;
++ unsigned long flags;
++ enum snd_soc_dpcm_state state;
+
+ for_each_dpcm_be(fe, stream, dpcm) {
+ struct snd_pcm_substream *be_substream;
+@@ -2017,76 +2019,141 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
+ break;
+ case SNDRV_PCM_TRIGGER_RESUME:
+- if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
+ break;
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_START) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ if (!snd_soc_dpcm_can_be_free_stop(fe, be, stream))
+ continue;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
++
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
+ break;
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+- if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ if (!snd_soc_dpcm_can_be_free_stop(fe, be, stream))
+ continue;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
++
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_SUSPEND;
+ break;
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START) {
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ continue;
++ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ if (!snd_soc_dpcm_can_be_free_stop(fe, be, stream))
+ continue;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ state = be->dpcm[stream].state;
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_PAUSED;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
++
+ ret = soc_pcm_trigger(be_substream, cmd);
+- if (ret)
++ if (ret) {
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
++ be->dpcm[stream].state = state;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ goto end;
++ }
+
+- be->dpcm[stream].state = SND_SOC_DPCM_STATE_PAUSED;
+ break;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 76d6f202e3501d00be19707fa55cf1a25df8fac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 22:42:45 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix DIT mode support
+
+From: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+
+[ Upstream commit bbdd3f4dbe81e19b9123bc54e23ed54517615524 ]
+
+The DIT mode support has not been tested due to lack of platform where it
+can be tested.
+To be able to use the McASP on OMAP4/5 (only supporting DIT mode) we need
+to have DIT mode working in the McASP driver on a know platform.
+After hacking around (on BBW, mcasp1.axr1 can be routed out for this) it
+appeared that DIT mode is broken.
+
+This patch fixes it up and 16/24 bit audio works along with passthrough,
+but I have only tested with DTS example and test files.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20210705194249.2385-2-peter.ujfalusi@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/davinci-mcasp.c | 150 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 129 insertions(+), 21 deletions(-)
+
+diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
+index 017a5a5e56cd..64ec6d485834 100644
+--- a/sound/soc/ti/davinci-mcasp.c
++++ b/sound/soc/ti/davinci-mcasp.c
+@@ -83,6 +83,8 @@ struct davinci_mcasp {
+ struct snd_pcm_substream *substreams[2];
+ unsigned int dai_fmt;
+
++ u32 iec958_status;
++
+ /* Audio can not be enabled due to missing parameter(s) */
+ bool missing_audio_param;
+
+@@ -757,6 +759,9 @@ static int davinci_mcasp_set_tdm_slot(struct snd_soc_dai *dai,
+ {
+ struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
+
++ if (mcasp->op_mode == DAVINCI_MCASP_DIT_MODE)
++ return 0;
++
+ dev_dbg(mcasp->dev,
+ "%s() tx_mask 0x%08x rx_mask 0x%08x slots %d width %d\n",
+ __func__, tx_mask, rx_mask, slots, slot_width);
+@@ -827,6 +832,20 @@ static int davinci_config_channel_size(struct davinci_mcasp *mcasp,
+ mcasp_mod_bits(mcasp, DAVINCI_MCASP_RXFMT_REG, RXROT(rx_rotate),
+ RXROT(7));
+ mcasp_set_reg(mcasp, DAVINCI_MCASP_RXMASK_REG, mask);
++ } else {
++ /*
++ * according to the TRM it should be TXROT=0, this one works:
++ * 16 bit to 23-8 (TXROT=6, rotate 24 bits)
++ * 24 bit to 23-0 (TXROT=0, rotate 0 bits)
++ *
++ * TXROT = 0 only works with 24bit samples
++ */
++ tx_rotate = (sample_width / 4 + 2) & 0x7;
++
++ mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, TXROT(tx_rotate),
++ TXROT(7));
++ mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, TXSSZ(15),
++ TXSSZ(0x0F));
+ }
+
+ mcasp_set_reg(mcasp, DAVINCI_MCASP_TXMASK_REG, mask);
+@@ -842,10 +861,16 @@ static int mcasp_common_hw_param(struct davinci_mcasp *mcasp, int stream,
+ u8 tx_ser = 0;
+ u8 rx_ser = 0;
+ u8 slots = mcasp->tdm_slots;
+- u8 max_active_serializers = (channels + slots - 1) / slots;
+- u8 max_rx_serializers, max_tx_serializers;
++ u8 max_active_serializers, max_rx_serializers, max_tx_serializers;
+ int active_serializers, numevt;
+ u32 reg;
++
++ /* In DIT mode we only allow maximum of one serializers for now */
++ if (mcasp->op_mode == DAVINCI_MCASP_DIT_MODE)
++ max_active_serializers = 1;
++ else
++ max_active_serializers = (channels + slots - 1) / slots;
++
+ /* Default configuration */
+ if (mcasp->version < MCASP_VERSION_3)
+ mcasp_set_bits(mcasp, DAVINCI_MCASP_PWREMUMGT_REG, MCASP_SOFT);
+@@ -1031,16 +1056,18 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ static int mcasp_dit_hw_param(struct davinci_mcasp *mcasp,
+ unsigned int rate)
+ {
+- u32 cs_value = 0;
+- u8 *cs_bytes = (u8*) &cs_value;
++ u8 *cs_bytes = (u8 *)&mcasp->iec958_status;
+
+- /* Set the TX format : 24 bit right rotation, 32 bit slot, Pad 0
+- and LSB first */
+- mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, TXROT(6) | TXSSZ(15));
++ if (!mcasp->dat_port)
++ mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, TXSEL);
++ else
++ mcasp_clr_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, TXSEL);
+
+ /* Set TX frame synch : DIT Mode, 1 bit width, internal, rising edge */
+ mcasp_set_reg(mcasp, DAVINCI_MCASP_TXFMCTL_REG, AFSXE | FSXMOD(0x180));
+
++ mcasp_set_reg(mcasp, DAVINCI_MCASP_TXMASK_REG, 0xFFFF);
++
+ /* Set the TX tdm : for all the slots */
+ mcasp_set_reg(mcasp, DAVINCI_MCASP_TXTDM_REG, 0xFFFFFFFF);
+
+@@ -1049,16 +1076,8 @@ static int mcasp_dit_hw_param(struct davinci_mcasp *mcasp,
+
+ mcasp_clr_bits(mcasp, DAVINCI_MCASP_XEVTCTL_REG, TXDATADMADIS);
+
+- /* Only 44100 and 48000 are valid, both have the same setting */
+- mcasp_set_bits(mcasp, DAVINCI_MCASP_AHCLKXCTL_REG, AHCLKXDIV(3));
+-
+- /* Enable the DIT */
+- mcasp_set_bits(mcasp, DAVINCI_MCASP_TXDITCTL_REG, DITEN);
+-
+ /* Set S/PDIF channel status bits */
+- cs_bytes[0] = IEC958_AES0_CON_NOT_COPYRIGHT;
+- cs_bytes[1] = IEC958_AES1_CON_PCM_CODER;
+-
++ cs_bytes[3] &= ~IEC958_AES3_CON_FS;
+ switch (rate) {
+ case 22050:
+ cs_bytes[3] |= IEC958_AES3_CON_FS_22050;
+@@ -1088,12 +1107,15 @@ static int mcasp_dit_hw_param(struct davinci_mcasp *mcasp,
+ cs_bytes[3] |= IEC958_AES3_CON_FS_192000;
+ break;
+ default:
+- printk(KERN_WARNING "unsupported sampling rate: %d\n", rate);
++ dev_err(mcasp->dev, "unsupported sampling rate: %d\n", rate);
+ return -EINVAL;
+ }
+
+- mcasp_set_reg(mcasp, DAVINCI_MCASP_DITCSRA_REG, cs_value);
+- mcasp_set_reg(mcasp, DAVINCI_MCASP_DITCSRB_REG, cs_value);
++ mcasp_set_reg(mcasp, DAVINCI_MCASP_DITCSRA_REG, mcasp->iec958_status);
++ mcasp_set_reg(mcasp, DAVINCI_MCASP_DITCSRB_REG, mcasp->iec958_status);
++
++ /* Enable the DIT */
++ mcasp_set_bits(mcasp, DAVINCI_MCASP_TXDITCTL_REG, DITEN);
+
+ return 0;
+ }
+@@ -1237,12 +1259,18 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
+ int slots = mcasp->tdm_slots;
+ int rate = params_rate(params);
+ int sbits = params_width(params);
++ unsigned int bclk_target;
+
+ if (mcasp->slot_width)
+ sbits = mcasp->slot_width;
+
++ if (mcasp->op_mode == DAVINCI_MCASP_IIS_MODE)
++ bclk_target = rate * sbits * slots;
++ else
++ bclk_target = rate * 128;
++
+ davinci_mcasp_calc_clk_div(mcasp, mcasp->sysclk_freq,
+- rate * sbits * slots, true);
++ bclk_target, true);
+ }
+
+ ret = mcasp_common_hw_param(mcasp, substream->stream,
+@@ -1598,6 +1626,77 @@ static const struct snd_soc_dai_ops davinci_mcasp_dai_ops = {
+ .set_tdm_slot = davinci_mcasp_set_tdm_slot,
+ };
+
++static int davinci_mcasp_iec958_info(struct snd_kcontrol *kcontrol,
++ struct snd_ctl_elem_info *uinfo)
++{
++ uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
++ uinfo->count = 1;
++
++ return 0;
++}
++
++static int davinci_mcasp_iec958_get(struct snd_kcontrol *kcontrol,
++ struct snd_ctl_elem_value *uctl)
++{
++ struct snd_soc_dai *cpu_dai = snd_kcontrol_chip(kcontrol);
++ struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(cpu_dai);
++
++ memcpy(uctl->value.iec958.status, &mcasp->iec958_status,
++ sizeof(mcasp->iec958_status));
++
++ return 0;
++}
++
++static int davinci_mcasp_iec958_put(struct snd_kcontrol *kcontrol,
++ struct snd_ctl_elem_value *uctl)
++{
++ struct snd_soc_dai *cpu_dai = snd_kcontrol_chip(kcontrol);
++ struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(cpu_dai);
++
++ memcpy(&mcasp->iec958_status, uctl->value.iec958.status,
++ sizeof(mcasp->iec958_status));
++
++ return 0;
++}
++
++static int davinci_mcasp_iec958_con_mask_get(struct snd_kcontrol *kcontrol,
++ struct snd_ctl_elem_value *ucontrol)
++{
++ struct snd_soc_dai *cpu_dai = snd_kcontrol_chip(kcontrol);
++ struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(cpu_dai);
++
++ memset(ucontrol->value.iec958.status, 0xff, sizeof(mcasp->iec958_status));
++ return 0;
++}
++
++static const struct snd_kcontrol_new davinci_mcasp_iec958_ctls[] = {
++ {
++ .access = (SNDRV_CTL_ELEM_ACCESS_READWRITE |
++ SNDRV_CTL_ELEM_ACCESS_VOLATILE),
++ .iface = SNDRV_CTL_ELEM_IFACE_PCM,
++ .name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
++ .info = davinci_mcasp_iec958_info,
++ .get = davinci_mcasp_iec958_get,
++ .put = davinci_mcasp_iec958_put,
++ }, {
++ .access = SNDRV_CTL_ELEM_ACCESS_READ,
++ .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++ .name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, CON_MASK),
++ .info = davinci_mcasp_iec958_info,
++ .get = davinci_mcasp_iec958_con_mask_get,
++ },
++};
++
++static void davinci_mcasp_init_iec958_status(struct davinci_mcasp *mcasp)
++{
++ unsigned char *cs = (u8 *)&mcasp->iec958_status;
++
++ cs[0] = IEC958_AES0_CON_NOT_COPYRIGHT | IEC958_AES0_CON_EMPHASIS_NONE;
++ cs[1] = IEC958_AES1_CON_PCM_CODER;
++ cs[2] = IEC958_AES2_CON_SOURCE_UNSPEC | IEC958_AES2_CON_CHANNEL_UNSPEC;
++ cs[3] = IEC958_AES3_CON_CLOCK_1000PPM;
++}
++
+ static int davinci_mcasp_dai_probe(struct snd_soc_dai *dai)
+ {
+ struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
+@@ -1605,6 +1704,12 @@ static int davinci_mcasp_dai_probe(struct snd_soc_dai *dai)
+ dai->playback_dma_data = &mcasp->dma_data[SNDRV_PCM_STREAM_PLAYBACK];
+ dai->capture_dma_data = &mcasp->dma_data[SNDRV_PCM_STREAM_CAPTURE];
+
++ if (mcasp->op_mode == DAVINCI_MCASP_DIT_MODE) {
++ davinci_mcasp_init_iec958_status(mcasp);
++ snd_soc_add_dai_controls(dai, davinci_mcasp_iec958_ctls,
++ ARRAY_SIZE(davinci_mcasp_iec958_ctls));
++ }
++
+ return 0;
+ }
+
+@@ -1651,7 +1756,8 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
+ .channels_min = 1,
+ .channels_max = 384,
+ .rates = DAVINCI_MCASP_RATES,
+- .formats = DAVINCI_MCASP_PCM_FMTS,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE |
++ SNDRV_PCM_FMTBIT_S24_LE,
+ },
+ .ops = &davinci_mcasp_dai_ops,
+ },
+@@ -1871,6 +1977,8 @@ static int davinci_mcasp_get_config(struct davinci_mcasp *mcasp,
+ } else {
+ mcasp->tdm_slots = pdata->tdm_slots;
+ }
++ } else {
++ mcasp->tdm_slots = 32;
+ }
+
+ mcasp->num_serializer = pdata->num_serializer;
+--
+2.30.2
+
--- /dev/null
+From 5716e475559548979219524edea37761c6f93e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 15:51:30 +0300
+Subject: ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3ad4a31620355358316fa08fcfab37b9d6c33347 ]
+
+Last change to device managed APIs cleaned up error path to simple phy_exit()
+call, which in some cases has been executed with NULL parameter. This per se
+is not a problem, but rather logical misconception: no need to free resource
+when it's for sure has not been allocated yet. Fix the driver accordingly.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210727125130.19977-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/sata_dwc_460ex.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
+index f0ef844428bb..338c2e50f759 100644
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -1259,24 +1259,20 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ irq = irq_of_parse_and_map(np, 0);
+ if (irq == NO_IRQ) {
+ dev_err(&ofdev->dev, "no SATA DMA irq\n");
+- err = -ENODEV;
+- goto error_out;
++ return -ENODEV;
+ }
+
+ #ifdef CONFIG_SATA_DWC_OLD_DMA
+ if (!of_find_property(np, "dmas", NULL)) {
+ err = sata_dwc_dma_init_old(ofdev, hsdev);
+ if (err)
+- goto error_out;
++ return err;
+ }
+ #endif
+
+ hsdev->phy = devm_phy_optional_get(hsdev->dev, "sata-phy");
+- if (IS_ERR(hsdev->phy)) {
+- err = PTR_ERR(hsdev->phy);
+- hsdev->phy = NULL;
+- goto error_out;
+- }
++ if (IS_ERR(hsdev->phy))
++ return PTR_ERR(hsdev->phy);
+
+ err = phy_init(hsdev->phy);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From 809635afa45777644ead3ce832deb75ffef4bd3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jun 2021 09:29:14 -0400
+Subject: ath9k: fix OOB read ar9300_eeprom_restore_internal
+
+From: Zekun Shen <bruceshenzk@gmail.com>
+
+[ Upstream commit 23151b9ae79e3bc4f6a0c4cd3a7f355f68dad128 ]
+
+Bad header can have large length field which can cause OOB.
+cptr is the last bytes for read, and the eeprom is parsed
+from high to low address. The OOB, triggered by the condition
+length > cptr could cause memory error with a read on
+negative index.
+
+There are some sanity check around length, but it is not
+compared with cptr (the remaining bytes). Here, the
+corrupted/bad EEPROM can cause panic.
+
+I was able to reproduce the crash, but I cannot find the
+log and the reproducer now. After I applied the patch, the
+bug is no longer reproducible.
+
+Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/YM3xKsQJ0Hw2hjrc@Zekuns-MBP-16.fios-router.home
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index b4885a700296..b0a4ca3559fd 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -3351,7 +3351,8 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
+ "Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n",
+ cptr, code, reference, length, major, minor);
+ if ((!AR_SREV_9485(ah) && length >= 1024) ||
+- (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) {
++ (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) ||
++ (length > cptr)) {
+ ath_dbg(common, EEPROM, "Skipping bad header\n");
+ cptr -= COMP_HDR_LEN;
+ continue;
+--
+2.30.2
+
--- /dev/null
+From 5eb01358ed36bb1ae77f6eeb23434a049142d898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 12:05:16 +0800
+Subject: ath9k: fix sleeping in atomic context
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit 7c48662b9d56666219f526a71ace8c15e6e12f1f ]
+
+The problem is that gpio_free() can sleep and the cfg_soc() can be
+called with spinlocks held. One problematic call tree is:
+
+--> ath_reset_internal() takes &sc->sc_pcu_lock spin lock
+ --> ath9k_hw_reset()
+ --> ath9k_hw_gpio_request_in()
+ --> ath9k_hw_gpio_request()
+ --> ath9k_hw_gpio_cfg_soc()
+
+Remove gpio_free(), use error message instead, so we should make sure
+there is no GPIO conflict.
+
+Also remove ath9k_hw_gpio_free() from ath9k_hw_apply_gpio_override(),
+as gpio_mask will never be set for SOC chips.
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1628481916-15030-1-git-send-email-miaoqing@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 2ca3b86714a9..172081ffe477 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1621,7 +1621,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah)
+ ath9k_hw_gpio_request_out(ah, i, NULL,
+ AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ ath9k_hw_set_gpio(ah, i, !!(ah->gpio_val & BIT(i)));
+- ath9k_hw_gpio_free(ah, i);
+ }
+ }
+
+@@ -2728,14 +2727,17 @@ static void ath9k_hw_gpio_cfg_output_mux(struct ath_hw *ah, u32 gpio, u32 type)
+ static void ath9k_hw_gpio_cfg_soc(struct ath_hw *ah, u32 gpio, bool out,
+ const char *label)
+ {
++ int err;
++
+ if (ah->caps.gpio_requested & BIT(gpio))
+ return;
+
+- /* may be requested by BSP, free anyway */
+- gpio_free(gpio);
+-
+- if (gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label))
++ err = gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label);
++ if (err) {
++ ath_err(ath9k_hw_common(ah), "request GPIO%d failed:%d\n",
++ gpio, err);
+ return;
++ }
+
+ ah->caps.gpio_requested |= BIT(gpio);
+ }
+--
+2.30.2
+
--- /dev/null
+From 79c680ef1df379cb1e71eca19c2bb15088abf870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:14:06 +0800
+Subject: Bluetooth: avoid circular locks in sco_sock_connect
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 734bc5ff783115aa3164f4e9dd5967ae78e0a8ab ]
+
+In a future patch, calls to bh_lock_sock in sco.c should be replaced
+by lock_sock now that none of the functions are run in IRQ context.
+
+However, doing so results in a circular locking dependency:
+
+======================================================
+WARNING: possible circular locking dependency detected
+5.14.0-rc4-syzkaller #0 Not tainted
+------------------------------------------------------
+syz-executor.2/14867 is trying to acquire lock:
+ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
+lock_sock include/net/sock.h:1613 [inline]
+ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
+sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
+
+but task is already holding lock:
+ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
+hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
+ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
+hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
+ __mutex_lock_common kernel/locking/mutex.c:959 [inline]
+ __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
+ hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
+ hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
+ hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
+ hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
+ process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
+ worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
+ kthread+0x3e5/0x4d0 kernel/kthread.c:319
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
+
+-> #1 (&hdev->lock){+.+.}-{3:3}:
+ __mutex_lock_common kernel/locking/mutex.c:959 [inline]
+ __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
+ sco_connect net/bluetooth/sco.c:245 [inline]
+ sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
+ __sys_connect_file+0x155/0x1a0 net/socket.c:1879
+ __sys_connect+0x161/0x190 net/socket.c:1896
+ __do_sys_connect net/socket.c:1906 [inline]
+ __se_sys_connect net/socket.c:1903 [inline]
+ __x64_sys_connect+0x6f/0xb0 net/socket.c:1903
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
+ check_prev_add kernel/locking/lockdep.c:3051 [inline]
+ check_prevs_add kernel/locking/lockdep.c:3174 [inline]
+ validate_chain kernel/locking/lockdep.c:3789 [inline]
+ __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
+ lock_acquire kernel/locking/lockdep.c:5625 [inline]
+ lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
+ lock_sock_nested+0xca/0x120 net/core/sock.c:3170
+ lock_sock include/net/sock.h:1613 [inline]
+ sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
+ sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
+ hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
+ hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
+ hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
+ hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
+ vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
+ __fput+0x288/0x920 fs/file_table.c:280
+ task_work_run+0xdd/0x1a0 kernel/task_work.c:164
+ exit_task_work include/linux/task_work.h:32 [inline]
+ do_exit+0xbd4/0x2a60 kernel/exit.c:825
+ do_group_exit+0x125/0x310 kernel/exit.c:922
+ get_signal+0x47f/0x2160 kernel/signal.c:2808
+ arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
+ handle_signal_work kernel/entry/common.c:148 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
+ exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
+ syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
+ ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
+
+other info that might help us debug this:
+
+Chain exists of:
+ sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(hci_cb_list_lock);
+ lock(&hdev->lock);
+ lock(hci_cb_list_lock);
+ lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
+
+ *** DEADLOCK ***
+
+The issue is that the lock hierarchy should go from &hdev->lock -->
+hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
+one such call trace is:
+
+ hci_dev_do_close():
+ hci_dev_lock();
+ hci_conn_hash_flush():
+ hci_disconn_cfm():
+ mutex_lock(&hci_cb_list_lock);
+ sco_disconn_cfm():
+ sco_conn_del():
+ lock_sock(sk);
+
+However, in sco_sock_connect, we call lock_sock before calling
+hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
+
+We fix this by pulling the call to hci_dev_lock out from sco_connect.
+
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 39 ++++++++++++++++-----------------------
+ 1 file changed, 16 insertions(+), 23 deletions(-)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 9cf1ead1d832..110cfd6aa2b7 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -235,44 +235,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ return err;
+ }
+
+-static int sco_connect(struct sock *sk)
++static int sco_connect(struct hci_dev *hdev, struct sock *sk)
+ {
+ struct sco_conn *conn;
+ struct hci_conn *hcon;
+- struct hci_dev *hdev;
+ int err, type;
+
+ BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
+
+- hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
+- if (!hdev)
+- return -EHOSTUNREACH;
+-
+- hci_dev_lock(hdev);
+-
+ if (lmp_esco_capable(hdev) && !disable_esco)
+ type = ESCO_LINK;
+ else
+ type = SCO_LINK;
+
+ if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
+- (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
+- err = -EOPNOTSUPP;
+- goto done;
+- }
++ (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)))
++ return -EOPNOTSUPP;
+
+ hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
+ sco_pi(sk)->setting);
+- if (IS_ERR(hcon)) {
+- err = PTR_ERR(hcon);
+- goto done;
+- }
++ if (IS_ERR(hcon))
++ return PTR_ERR(hcon);
+
+ conn = sco_conn_add(hcon);
+ if (!conn) {
+ hci_conn_drop(hcon);
+- err = -ENOMEM;
+- goto done;
++ return -ENOMEM;
+ }
+
+ /* Update source addr of the socket */
+@@ -280,7 +268,7 @@ static int sco_connect(struct sock *sk)
+
+ err = sco_chan_add(conn, sk, NULL);
+ if (err)
+- goto done;
++ return err;
+
+ if (hcon->state == BT_CONNECTED) {
+ sco_sock_clear_timer(sk);
+@@ -290,9 +278,6 @@ static int sco_connect(struct sock *sk)
+ sco_sock_set_timer(sk, sk->sk_sndtimeo);
+ }
+
+-done:
+- hci_dev_unlock(hdev);
+- hci_dev_put(hdev);
+ return err;
+ }
+
+@@ -585,6 +570,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
+ {
+ struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+ struct sock *sk = sock->sk;
++ struct hci_dev *hdev;
+ int err;
+
+ BT_DBG("sk %p", sk);
+@@ -599,12 +585,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
+ if (sk->sk_type != SOCK_SEQPACKET)
+ return -EINVAL;
+
++ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
++ if (!hdev)
++ return -EHOSTUNREACH;
++ hci_dev_lock(hdev);
++
+ lock_sock(sk);
+
+ /* Set destination address and psm */
+ bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
+
+- err = sco_connect(sk);
++ err = sco_connect(hdev, sk);
++ hci_dev_unlock(hdev);
++ hci_dev_put(hdev);
+ if (err)
+ goto done;
+
+--
+2.30.2
+
--- /dev/null
+From 7e3dcd2f2e79b1f8f19c5663ea609a14b4539eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 16:20:15 -0700
+Subject: Bluetooth: Fix handling of LE Enhanced Connection Complete
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit cafae4cd625502f65d1798659c1aa9b62d38cc56 ]
+
+LE Enhanced Connection Complete contains the Local RPA used in the
+connection which must be used when set otherwise there could problems
+when pairing since the address used by the remote stack could be the
+Local RPA:
+
+BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
+page 2396
+
+ 'Resolvable Private Address being used by the local device for this
+ connection. This is only valid when the Own_Address_Type (from the
+ HCI_LE_Create_Connection, HCI_LE_Set_Advertising_Parameters,
+ HCI_LE_Set_Extended_Advertising_Parameters, or
+ HCI_LE_Extended_Create_Connection commands) is set to 0x02 or
+ 0x03, and the Controller generated a resolvable private address for the
+ local device using a non-zero local IRK. For other Own_Address_Type
+ values, the Controller shall return all zeros.'
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 93 ++++++++++++++++++++++++++-------------
+ 1 file changed, 62 insertions(+), 31 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 78032f1d8838..f41bd5dfc313 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5133,9 +5133,64 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
+ }
+ #endif
+
++static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
++ u8 bdaddr_type, bdaddr_t *local_rpa)
++{
++ if (conn->out) {
++ conn->dst_type = bdaddr_type;
++ conn->resp_addr_type = bdaddr_type;
++ bacpy(&conn->resp_addr, bdaddr);
++
++ /* Check if the controller has set a Local RPA then it must be
++ * used instead or hdev->rpa.
++ */
++ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
++ conn->init_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->init_addr, local_rpa);
++ } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
++ conn->init_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->init_addr, &conn->hdev->rpa);
++ } else {
++ hci_copy_identity_address(conn->hdev, &conn->init_addr,
++ &conn->init_addr_type);
++ }
++ } else {
++ conn->resp_addr_type = conn->hdev->adv_addr_type;
++ /* Check if the controller has set a Local RPA then it must be
++ * used instead or hdev->rpa.
++ */
++ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
++ conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->resp_addr, local_rpa);
++ } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
++ /* In case of ext adv, resp_addr will be updated in
++ * Adv Terminated event.
++ */
++ if (!ext_adv_capable(conn->hdev))
++ bacpy(&conn->resp_addr,
++ &conn->hdev->random_addr);
++ } else {
++ bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
++ }
++
++ conn->init_addr_type = bdaddr_type;
++ bacpy(&conn->init_addr, bdaddr);
++
++ /* For incoming connections, set the default minimum
++ * and maximum connection interval. They will be used
++ * to check if the parameters are in range and if not
++ * trigger the connection update procedure.
++ */
++ conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
++ conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
++ }
++}
++
+ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+- bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
+- u16 interval, u16 latency, u16 supervision_timeout)
++ bdaddr_t *bdaddr, u8 bdaddr_type,
++ bdaddr_t *local_rpa, u8 role, u16 handle,
++ u16 interval, u16 latency,
++ u16 supervision_timeout)
+ {
+ struct hci_conn_params *params;
+ struct hci_conn *conn;
+@@ -5183,32 +5238,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+ cancel_delayed_work(&conn->le_conn_timeout);
+ }
+
+- if (!conn->out) {
+- /* Set the responder (our side) address type based on
+- * the advertising address type.
+- */
+- conn->resp_addr_type = hdev->adv_addr_type;
+- if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
+- /* In case of ext adv, resp_addr will be updated in
+- * Adv Terminated event.
+- */
+- if (!ext_adv_capable(hdev))
+- bacpy(&conn->resp_addr, &hdev->random_addr);
+- } else {
+- bacpy(&conn->resp_addr, &hdev->bdaddr);
+- }
+-
+- conn->init_addr_type = bdaddr_type;
+- bacpy(&conn->init_addr, bdaddr);
+-
+- /* For incoming connections, set the default minimum
+- * and maximum connection interval. They will be used
+- * to check if the parameters are in range and if not
+- * trigger the connection update procedure.
+- */
+- conn->le_conn_min_interval = hdev->le_conn_min_interval;
+- conn->le_conn_max_interval = hdev->le_conn_max_interval;
+- }
++ le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
+
+ /* Lookup the identity address from the stored connection
+ * address and address type.
+@@ -5319,7 +5349,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
+- ev->role, le16_to_cpu(ev->handle),
++ NULL, ev->role, le16_to_cpu(ev->handle),
+ le16_to_cpu(ev->interval),
+ le16_to_cpu(ev->latency),
+ le16_to_cpu(ev->supervision_timeout));
+@@ -5333,7 +5363,7 @@ static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
+- ev->role, le16_to_cpu(ev->handle),
++ &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
+ le16_to_cpu(ev->interval),
+ le16_to_cpu(ev->latency),
+ le16_to_cpu(ev->supervision_timeout));
+@@ -5369,7 +5399,8 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ if (conn) {
+ struct adv_info *adv_instance;
+
+- if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
++ if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
++ bacmp(&conn->resp_addr, BDADDR_ANY))
+ return;
+
+ if (!ev->handle) {
+--
+2.30.2
+
--- /dev/null
+From 82e1dd68c2ea7bc1add34ad87d1364ca0e9c36d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 16:56:19 -0700
+Subject: Bluetooth: Fix not generating RPA when required
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit c45074d68a9b1e893d86520af71fab37693c3d7e ]
+
+Code was checking if random_addr and hdev->rpa match without first
+checking if the RPA has not been set (BDADDR_ANY), furthermore it was
+clearing HCI_RPA_EXPIRED before the command completes and the RPA is
+actually programmed which in case of failure would leave the expired
+RPA still set.
+
+Since advertising instance have a similar problem the clearing of
+HCI_RPA_EXPIRED has been moved to hci_event.c after checking the random
+address is in fact the hdev->rap and then proceed to set the expire
+timeout.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 4 ++
+ net/bluetooth/hci_event.c | 32 +++++++++----
+ net/bluetooth/hci_request.c | 81 ++++++++++++++------------------
+ 3 files changed, 61 insertions(+), 56 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index db4312e44d47..c17e5557a007 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1412,6 +1412,10 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
+ !hci_dev_test_flag(dev, HCI_AUTO_OFF))
+ #define bredr_sc_enabled(dev) (lmp_sc_capable(dev) && \
+ hci_dev_test_flag(dev, HCI_SC_ENABLED))
++#define rpa_valid(dev) (bacmp(&dev->rpa, BDADDR_ANY) && \
++ !hci_dev_test_flag(dev, HCI_RPA_EXPIRED))
++#define adv_rpa_valid(adv) (bacmp(&adv->random_addr, BDADDR_ANY) && \
++ !adv->rpa_expired)
+
+ #define scan_1m(dev) (((dev)->le_tx_def_phys & HCI_LE_SET_PHY_1M) || \
+ ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_1M))
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index ea7fc09478be..78032f1d8838 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -40,6 +40,8 @@
+ #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
+ "\x00\x00\x00\x00\x00\x00\x00\x00"
+
++#define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
++
+ /* Handle HCI Event packets */
+
+ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
+@@ -1171,6 +1173,12 @@ static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
+
+ bacpy(&hdev->random_addr, sent);
+
++ if (!bacmp(&hdev->rpa, sent)) {
++ hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
++ queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
++ secs_to_jiffies(hdev->rpa_timeout));
++ }
++
+ hci_dev_unlock(hdev);
+ }
+
+@@ -1201,24 +1209,30 @@ static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
+ {
+ __u8 status = *((__u8 *) skb->data);
+ struct hci_cp_le_set_adv_set_rand_addr *cp;
+- struct adv_info *adv_instance;
++ struct adv_info *adv;
+
+ if (status)
+ return;
+
+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
+- if (!cp)
++ /* Update only in case the adv instance since handle 0x00 shall be using
++ * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
++ * non-extended adverting.
++ */
++ if (!cp || !cp->handle)
+ return;
+
+ hci_dev_lock(hdev);
+
+- if (!cp->handle) {
+- /* Store in hdev for instance 0 (Set adv and Directed advs) */
+- bacpy(&hdev->random_addr, &cp->bdaddr);
+- } else {
+- adv_instance = hci_find_adv_instance(hdev, cp->handle);
+- if (adv_instance)
+- bacpy(&adv_instance->random_addr, &cp->bdaddr);
++ adv = hci_find_adv_instance(hdev, cp->handle);
++ if (adv) {
++ bacpy(&adv->random_addr, &cp->bdaddr);
++ if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
++ adv->rpa_expired = false;
++ queue_delayed_work(hdev->workqueue,
++ &adv->rpa_expired_cb,
++ secs_to_jiffies(hdev->rpa_timeout));
++ }
+ }
+
+ hci_dev_unlock(hdev);
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 1d14adc023e9..f15626607b2d 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -2072,8 +2072,6 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
+ * current RPA has expired then generate a new one.
+ */
+ if (use_rpa) {
+- int to;
+-
+ /* If Controller supports LL Privacy use own address type is
+ * 0x03
+ */
+@@ -2084,14 +2082,10 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
+ *own_addr_type = ADDR_LE_DEV_RANDOM;
+
+ if (adv_instance) {
+- if (!adv_instance->rpa_expired &&
+- !bacmp(&adv_instance->random_addr, &hdev->rpa))
++ if (adv_rpa_valid(adv_instance))
+ return 0;
+-
+- adv_instance->rpa_expired = false;
+ } else {
+- if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
+- !bacmp(&hdev->random_addr, &hdev->rpa))
++ if (rpa_valid(hdev))
+ return 0;
+ }
+
+@@ -2103,14 +2097,6 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
+
+ bacpy(rand_addr, &hdev->rpa);
+
+- to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
+- if (adv_instance)
+- queue_delayed_work(hdev->workqueue,
+- &adv_instance->rpa_expired_cb, to);
+- else
+- queue_delayed_work(hdev->workqueue,
+- &hdev->rpa_expired, to);
+-
+ return 0;
+ }
+
+@@ -2153,6 +2139,30 @@ void __hci_req_clear_ext_adv_sets(struct hci_request *req)
+ hci_req_add(req, HCI_OP_LE_CLEAR_ADV_SETS, 0, NULL);
+ }
+
++static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
++{
++ struct hci_dev *hdev = req->hdev;
++
++ /* If we're advertising or initiating an LE connection we can't
++ * go ahead and change the random address at this time. This is
++ * because the eventual initiator address used for the
++ * subsequently created connection will be undefined (some
++ * controllers use the new address and others the one we had
++ * when the operation started).
++ *
++ * In this kind of scenario skip the update and let the random
++ * address be updated at the next cycle.
++ */
++ if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
++ hci_lookup_le_connect(hdev)) {
++ bt_dev_dbg(hdev, "Deferring random address update");
++ hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
++ return;
++ }
++
++ hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
++}
++
+ int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+@@ -2255,6 +2265,13 @@ int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance)
+ } else {
+ if (!bacmp(&random_addr, &hdev->random_addr))
+ return 0;
++ /* Instance 0x00 doesn't have an adv_info, instead it
++ * uses hdev->random_addr to track its address so
++ * whenever it needs to be updated this also set the
++ * random address since hdev->random_addr is shared with
++ * scan state machine.
++ */
++ set_random_addr(req, &random_addr);
+ }
+
+ memset(&cp, 0, sizeof(cp));
+@@ -2512,30 +2529,6 @@ void hci_req_clear_adv_instance(struct hci_dev *hdev, struct sock *sk,
+ false);
+ }
+
+-static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
+-{
+- struct hci_dev *hdev = req->hdev;
+-
+- /* If we're advertising or initiating an LE connection we can't
+- * go ahead and change the random address at this time. This is
+- * because the eventual initiator address used for the
+- * subsequently created connection will be undefined (some
+- * controllers use the new address and others the one we had
+- * when the operation started).
+- *
+- * In this kind of scenario skip the update and let the random
+- * address be updated at the next cycle.
+- */
+- if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
+- hci_lookup_le_connect(hdev)) {
+- bt_dev_dbg(hdev, "Deferring random address update");
+- hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
+- return;
+- }
+-
+- hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
+-}
+-
+ int hci_update_random_address(struct hci_request *req, bool require_privacy,
+ bool use_rpa, u8 *own_addr_type)
+ {
+@@ -2547,8 +2540,6 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
+ * the current RPA in use, then generate a new one.
+ */
+ if (use_rpa) {
+- int to;
+-
+ /* If Controller supports LL Privacy use own address type is
+ * 0x03
+ */
+@@ -2558,8 +2549,7 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
+ else
+ *own_addr_type = ADDR_LE_DEV_RANDOM;
+
+- if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
+- !bacmp(&hdev->random_addr, &hdev->rpa))
++ if (rpa_valid(hdev))
+ return 0;
+
+ err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
+@@ -2570,9 +2560,6 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
+
+ set_random_addr(req, &hdev->rpa);
+
+- to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
+- queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c3bd54cdb53a541bec05ca2177a292a05bdd9a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 05:07:47 +0530
+Subject: Bluetooth: Fix race condition in handling NOP command
+
+From: Kiran K <kiran.k@intel.com>
+
+[ Upstream commit ecb71f2566673553bc067e5b0036756871d0b9d3 ]
+
+For NOP command, need to cancel work scheduled on cmd_timer,
+on receiving command status or commmand complete event.
+
+Below use case might lead to race condition multiple when NOP
+commands are queued sequentially:
+
+hci_cmd_work() {
+ if (atomic_read(&hdev->cmd_cnt) {
+ .
+ .
+ .
+ atomic_dec(&hdev->cmd_cnt);
+ hci_send_frame(hdev,...);
+ schedule_delayed_work(&hdev->cmd_timer,...);
+ }
+}
+
+On receiving event for first NOP, the work scheduled on hdev->cmd_timer
+is not cancelled and second NOP is dequeued and sent to controller.
+
+While waiting for an event for second NOP command, work scheduled on
+cmd_timer for the first NOP can get scheduled, resulting in sending third
+NOP command (sending back to back NOP commands). This might
+cause issues at controller side (like memory overrun, controller going
+unresponsive) resulting in hci tx timeouts, hardware errors etc.
+
+The fix to this issue is to cancel the delayed work scheduled on
+cmd_timer on receiving command status or command complete event for
+NOP command (this patch handles NOP command same as any other SIG
+command).
+
+Signed-off-by: Kiran K <kiran.k@intel.com>
+Reviewed-by: Chethan T N <chethan.tumkur.narayan@intel.com>
+Reviewed-by: Srivatsa Ravishankar <ravishankar.srivatsa@intel.com>
+Acked-by: Manish Mandlik <mmandlik@google.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index f41bd5dfc313..0d0b958b7fe7 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3282,11 +3282,9 @@ static void hci_remote_features_evt(struct hci_dev *hdev,
+ hci_dev_unlock(hdev);
+ }
+
+-static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev,
+- u16 opcode, u8 ncmd)
++static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
+ {
+- if (opcode != HCI_OP_NOP)
+- cancel_delayed_work(&hdev->cmd_timer);
++ cancel_delayed_work(&hdev->cmd_timer);
+
+ if (!test_bit(HCI_RESET, &hdev->flags)) {
+ if (ncmd) {
+@@ -3661,7 +3659,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ break;
+ }
+
+- handle_cmd_cnt_and_timer(hdev, *opcode, ev->ncmd);
++ handle_cmd_cnt_and_timer(hdev, ev->ncmd);
+
+ hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
+ req_complete_skb);
+@@ -3762,7 +3760,7 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ break;
+ }
+
+- handle_cmd_cnt_and_timer(hdev, *opcode, ev->ncmd);
++ handle_cmd_cnt_and_timer(hdev, ev->ncmd);
+
+ /* Indicate request completion if the command failed. Also, if
+ * we're not waiting for a special event and we get a success
+--
+2.30.2
+
--- /dev/null
+From 443837c7f0e77b8ffa252af269b158bc11767c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:14:05 +0800
+Subject: Bluetooth: schedule SCO timeouts with delayed_work
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit ba316be1b6a00db7126ed9a39f9bee434a508043 ]
+
+struct sock.sk_timer should be used as a sock cleanup timer. However,
+SCO uses it to implement sock timeouts.
+
+This causes issues because struct sock.sk_timer's callback is run in
+an IRQ context, and the timer callback function sco_sock_timeout takes
+a spin lock on the socket. However, other functions such as
+sco_conn_del and sco_conn_ready take the spin lock with interrupts
+enabled.
+
+This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
+lead to deadlocks as reported by Syzbot [1]:
+ CPU0
+ ----
+ lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
+ <Interrupt>
+ lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
+
+To fix this, we use delayed work to implement SCO sock timouts
+instead. This allows us to avoid taking the spin lock on the socket in
+an IRQ context, and corrects the misuse of struct sock.sk_timer.
+
+As a note, cancel_delayed_work is used instead of
+cancel_delayed_work_sync in sco_sock_set_timer and
+sco_sock_clear_timer to avoid a deadlock. In the future, the call to
+bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
+synchronize with other functions using lock_sock. However, since
+sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
+the locked socket (in sco_connect and __sco_sock_close),
+cancel_delayed_work_sync might cause them to sleep until an
+sco_sock_timeout that has started finishes running. But
+sco_sock_timeout would also sleep until it can grab the lock_sock.
+
+Using cancel_delayed_work is fine because sco_sock_timeout does not
+change from run to run, hence there is no functional difference
+between:
+1. waiting for a timeout to finish running before scheduling another
+timeout
+2. scheduling another timeout while a timeout is running.
+
+Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
+Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
+Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 35 +++++++++++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index b5ab842c7c4a..9cf1ead1d832 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -48,6 +48,8 @@ struct sco_conn {
+ spinlock_t lock;
+ struct sock *sk;
+
++ struct delayed_work timeout_work;
++
+ unsigned int mtu;
+ };
+
+@@ -74,9 +76,20 @@ struct sco_pinfo {
+ #define SCO_CONN_TIMEOUT (HZ * 40)
+ #define SCO_DISCONN_TIMEOUT (HZ * 2)
+
+-static void sco_sock_timeout(struct timer_list *t)
++static void sco_sock_timeout(struct work_struct *work)
+ {
+- struct sock *sk = from_timer(sk, t, sk_timer);
++ struct sco_conn *conn = container_of(work, struct sco_conn,
++ timeout_work.work);
++ struct sock *sk;
++
++ sco_conn_lock(conn);
++ sk = conn->sk;
++ if (sk)
++ sock_hold(sk);
++ sco_conn_unlock(conn);
++
++ if (!sk)
++ return;
+
+ BT_DBG("sock %p state %d", sk, sk->sk_state);
+
+@@ -90,14 +103,21 @@ static void sco_sock_timeout(struct timer_list *t)
+
+ static void sco_sock_set_timer(struct sock *sk, long timeout)
+ {
++ if (!sco_pi(sk)->conn)
++ return;
++
+ BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
+- sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
++ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
++ schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
+ }
+
+ static void sco_sock_clear_timer(struct sock *sk)
+ {
++ if (!sco_pi(sk)->conn)
++ return;
++
+ BT_DBG("sock %p state %d", sk, sk->sk_state);
+- sk_stop_timer(sk, &sk->sk_timer);
++ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
+ }
+
+ /* ---- SCO connections ---- */
+@@ -177,6 +197,9 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
+ sco_chan_del(sk, err);
+ bh_unlock_sock(sk);
+ sock_put(sk);
++
++ /* Ensure no more work items will run before freeing conn. */
++ cancel_delayed_work_sync(&conn->timeout_work);
+ }
+
+ hcon->sco_data = NULL;
+@@ -191,6 +214,8 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ sco_pi(sk)->conn = conn;
+ conn->sk = sk;
+
++ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
++
+ if (parent)
+ bt_accept_enqueue(parent, sk, true);
+ }
+@@ -496,8 +521,6 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
+
+ sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
+
+- timer_setup(&sk->sk_timer, sco_sock_timeout, 0);
+-
+ bt_sock_link(&sco_sk_list, sk);
+ return sk;
+ }
+--
+2.30.2
+
--- /dev/null
+From 4b758fb0fc2a92713527b8d32c3a38c856c659d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 15:51:04 +0800
+Subject: Bluetooth: skip invalid hci_sync_conn_complete_evt
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]
+
+Syzbot reported a corrupted list in kobject_add_internal [1]. This
+happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with
+status 0 are sent for the same HCI connection. This causes us to
+register the device more than once which corrupts the kset list.
+
+As this is forbidden behavior, we add a check for whether we're
+trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple
+times for one connection. If that's the case, the event is invalid, so
+we report an error that the device is misbehaving, and ignore the
+packet.
+
+Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1]
+Reported-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
+Tested-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 1c3018202564..ea7fc09478be 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4382,6 +4382,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
+
+ switch (ev->status) {
+ case 0x00:
++ /* The synchronous connection complete event should only be
++ * sent once per new connection. Receiving a successful
++ * complete event when the connection status is already
++ * BT_CONNECTED means that the device is misbehaving and sent
++ * multiple complete event packets for the same new connection.
++ *
++ * Registering the device more than once can corrupt kernel
++ * memory, hence upon detecting this invalid event, we report
++ * an error and ignore the packet.
++ */
++ if (conn->state == BT_CONNECTED) {
++ bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
++ goto unlock;
++ }
++
+ conn->handle = __le16_to_cpu(ev->handle);
+ conn->state = BT_CONNECTED;
+ conn->type = ev->link_type;
+--
+2.30.2
+
--- /dev/null
+From 8daa4fba7eb6a7a933defc6d051d47a97fcbe3e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 10:19:11 +0800
+Subject: bonding: 3ad: fix the concurrency between __bond_release_one() and
+ bond_3ad_state_machine_handler()
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 220ade77452c15ecb1ab94c3f8aaeb6d033c3582 ]
+
+Some time ago, I reported a calltrace issue
+"did not find a suitable aggregator", please see[1].
+After a period of analysis and reproduction, I find
+that this problem is caused by concurrency.
+
+Before the problem occurs, the bond structure is like follows:
+
+bond0 - slaver0(eth0) - agg0.lag_ports -> port0 - port1
+ \
+ port0
+ \
+ slaver1(eth1) - agg1.lag_ports -> NULL
+ \
+ port1
+
+If we run 'ifenslave bond0 -d eth1', the process is like below:
+
+excuting __bond_release_one()
+|
+bond_upper_dev_unlink()[step1]
+| | |
+| | bond_3ad_lacpdu_recv()
+| | ->bond_3ad_rx_indication()
+| | spin_lock_bh()
+| | ->ad_rx_machine()
+| | ->__record_pdu()[step2]
+| | spin_unlock_bh()
+| | |
+| bond_3ad_state_machine_handler()
+| spin_lock_bh()
+| ->ad_port_selection_logic()
+| ->try to find free aggregator[step3]
+| ->try to find suitable aggregator[step4]
+| ->did not find a suitable aggregator[step5]
+| spin_unlock_bh()
+| |
+| |
+bond_3ad_unbind_slave() |
+spin_lock_bh()
+spin_unlock_bh()
+
+step1: already removed slaver1(eth1) from list, but port1 remains
+step2: receive a lacpdu and update port0
+step3: port0 will be removed from agg0.lag_ports. The struct is
+ "agg0.lag_ports -> port1" now, and agg0 is not free. At the
+ same time, slaver1/agg1 has been removed from the list by step1.
+ So we can't find a free aggregator now.
+step4: can't find suitable aggregator because of step2
+step5: cause a calltrace since port->aggregator is NULL
+
+To solve this concurrency problem, put bond_upper_dev_unlink()
+after bond_3ad_unbind_slave(). In this way, we can invalid the port
+first and skip this port in bond_3ad_state_machine_handler(). This
+eliminates the situation that the slaver has been removed from the
+list but the port is still valid.
+
+[1]https://lore.kernel.org/netdev/10374.1611947473@famine/
+
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 31730efa7538..8aef6005bfee 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2252,7 +2252,6 @@ static int __bond_release_one(struct net_device *bond_dev,
+ /* recompute stats just before removing the slave */
+ bond_get_stats(bond->dev, &bond->bond_stats);
+
+- bond_upper_dev_unlink(bond, slave);
+ /* unregister rx_handler early so bond_handle_frame wouldn't be called
+ * for this slave anymore.
+ */
+@@ -2261,6 +2260,8 @@ static int __bond_release_one(struct net_device *bond_dev,
+ if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ bond_3ad_unbind_slave(slave);
+
++ bond_upper_dev_unlink(bond, slave);
++
+ if (bond_mode_can_use_xmit_hash(bond))
+ bond_update_slave_arr(bond, slave);
+
+--
+2.30.2
+
--- /dev/null
+From 0af0fa0371eb376731a350bfdd8687e7ec206bb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 18:47:41 +0200
+Subject: bpf: Fix off-by-one in tail call count limiting
+
+From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+
+[ Upstream commit b61a28cf11d61f512172e673b8f8c4a6c789b425 ]
+
+Before, the interpreter allowed up to MAX_TAIL_CALL_CNT + 1 tail calls.
+Now precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the
+behavior of the x86 JITs.
+
+Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210728164741.350370-1-johan.almbladh@anyfinetworks.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 0a28a8095d3e..82af6279992d 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -1564,7 +1564,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
+
+ if (unlikely(index >= array->map.max_entries))
+ goto out;
+- if (unlikely(tail_call_cnt > MAX_TAIL_CALL_CNT))
++ if (unlikely(tail_call_cnt >= MAX_TAIL_CALL_CNT))
+ goto out;
+
+ tail_call_cnt++;
+--
+2.30.2
+
--- /dev/null
+From 6b97cd201421078fe381f8b363a461be6e40d3cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 12:38:22 +0200
+Subject: bpf/tests: Do not PASS tests without actually testing the result
+
+From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+
+[ Upstream commit 2b7e9f25e590726cca76700ebdb10e92a7a72ca1 ]
+
+Each test case can have a set of sub-tests, where each sub-test can
+run the cBPF/eBPF test snippet with its own data_size and expected
+result. Before, the end of the sub-test array was indicated by both
+data_size and result being zero. However, most or all of the internal
+eBPF tests has a data_size of zero already. When such a test also had
+an expected value of zero, the test was never run but reported as
+PASS anyway.
+
+Now the test runner always runs the first sub-test, regardless of the
+data_size and result values. The sub-test array zero-termination only
+applies for any additional sub-tests.
+
+There are other ways fix it of course, but this solution at least
+removes the surprise of eBPF tests with a zero result always succeeding.
+
+Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210721103822.3755111-1-johan.almbladh@anyfinetworks.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_bpf.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/lib/test_bpf.c b/lib/test_bpf.c
+index 1c5299cb3f19..f6d5d30d01bf 100644
+--- a/lib/test_bpf.c
++++ b/lib/test_bpf.c
+@@ -6659,7 +6659,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test)
+ u64 duration;
+ u32 ret;
+
+- if (test->test[i].data_size == 0 &&
++ /*
++ * NOTE: Several sub-tests may be present, in which case
++ * a zero {data_size, result} tuple indicates the end of
++ * the sub-test array. The first test is always run,
++ * even if both data_size and result happen to be zero.
++ */
++ if (i > 0 &&
++ test->test[i].data_size == 0 &&
+ test->test[i].result == 0)
+ break;
+
+--
+2.30.2
+
--- /dev/null
+From 970f2a8423efde042ec33f75f6a409ee2e240bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 12:40:58 +0200
+Subject: bpf/tests: Fix copy-and-paste error in double word test
+
+From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+
+[ Upstream commit ae7f47041d928b1a2f28717d095b4153c63cbf6a ]
+
+This test now operates on DW as stated instead of W, which was
+already covered by another test.
+
+Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210721104058.3755254-1-johan.almbladh@anyfinetworks.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_bpf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/test_bpf.c b/lib/test_bpf.c
+index d500320778c7..1c5299cb3f19 100644
+--- a/lib/test_bpf.c
++++ b/lib/test_bpf.c
+@@ -4286,8 +4286,8 @@ static struct bpf_test tests[] = {
+ .u.insns_int = {
+ BPF_LD_IMM64(R0, 0),
+ BPF_LD_IMM64(R1, 0xffffffffffffffffLL),
+- BPF_STX_MEM(BPF_W, R10, R1, -40),
+- BPF_LDX_MEM(BPF_W, R0, R10, -40),
++ BPF_STX_MEM(BPF_DW, R10, R1, -40),
++ BPF_LDX_MEM(BPF_DW, R0, R10, -40),
+ BPF_EXIT_INSN(),
+ },
+ INTERNAL,
+--
+2.30.2
+
--- /dev/null
+From 02a0a029485e7f670d7c0787d7342145d05c2414 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 16:03:40 +0100
+Subject: btrfs: remove racy and unnecessary inode transaction update when
+ using no-holes
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit cceaa89f02f15f232391ae4be214137b0a0285c0 ]
+
+When using the NO_HOLES feature and expanding the size of an inode, we
+update the inode's last_trans, last_sub_trans and last_log_commit fields
+at maybe_insert_hole() so that a fsync does know that the inode needs to
+be logged (by making sure that btrfs_inode_in_log() returns false). This
+happens for expanding truncate operations, buffered writes, direct IO
+writes and when cloning extents to an offset greater than the inode's
+i_size.
+
+However the way we do it is racy, because in between setting the inode's
+last_sub_trans and last_log_commit fields, the log transaction ID that was
+assigned to last_sub_trans might be committed before we read the root's
+last_log_commit and assign that value to last_log_commit. If that happens
+it would make a future call to btrfs_inode_in_log() return true. This is
+a race that should be extremely unlikely to be hit in practice, and it is
+the same that was described by commit bc0939fcfab0d7 ("btrfs: fix race
+between marking inode needs to be logged and log syncing").
+
+The fix would simply be to set last_log_commit to the value we assigned
+to last_sub_trans minus 1, like it was done in that commit. However
+updating these two fields plus the last_trans field is pointless here
+because all the callers of btrfs_cont_expand() (which is the only
+caller of maybe_insert_hole()) always call btrfs_set_inode_last_trans()
+or btrfs_update_inode() after calling btrfs_cont_expand(). Calling either
+btrfs_set_inode_last_trans() or btrfs_update_inode() guarantees that the
+next fsync will log the inode, as it makes btrfs_inode_in_log() return
+false.
+
+So just remove the code that explicitly sets the inode's last_trans,
+last_sub_trans and last_log_commit fields.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 4fd242acec3c..8132d503c83d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5088,15 +5088,13 @@ static int maybe_insert_hole(struct btrfs_root *root, struct btrfs_inode *inode,
+ int ret;
+
+ /*
+- * Still need to make sure the inode looks like it's been updated so
+- * that any holes get logged if we fsync.
++ * If NO_HOLES is enabled, we don't need to do anything.
++ * Later, up in the call chain, either btrfs_set_inode_last_sub_trans()
++ * or btrfs_update_inode() will be called, which guarantee that the next
++ * fsync will know this inode was changed and needs to be logged.
+ */
+- if (btrfs_fs_incompat(fs_info, NO_HOLES)) {
+- inode->last_trans = fs_info->generation;
+- inode->last_sub_trans = root->log_transid;
+- inode->last_log_commit = root->last_log_commit;
++ if (btrfs_fs_incompat(fs_info, NO_HOLES))
+ return 0;
+- }
+
+ /*
+ * 1 - for the one we're dropping
+--
+2.30.2
+
--- /dev/null
+From 2d3afdc85170ac0f586093bd9f17c6e376174ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 09:34:00 -0300
+Subject: btrfs: tree-log: check btrfs_lookup_data_extent return value
+
+From: Marcos Paulo de Souza <mpdesouza@suse.com>
+
+[ Upstream commit 3736127a3aa805602b7a2ad60ec9cfce68065fbb ]
+
+Function btrfs_lookup_data_extent calls btrfs_search_slot to verify if
+the EXTENT_ITEM exists in the extent tree. btrfs_search_slot can return
+values bellow zero if an error happened.
+
+Function replay_one_extent currently checks if the search found
+something (0 returned) and increments the reference, and if not, it
+seems to evaluate as 'not found'.
+
+Fix the condition by checking if the value was bellow zero and return
+early.
+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index e6430ac9bbe8..7037e5855d2a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -753,7 +753,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ */
+ ret = btrfs_lookup_data_extent(fs_info, ins.objectid,
+ ins.offset);
+- if (ret == 0) {
++ if (ret < 0) {
++ goto out;
++ } else if (ret == 0) {
+ btrfs_init_generic_ref(&ref,
+ BTRFS_ADD_DELAYED_REF,
+ ins.objectid, ins.offset, 0);
+--
+2.30.2
+
--- /dev/null
+From 7ec2c4bafda8ecc25bf7b5d37637f98fd2509ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 17:07:11 +0300
+Subject: bus: fsl-mc: fix arg in call to dprc_scan_objects()
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit aa0a1ae020e2d24749e9f8085f12ca6d46899c94 ]
+
+Second parameter of dprc_scan_objects() is a bool not a pointer
+so change from NULL to false.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Link: https://lore.kernel.org/r/20210715140718.8513-1-laurentiu.tudor@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
+index 09c8ab5e0959..ffec838450f3 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -220,7 +220,7 @@ static int scan_fsl_mc_bus(struct device *dev, void *data)
+ root_mc_dev = to_fsl_mc_device(dev);
+ root_mc_bus = to_fsl_mc_bus(root_mc_dev);
+ mutex_lock(&root_mc_bus->scan_mutex);
+- dprc_scan_objects(root_mc_dev, NULL);
++ dprc_scan_objects(root_mc_dev, false);
+ mutex_unlock(&root_mc_bus->scan_mutex);
+
+ exit:
+--
+2.30.2
+
--- /dev/null
+From 7f9ace974650146e03fa20f737c138fa034d3937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 17:07:18 +0300
+Subject: bus: fsl-mc: fix mmio base address for child DPRCs
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 8990f96a012f42543005b07d9e482694192e9309 ]
+
+Some versions of the MC firmware wrongly report 0 for register base
+address of the DPMCP associated with child DPRC objects thus rendering
+them unusable. This is particularly troublesome in ACPI boot scenarios
+where the legacy way of extracting this base address from the device
+tree does not apply.
+Given that DPMCPs share the same base address, workaround this by using
+the base address extracted from the root DPRC container.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Link: https://lore.kernel.org/r/20210715140718.8513-8-laurentiu.tudor@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
+index ffec838450f3..32b2b6d9bde0 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -68,6 +68,8 @@ struct fsl_mc_addr_translation_range {
+ #define MC_FAPR_PL BIT(18)
+ #define MC_FAPR_BMT BIT(17)
+
++static phys_addr_t mc_portal_base_phys_addr;
++
+ /**
+ * fsl_mc_bus_match - device to driver matching callback
+ * @dev: the fsl-mc device to match against
+@@ -703,14 +705,30 @@ static int fsl_mc_device_get_mmio_regions(struct fsl_mc_device *mc_dev,
+ * If base address is in the region_desc use it otherwise
+ * revert to old mechanism
+ */
+- if (region_desc.base_address)
++ if (region_desc.base_address) {
+ regions[i].start = region_desc.base_address +
+ region_desc.base_offset;
+- else
++ } else {
+ error = translate_mc_addr(mc_dev, mc_region_type,
+ region_desc.base_offset,
+ ®ions[i].start);
+
++ /*
++ * Some versions of the MC firmware wrongly report
++ * 0 for register base address of the DPMCP associated
++ * with child DPRC objects thus rendering them unusable.
++ * This is particularly troublesome in ACPI boot
++ * scenarios where the legacy way of extracting this
++ * base address from the device tree does not apply.
++ * Given that DPMCPs share the same base address,
++ * workaround this by using the base address extracted
++ * from the root DPRC container.
++ */
++ if (is_fsl_mc_bus_dprc(mc_dev) &&
++ regions[i].start == region_desc.base_offset)
++ regions[i].start += mc_portal_base_phys_addr;
++ }
++
+ if (error < 0) {
+ dev_err(parent_dev,
+ "Invalid MC offset: %#x (for %s.%d\'s region %d)\n",
+@@ -1126,6 +1144,8 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
+ plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ mc_portal_phys_addr = plat_res->start;
+ mc_portal_size = resource_size(plat_res);
++ mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;
++
+ error = fsl_create_mc_io(&pdev->dev, mc_portal_phys_addr,
+ mc_portal_size, NULL,
+ FSL_MC_IO_ATOMIC_CONTEXT_PORTAL, &mc_io);
+--
+2.30.2
+
--- /dev/null
+From 3f643d3b65b29516d3c41d91bcfac63a9525db4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 22:55:10 +0800
+Subject: cifs: fix wrong release in sess_alloc_buffer() failed path
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit d72c74197b70bc3c95152f351a568007bffa3e11 ]
+
+smb_buf is allocated by small_smb_init_no_tc(), and buf type is
+CIFS_SMALL_BUFFER, so we should use cifs_small_buf_release() to
+release it in failed path.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/sess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index c5785fd3f52e..606fd7d6cb71 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -877,7 +877,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct)
+ return 0;
+
+ out_free_smb_buf:
+- kfree(smb_buf);
++ cifs_small_buf_release(smb_buf);
+ sess_data->iov[0].iov_base = NULL;
+ sess_data->iov[0].iov_len = 0;
+ sess_data->buf0_type = CIFS_NO_BUFFER;
+--
+2.30.2
+
--- /dev/null
+From edff8d6be60a0f2d17030412865315f721821d8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 16:12:13 +0300
+Subject: clk: at91: clk-generated: Limit the requested rate to our range
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit af7651e67b9d5f7e63ea23b118e3672ac662244a ]
+
+On clk_generated_determine_rate(), the requested rate could be outside
+of clk's range. Limit the rate to the clock's range to not return an
+error.
+
+Fixes: df70aeef6083 ("clk: at91: add generated clock driver")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20210707131213.3283509-1-codrin.ciubotariu@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-generated.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index b4fc8d71daf2..b656d25a9767 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -128,6 +128,12 @@ static int clk_generated_determine_rate(struct clk_hw *hw,
+ int i;
+ u32 div;
+
++ /* do not look for a rate that is outside of our range */
++ if (gck->range.max && req->rate > gck->range.max)
++ req->rate = gck->range.max;
++ if (gck->range.min && req->rate < gck->range.min)
++ req->rate = gck->range.min;
++
+ for (i = 0; i < clk_hw_get_num_parents(hw); i++) {
+ if (gck->chg_pid == i)
+ continue;
+--
+2.30.2
+
--- /dev/null
+From fd2706488201b3e4c05b1b7311cd48c4a2bdab34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 17:14:33 +0200
+Subject: clk: imx8m: fix clock tree update of TF-A managed clocks
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit d36207b848a6490e14664e2197a1c8ab51d8148e ]
+
+On the i.MX8M*, the TF-A exposes a SiP (Silicon Provider) service
+for DDR frequency scaling. The imx8m-ddrc-devfreq driver calls the
+SiP and then does clk_set_parent on the DDR muxes to synchronize
+the clock tree.
+
+Since 936c383673b9 ("clk: imx: fix composite peripheral flags"),
+these TF-A managed muxes have SET_PARENT_GATE set, which results
+in imx8m-ddrc-devfreq's clk_set_parent after SiP failing with -EBUSY:
+
+ echo 25000000 > userspace/set_freq
+ imx8m-ddrc-devfreq 3d400000.memory-controller: failed to set
+ dram_apb parent: -16
+
+Fix this by adding a new i.MX composite flag for firmware managed
+clocks, which clears SET_PARENT_GATE.
+
+This is safe to do, because updating the Linux clock tree to reflect
+reality will always be glitch-free.
+
+Fixes: 936c383673b9 ("clk: imx: fix composite peripheral flags")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
+Link: https://lore.kernel.org/r/20210810151432.9228-1-a.fatoum@pengutronix.de
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-composite-8m.c | 3 ++-
+ drivers/clk/imx/clk-imx8mm.c | 7 ++++---
+ drivers/clk/imx/clk-imx8mn.c | 7 ++++---
+ drivers/clk/imx/clk-imx8mq.c | 7 ++++---
+ drivers/clk/imx/clk.h | 16 ++++++++++++++--
+ 5 files changed, 28 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c
+index 2c309e3dc8e3..04e728538cef 100644
+--- a/drivers/clk/imx/clk-composite-8m.c
++++ b/drivers/clk/imx/clk-composite-8m.c
+@@ -216,7 +216,8 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
+ div->width = PCG_PREDIV_WIDTH;
+ divider_ops = &imx8m_clk_composite_divider_ops;
+ mux_ops = &clk_mux_ops;
+- flags |= CLK_SET_PARENT_GATE;
++ if (!(composite_flags & IMX_COMPOSITE_FW_MANAGED))
++ flags |= CLK_SET_PARENT_GATE;
+ }
+
+ div->lock = &imx_ccm_lock;
+diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c
+index ce7127ccddab..e92621fa8b9c 100644
+--- a/drivers/clk/imx/clk-imx8mm.c
++++ b/drivers/clk/imx/clk-imx8mm.c
+@@ -470,10 +470,11 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)
+
+ /*
+ * DRAM clocks are manipulated from TF-A outside clock framework.
+- * Mark with GET_RATE_NOCACHE to always read div value from hardware
++ * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
++ * as div value should always be read from hardware
+ */
+- hws[IMX8MM_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mm_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
+- hws[IMX8MM_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mm_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
++ hws[IMX8MM_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mm_dram_alt_sels, base + 0xa000);
++ hws[IMX8MM_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mm_dram_apb_sels, base + 0xa080);
+
+ /* IP */
+ hws[IMX8MM_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mm_vpu_g1_sels, base + 0xa100);
+diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
+index 88f6630cd472..0a76f969b28b 100644
+--- a/drivers/clk/imx/clk-imx8mn.c
++++ b/drivers/clk/imx/clk-imx8mn.c
+@@ -453,10 +453,11 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
+
+ /*
+ * DRAM clocks are manipulated from TF-A outside clock framework.
+- * Mark with GET_RATE_NOCACHE to always read div value from hardware
++ * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
++ * as div value should always be read from hardware
+ */
+- hws[IMX8MN_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mn_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
+- hws[IMX8MN_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mn_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
++ hws[IMX8MN_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mn_dram_alt_sels, base + 0xa000);
++ hws[IMX8MN_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mn_dram_apb_sels, base + 0xa080);
+
+ hws[IMX8MN_CLK_DISP_PIXEL] = imx8m_clk_hw_composite("disp_pixel", imx8mn_disp_pixel_sels, base + 0xa500);
+ hws[IMX8MN_CLK_SAI2] = imx8m_clk_hw_composite("sai2", imx8mn_sai2_sels, base + 0xa600);
+diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
+index c491bc9c61ce..83cc2b1c3294 100644
+--- a/drivers/clk/imx/clk-imx8mq.c
++++ b/drivers/clk/imx/clk-imx8mq.c
+@@ -449,11 +449,12 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+
+ /*
+ * DRAM clocks are manipulated from TF-A outside clock framework.
+- * Mark with GET_RATE_NOCACHE to always read div value from hardware
++ * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
++ * as div value should always be read from hardware
+ */
+ hws[IMX8MQ_CLK_DRAM_CORE] = imx_clk_hw_mux2_flags("dram_core_clk", base + 0x9800, 24, 1, imx8mq_dram_core_sels, ARRAY_SIZE(imx8mq_dram_core_sels), CLK_IS_CRITICAL);
+- hws[IMX8MQ_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mq_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
+- hws[IMX8MQ_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mq_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
++ hws[IMX8MQ_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mq_dram_alt_sels, base + 0xa000);
++ hws[IMX8MQ_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mq_dram_apb_sels, base + 0xa080);
+
+ /* IP */
+ hws[IMX8MQ_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mq_vpu_g1_sels, base + 0xa100);
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index 7571603bee23..e144f983fd8c 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -530,8 +530,9 @@ struct clk_hw *imx_clk_hw_cpu(const char *name, const char *parent_name,
+ struct clk *div, struct clk *mux, struct clk *pll,
+ struct clk *step);
+
+-#define IMX_COMPOSITE_CORE BIT(0)
+-#define IMX_COMPOSITE_BUS BIT(1)
++#define IMX_COMPOSITE_CORE BIT(0)
++#define IMX_COMPOSITE_BUS BIT(1)
++#define IMX_COMPOSITE_FW_MANAGED BIT(2)
+
+ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
+ const char * const *parent_names,
+@@ -567,6 +568,17 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
+ ARRAY_SIZE(parent_names), reg, 0, \
+ flags | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE)
+
++#define __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, flags) \
++ imx8m_clk_hw_composite_flags(name, parent_names, \
++ ARRAY_SIZE(parent_names), reg, IMX_COMPOSITE_FW_MANAGED, \
++ flags | CLK_GET_RATE_NOCACHE | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE)
++
++#define imx8m_clk_hw_fw_managed_composite(name, parent_names, reg) \
++ __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, 0)
++
++#define imx8m_clk_hw_fw_managed_composite_critical(name, parent_names, reg) \
++ __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, CLK_IS_CRITICAL)
++
+ #define __imx8m_clk_composite(name, parent_names, reg, flags) \
+ to_clk(__imx8m_clk_hw_composite(name, parent_names, reg, flags))
+
+--
+2.30.2
+
--- /dev/null
+From 19e3c2e581411a0b99b790333226cf10a97b509a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 23:15:53 +0200
+Subject: clk: imx8mm: use correct mux type for clkout path
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 1822b4dedc4d8cab96fd1d87bf8ff98194e29d9b ]
+
+The mux in the clkout path needs the current selected parent to
+be enabled for the switch to work. Use the correct mux type
+to have the clk framework take care of this requirement.
+
+Fixes: c1ae5c6f789a ("clk: imx8mm: add clkout1/2 support")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
+Link: https://lore.kernel.org/r/20210628211554.2510238-1-l.stach@pengutronix.de
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c
+index f1919fafb124..ce7127ccddab 100644
+--- a/drivers/clk/imx/clk-imx8mm.c
++++ b/drivers/clk/imx/clk-imx8mm.c
+@@ -407,10 +407,10 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)
+ hws[IMX8MM_SYS_PLL2_500M] = imx_clk_hw_fixed_factor("sys_pll2_500m", "sys_pll2_500m_cg", 1, 2);
+ hws[IMX8MM_SYS_PLL2_1000M] = imx_clk_hw_fixed_factor("sys_pll2_1000m", "sys_pll2_out", 1, 1);
+
+- hws[IMX8MM_CLK_CLKOUT1_SEL] = imx_clk_hw_mux("clkout1_sel", base + 0x128, 4, 4, clkout_sels, ARRAY_SIZE(clkout_sels));
++ hws[IMX8MM_CLK_CLKOUT1_SEL] = imx_clk_hw_mux2("clkout1_sel", base + 0x128, 4, 4, clkout_sels, ARRAY_SIZE(clkout_sels));
+ hws[IMX8MM_CLK_CLKOUT1_DIV] = imx_clk_hw_divider("clkout1_div", "clkout1_sel", base + 0x128, 0, 4);
+ hws[IMX8MM_CLK_CLKOUT1] = imx_clk_hw_gate("clkout1", "clkout1_div", base + 0x128, 8);
+- hws[IMX8MM_CLK_CLKOUT2_SEL] = imx_clk_hw_mux("clkout2_sel", base + 0x128, 20, 4, clkout_sels, ARRAY_SIZE(clkout_sels));
++ hws[IMX8MM_CLK_CLKOUT2_SEL] = imx_clk_hw_mux2("clkout2_sel", base + 0x128, 20, 4, clkout_sels, ARRAY_SIZE(clkout_sels));
+ hws[IMX8MM_CLK_CLKOUT2_DIV] = imx_clk_hw_divider("clkout2_div", "clkout2_sel", base + 0x128, 16, 4);
+ hws[IMX8MM_CLK_CLKOUT2] = imx_clk_hw_gate("clkout2", "clkout2_div", base + 0x128, 24);
+
+--
+2.30.2
+
--- /dev/null
+From 154504b126fa204b4688b68d9527985b9ff1b091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 07:55:37 +0200
+Subject: clk: ralink: avoid to set 'CLK_IS_CRITICAL' flag for gates
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit c16edf5ff8ece9c4135175da4103cee1bec360be ]
+
+'clk_init_data' for gates is setting up 'CLK_IS_CRITICAL'
+flag for all of them. This was being doing because some
+drivers of this SoC might not be ready to use the clock
+and we don't wanted the kernel to disable them since default
+behaviour without clock driver was to set all gate bits to
+enabled state. After a bit more testing and checking driver
+code it is safe to remove this flag and just let the kernel
+to disable those gates that are not in use. No regressions
+seems to appear.
+
+Fixes: 48df7a26f470 ("clk: ralink: add clock driver for mt7621 SoC")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20210727055537.11785-1-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ralink/clk-mt7621.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/clk/ralink/clk-mt7621.c b/drivers/clk/ralink/clk-mt7621.c
+index 857da1e274be..a2c045390f00 100644
+--- a/drivers/clk/ralink/clk-mt7621.c
++++ b/drivers/clk/ralink/clk-mt7621.c
+@@ -131,14 +131,7 @@ static int mt7621_gate_ops_init(struct device *dev,
+ struct mt7621_gate *sclk)
+ {
+ struct clk_init_data init = {
+- /*
+- * Until now no clock driver existed so
+- * these SoC drivers are not prepared
+- * yet for the clock. We don't want kernel to
+- * disable anything so we add CLK_IS_CRITICAL
+- * flag here.
+- */
+- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++ .flags = CLK_SET_RATE_PARENT,
+ .num_parents = 1,
+ .parent_names = &sclk->parent_name,
+ .ops = &mt7621_gate_ops,
+--
+2.30.2
+
--- /dev/null
+From fe02a0cd3534705efff9288f3c92028e979faf98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 16:54:32 +0100
+Subject: clk: renesas: rzg2l: Fix off-by-one check in
+ rzg2l_cpg_clk_src_twocell_get()
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 1606e81543f80fc3b1912957cf6d8fa62e40b8e5 ]
+
+Fix clock index out of range check for module clocks in
+rzg2l_cpg_clk_src_twocell_get().
+
+Fixes: ef3c613ccd68 ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20210617155432.18827-1-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/renesas-rzg2l-cpg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/renesas-rzg2l-cpg.c b/drivers/clk/renesas/renesas-rzg2l-cpg.c
+index e7c59af2a1d8..f894a210de90 100644
+--- a/drivers/clk/renesas/renesas-rzg2l-cpg.c
++++ b/drivers/clk/renesas/renesas-rzg2l-cpg.c
+@@ -229,7 +229,7 @@ static struct clk
+
+ case CPG_MOD:
+ type = "module";
+- if (clkidx > priv->num_mod_clks) {
++ if (clkidx >= priv->num_mod_clks) {
+ dev_err(dev, "Invalid %s clock index %u\n", type,
+ clkidx);
+ return ERR_PTR(-EINVAL);
+--
+2.30.2
+
--- /dev/null
+From 350ba1edacb7ab15de260f5cbb4a32f8fdc3a58a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 14:00:28 -0400
+Subject: clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types
+
+From: Peter Geis <pgwipeout@gmail.com>
+
+[ Upstream commit 6fffe52fb336ec2063270a7305652a93ea677ca1 ]
+
+The rk3036/rk3328 pll types were converted to checking the lock status
+via the internal register in january 2020, so don't need the grf
+reference since then.
+
+But it was forgotten to remove grf check when deciding between the
+pll rate ops (read-only vs. read-write), so a clock driver without
+the needed grf reference might've been put into the read-only mode
+just because the grf reference was missing.
+
+This affected the rk356x that needs to reclock certain plls at boot.
+
+Fix this by removing the check for the grf for selecting the utilized
+operations.
+
+Suggested-by: Heiko Stuebner <heiko@sntech.de>
+Fixes: 7f6ffbb885d1 ("clk: rockchip: convert rk3036 pll type to use internal lock status")
+Signed-off-by: Peter Geis <pgwipeout@gmail.com>
+[adjusted the commit message, adjusted the fixes tag]
+Link: https://lore.kernel.org/r/20210728180034.717953-3-pgwipeout@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c
+index fe937bcdb487..f7827b3b7fc1 100644
+--- a/drivers/clk/rockchip/clk-pll.c
++++ b/drivers/clk/rockchip/clk-pll.c
+@@ -940,7 +940,7 @@ struct clk *rockchip_clk_register_pll(struct rockchip_clk_provider *ctx,
+ switch (pll_type) {
+ case pll_rk3036:
+ case pll_rk3328:
+- if (!pll->rate_table || IS_ERR(ctx->grf))
++ if (!pll->rate_table)
+ init.ops = &rockchip_rk3036_pll_clk_norate_ops;
+ else
+ init.ops = &rockchip_rk3036_pll_clk_ops;
+--
+2.30.2
+
--- /dev/null
+From 3d469e61c7bf03d2915e182caec9566d1fb6f3f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 12:03:18 +0530
+Subject: cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
+
+From: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+
+[ Upstream commit 50741b70b0cbbafbd9199f5180e66c0c53783a4a ]
+
+Commit d947fb4c965c ("cpuidle: pseries: Fixup exit latency for
+CEDE(0)") sets the exit latency of CEDE(0) based on the latency values
+of the Extended CEDE states advertised by the platform
+
+On POWER9 LPARs, the firmwares advertise a very low value of 2us for
+CEDE1 exit latency on a Dedicated LPAR. The latency advertized by the
+PHYP hypervisor corresponds to the latency required to wakeup from the
+underlying hardware idle state. However the wakeup latency from the
+LPAR perspective should include
+
+1. The time taken to transition the CPU from the Hypervisor into the
+ LPAR post wakeup from platform idle state
+
+2. Time taken to send the IPI from the source CPU (waker) to the idle
+ target CPU (wakee).
+
+1. can be measured via timer idle test, where we queue a timer, say
+for 1ms, and enter the CEDE state. When the timer fires, in the timer
+handler we compute how much extra timer over the expected 1ms have we
+consumed. On a a POWER9 LPAR the numbers are
+
+CEDE latency measured using a timer (numbers in ns)
+N Min Median Avg 90%ile 99%ile Max Stddev
+400 2601 5677 5668.74 5917 6413 9299 455.01
+
+1. and 2. combined can be determined by an IPI latency test where we
+send an IPI to an idle CPU and in the handler compute the time
+difference between when the IPI was sent and when the handler ran. We
+see the following numbers on POWER9 LPAR.
+
+CEDE latency measured using an IPI (numbers in ns)
+N Min Median Avg 90%ile 99%ile Max Stddev
+400 711 7564 7369.43 8559 9514 9698 1200.01
+
+Suppose, we consider the 99th percentile latency value measured using
+the IPI to be the wakeup latency, the value would be 9.5us This is in
+the ballpark of the default value of 10us.
+
+Hence, use the exit latency of CEDE(0) based on the latency values
+advertized by platform only from POWER10 onwards. The values
+advertized on POWER10 platforms is more realistic and informed by the
+latency measurements. For earlier platforms stick to the default value
+of 10us. The fix was suggested by Michael Ellerman.
+
+Fixes: d947fb4c965c ("cpuidle: pseries: Fixup exit latency for CEDE(0)")
+Reported-by: Enrico Joedecke <joedecke@de.ibm.com>
+Signed-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1626676399-15975-2-git-send-email-ego@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-pseries.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
+index a2b5c6f60cf0..e592280d8acf 100644
+--- a/drivers/cpuidle/cpuidle-pseries.c
++++ b/drivers/cpuidle/cpuidle-pseries.c
+@@ -419,7 +419,21 @@ static int pseries_idle_probe(void)
+ cpuidle_state_table = shared_states;
+ max_idle_state = ARRAY_SIZE(shared_states);
+ } else {
+- fixup_cede0_latency();
++ /*
++ * Use firmware provided latency values
++ * starting with POWER10 platforms. In the
++ * case that we are running on a POWER10
++ * platform but in an earlier compat mode, we
++ * can still use the firmware provided values.
++ *
++ * However, on platforms prior to POWER10, we
++ * cannot rely on the accuracy of the firmware
++ * provided latency values. On such platforms,
++ * go with the conservative default estimate
++ * of 10us.
++ */
++ if (cpu_has_feature(CPU_FTR_ARCH_31) || pvr_version_is(PVR_POWER10))
++ fixup_cede0_latency();
+ cpuidle_state_table = dedicated_states;
+ max_idle_state = NR_DEDICATED_STATES;
+ }
+--
+2.30.2
+
--- /dev/null
+From a6876a618a5b2590232e6d7918e7903a600a125b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 14:15:47 -0700
+Subject: cpuidle: pseries: Mark pseries_idle_proble() as __init
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit d04691d373e75c83424b85c0e68e4a3f9370c10d ]
+
+After commit 7cbd631d4dec ("cpuidle: pseries: Fixup CEDE0 latency only
+for POWER10 onwards"), pseries_idle_probe() is no longer inlined when
+compiling with clang, which causes a modpost warning:
+
+WARNING: modpost: vmlinux.o(.text+0xc86a54): Section mismatch in
+reference from the function pseries_idle_probe() to the function
+.init.text:fixup_cede0_latency()
+The function pseries_idle_probe() references
+the function __init fixup_cede0_latency().
+This is often because pseries_idle_probe lacks a __init
+annotation or the annotation of fixup_cede0_latency is wrong.
+
+pseries_idle_probe() is a non-init function, which calls
+fixup_cede0_latency(), which is an init function, explaining the
+mismatch. pseries_idle_probe() is only called from
+pseries_processor_idle_init(), which is an init function, so mark
+pseries_idle_probe() as __init so there is no more warning.
+
+Fixes: 054e44ba99ae ("cpuidle: pseries: Add function to parse extended CEDE records")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210803211547.1093820-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-pseries.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
+index e592280d8acf..ff164dec8422 100644
+--- a/drivers/cpuidle/cpuidle-pseries.c
++++ b/drivers/cpuidle/cpuidle-pseries.c
+@@ -402,7 +402,7 @@ static void __init fixup_cede0_latency(void)
+ * pseries_idle_probe()
+ * Choose state table for shared versus dedicated partition
+ */
+-static int pseries_idle_probe(void)
++static int __init pseries_idle_probe(void)
+ {
+
+ if (cpuidle_disable != IDLE_NO_OVERRIDE)
+--
+2.30.2
+
--- /dev/null
+From 83e9944ba8cd19ed12a9280f489aebb1cc6e1d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 14:56:38 -0400
+Subject: crypto: mxs-dcp - Use sg_mapping_iter to copy data
+
+From: Sean Anderson <sean.anderson@seco.com>
+
+[ Upstream commit 2e6d793e1bf07fe5e20cfbbdcec9e1af7e5097eb ]
+
+This uses the sg_pcopy_from_buffer to copy data, instead of doing it
+ourselves.
+
+In addition to reducing code size, this fixes the following oops
+resulting from failing to kmap the page:
+
+[ 68.896381] Unable to handle kernel NULL pointer dereference at virtual address 00000ab8
+[ 68.904539] pgd = 3561adb3
+[ 68.907475] [00000ab8] *pgd=00000000
+[ 68.911153] Internal error: Oops: 805 [#1] ARM
+[ 68.915618] Modules linked in: cfg80211 rfkill des_generic libdes arc4 libarc4 cbc ecb algif_skcipher sha256_generic libsha256 sha1_generic hmac aes_generic libaes cmac sha512_generic md5 md4 algif_hash af_alg i2c_imx i2c_core ci_hdrc_imx ci_hdrc mxs_dcp ulpi roles udc_core imx_sdma usbmisc_imx usb_common firmware_class virt_dma phy_mxs_usb nf_tables nfnetlink ip_tables x_tables ipv6 autofs4
+[ 68.950741] CPU: 0 PID: 139 Comm: mxs_dcp_chan/ae Not tainted 5.10.34 #296
+[ 68.958501] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
+[ 68.964710] PC is at memcpy+0xa8/0x330
+[ 68.968479] LR is at 0xd7b2bc9d
+[ 68.971638] pc : [<c053e7c8>] lr : [<d7b2bc9d>] psr: 000f0013
+[ 68.977920] sp : c2cbbee4 ip : 00000010 fp : 00000010
+[ 68.983159] r10: 00000000 r9 : c3283a40 r8 : 1a5a6f08
+[ 68.988402] r7 : 4bfe0ecc r6 : 76d8a220 r5 : c32f9050 r4 : 00000001
+[ 68.994945] r3 : 00000ab8 r2 : fffffff0 r1 : c32f9050 r0 : 00000ab8
+[ 69.001492] Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+[ 69.008646] Control: 10c53c7d Table: 83664059 DAC: 00000051
+[ 69.014414] Process mxs_dcp_chan/ae (pid: 139, stack limit = 0x667b57ab)
+[ 69.021133] Stack: (0xc2cbbee4 to 0xc2cbc000)
+[ 69.025519] bee0: c32f9050 c3235408 00000010 00000010 00000ab8 00000001 bf10406c
+[ 69.033720] bf00: 00000000 00000000 00000010 00000000 c32355d0 832fb080 00000000 c13de2fc
+[ 69.041921] bf20: c3628010 00000010 c33d5780 00000ab8 bf1067e8 00000002 c21e5010 c2cba000
+[ 69.050125] bf40: c32f8040 00000000 bf106a40 c32f9040 c3283a80 00000001 bf105240 c3234040
+[ 69.058327] bf60: ffffe000 c3204100 c2c69800 c2cba000 00000000 bf103b84 00000000 c2eddc54
+[ 69.066530] bf80: c3204144 c0140d1c c2cba000 c2c69800 c0140be8 00000000 00000000 00000000
+[ 69.074730] bfa0: 00000000 00000000 00000000 c0100114 00000000 00000000 00000000 00000000
+[ 69.082932] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 69.091131] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
+[ 69.099364] [<c053e7c8>] (memcpy) from [<bf10406c>] (dcp_chan_thread_aes+0x4e8/0x840 [mxs_dcp])
+[ 69.108117] [<bf10406c>] (dcp_chan_thread_aes [mxs_dcp]) from [<c0140d1c>] (kthread+0x134/0x160)
+[ 69.116941] [<c0140d1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
+[ 69.124178] Exception stack(0xc2cbbfb0 to 0xc2cbbff8)
+[ 69.129250] bfa0: 00000000 00000000 00000000 00000000
+[ 69.137450] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 69.145648] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+[ 69.152289] Code: e320f000 e4803004 e4804004 e4805004 (e4806004)
+
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 36 +++++++++---------------------------
+ 1 file changed, 9 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index f397cc5bf102..d19e5ffb5104 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -300,21 +300,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+
+ struct scatterlist *dst = req->dst;
+ struct scatterlist *src = req->src;
+- const int nents = sg_nents(req->src);
++ int dst_nents = sg_nents(dst);
+
+ const int out_off = DCP_BUF_SZ;
+ uint8_t *in_buf = sdcp->coh->aes_in_buf;
+ uint8_t *out_buf = sdcp->coh->aes_out_buf;
+
+- uint8_t *out_tmp, *src_buf, *dst_buf = NULL;
+ uint32_t dst_off = 0;
++ uint8_t *src_buf = NULL;
+ uint32_t last_out_len = 0;
+
+ uint8_t *key = sdcp->coh->aes_key;
+
+ int ret = 0;
+- int split = 0;
+- unsigned int i, len, clen, rem = 0, tlen = 0;
++ unsigned int i, len, clen, tlen = 0;
+ int init = 0;
+ bool limit_hit = false;
+
+@@ -332,7 +331,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
+ }
+
+- for_each_sg(req->src, src, nents, i) {
++ for_each_sg(req->src, src, sg_nents(src), i) {
+ src_buf = sg_virt(src);
+ len = sg_dma_len(src);
+ tlen += len;
+@@ -357,34 +356,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ * submit the buffer.
+ */
+ if (actx->fill == out_off || sg_is_last(src) ||
+- limit_hit) {
++ limit_hit) {
+ ret = mxs_dcp_run_aes(actx, req, init);
+ if (ret)
+ return ret;
+ init = 0;
+
+- out_tmp = out_buf;
++ sg_pcopy_from_buffer(dst, dst_nents, out_buf,
++ actx->fill, dst_off);
++ dst_off += actx->fill;
+ last_out_len = actx->fill;
+- while (dst && actx->fill) {
+- if (!split) {
+- dst_buf = sg_virt(dst);
+- dst_off = 0;
+- }
+- rem = min(sg_dma_len(dst) - dst_off,
+- actx->fill);
+-
+- memcpy(dst_buf + dst_off, out_tmp, rem);
+- out_tmp += rem;
+- dst_off += rem;
+- actx->fill -= rem;
+-
+- if (dst_off == sg_dma_len(dst)) {
+- dst = sg_next(dst);
+- split = 0;
+- } else {
+- split = 1;
+- }
+- }
++ actx->fill = 0;
+ }
+ } while (len);
+
+--
+2.30.2
+
--- /dev/null
+From 34ad785c515f5ae5a3421dad3418d354129117e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jun 2021 11:46:33 +0200
+Subject: dma-buf: fix dma_resv_test_signaled test_all handling v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 9d38814d1e346ea37a51cbf31f4424c9d059459e ]
+
+As the name implies if testing all fences is requested we
+should indeed test all fences and not skip the exclusive
+one because we see shared ones.
+
+v2: fix logic once more
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210702111642.17259-3-christian.koenig@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-resv.c | 33 ++++++++++++---------------------
+ 1 file changed, 12 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
+index f26c71747d43..e744fd87c63c 100644
+--- a/drivers/dma-buf/dma-resv.c
++++ b/drivers/dma-buf/dma-resv.c
+@@ -615,25 +615,21 @@ static inline int dma_resv_test_signaled_single(struct dma_fence *passed_fence)
+ */
+ bool dma_resv_test_signaled(struct dma_resv *obj, bool test_all)
+ {
+- unsigned int seq, shared_count;
++ struct dma_fence *fence;
++ unsigned int seq;
+ int ret;
+
+ rcu_read_lock();
+ retry:
+ ret = true;
+- shared_count = 0;
+ seq = read_seqcount_begin(&obj->seq);
+
+ if (test_all) {
+ struct dma_resv_list *fobj = dma_resv_shared_list(obj);
+- unsigned int i;
+-
+- if (fobj)
+- shared_count = fobj->shared_count;
++ unsigned int i, shared_count;
+
++ shared_count = fobj ? fobj->shared_count : 0;
+ for (i = 0; i < shared_count; ++i) {
+- struct dma_fence *fence;
+-
+ fence = rcu_dereference(fobj->shared[i]);
+ ret = dma_resv_test_signaled_single(fence);
+ if (ret < 0)
+@@ -641,24 +637,19 @@ bool dma_resv_test_signaled(struct dma_resv *obj, bool test_all)
+ else if (!ret)
+ break;
+ }
+-
+- if (read_seqcount_retry(&obj->seq, seq))
+- goto retry;
+ }
+
+- if (!shared_count) {
+- struct dma_fence *fence_excl = dma_resv_excl_fence(obj);
+-
+- if (fence_excl) {
+- ret = dma_resv_test_signaled_single(fence_excl);
+- if (ret < 0)
+- goto retry;
++ fence = dma_resv_excl_fence(obj);
++ if (ret && fence) {
++ ret = dma_resv_test_signaled_single(fence);
++ if (ret < 0)
++ goto retry;
+
+- if (read_seqcount_retry(&obj->seq, seq))
+- goto retry;
+- }
+ }
+
++ if (read_seqcount_retry(&obj->seq, seq))
++ goto retry;
++
+ rcu_read_unlock();
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 826ec19ab2546daa3ca9d3f2b66663659a406c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 16:10:55 +0200
+Subject: dma-debug: fix debugfs initialization order
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 173735c346c412d9f084825ecb04f24ada0e2986 ]
+
+Due to link order, dma_debug_init is called before debugfs has a chance
+to initialize (via debugfs_init which also happens in the core initcall
+stage), so the directories for dma-debug are never created.
+
+Decouple dma_debug_fs_init from dma_debug_init and defer its init until
+core_initcall_sync (after debugfs has been initialized) while letting
+dma-debug initialization occur as soon as possible to catch any early
+mappings, as suggested in [1].
+
+[1] https://lore.kernel.org/linux-iommu/YIgGa6yF%2Fadg8OSN@kroah.com/
+
+Fixes: 15b28bbcd567 ("dma-debug: move initialization to common code")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index dadae6255d05..f2faa13534e5 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -792,7 +792,7 @@ static int dump_show(struct seq_file *seq, void *v)
+ }
+ DEFINE_SHOW_ATTRIBUTE(dump);
+
+-static void dma_debug_fs_init(void)
++static int __init dma_debug_fs_init(void)
+ {
+ struct dentry *dentry = debugfs_create_dir("dma-api", NULL);
+
+@@ -805,7 +805,10 @@ static void dma_debug_fs_init(void)
+ debugfs_create_u32("nr_total_entries", 0444, dentry, &nr_total_entries);
+ debugfs_create_file("driver_filter", 0644, dentry, NULL, &filter_fops);
+ debugfs_create_file("dump", 0444, dentry, NULL, &dump_fops);
++
++ return 0;
+ }
++core_initcall_sync(dma_debug_fs_init);
+
+ static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
+ {
+@@ -890,8 +893,6 @@ static int dma_debug_init(void)
+ spin_lock_init(&dma_entry_hash[i].lock);
+ }
+
+- dma_debug_fs_init();
+-
+ nr_pages = DIV_ROUND_UP(nr_prealloc_entries, DMA_DEBUG_DYNAMIC_ENTRIES);
+ for (i = 0; i < nr_pages; ++i)
+ dma_debug_create_entries(GFP_KERNEL);
+--
+2.30.2
+
--- /dev/null
+From 306956a369d1ce29e8930d1633451ae74798ce4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 16:04:12 +0300
+Subject: docs: Fix infiniband uverbs minor number
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 8d7e415d55610d503fdb8815344846b72d194a40 ]
+
+Starting from the beginning of infiniband subsystem, the uverbs char
+devices start from 192 as a minor number, see
+commit bc38a6abdd5a ("[PATCH] IB uverbs: core implementation").
+
+This patch updates the admin guide documentation to reflect it.
+
+Fixes: 9d85025b0418 ("docs-rst: create an user's manual book")
+Link: https://lore.kernel.org/r/bad03e6bcde45550c01e12908a6fe7dfa4770703.1627477347.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/devices.txt | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/admin-guide/devices.txt b/Documentation/admin-guide/devices.txt
+index 9c2be821c225..922c23bb4372 100644
+--- a/Documentation/admin-guide/devices.txt
++++ b/Documentation/admin-guide/devices.txt
+@@ -2993,10 +2993,10 @@
+ 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device
+ ...
+ 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device
+- 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device
+- 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device
++ 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device
++ 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device
+ ...
+- 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device
++ 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device
+
+ 232 char Biometric Devices
+ 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device
+--
+2.30.2
+
--- /dev/null
+From 0333a9c264ea6e79d6eaf816d817ea36cc015185 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 19:57:40 +0300
+Subject: dpaa2-switch: do not enable the DPSW at probe time
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 042ad90ca7ce70f35dc5efd5b2043d2f8aceb12a ]
+
+We should not enable the switch interfaces at probe time since this is
+trigged by the open callback. Remove the call dpsw_enable() which does
+exactly this.
+
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+index 98cc0133c343..5ad5419e8be3 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -3231,12 +3231,6 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev)
+ ðsw->fq[i].napi, dpaa2_switch_poll,
+ NAPI_POLL_WEIGHT);
+
+- err = dpsw_enable(ethsw->mc_io, 0, ethsw->dpsw_handle);
+- if (err) {
+- dev_err(ethsw->dev, "dpsw_enable err %d\n", err);
+- goto err_free_netdev;
+- }
+-
+ /* Setup IRQs */
+ err = dpaa2_switch_setup_irqs(sw_dev);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From da616fedca3f3ff7f9c864f269cd6313263ed289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 11:00:44 -0400
+Subject: drm/amd/amdgpu: Update debugfs link_settings output link_rate field
+ in hex
+
+From: Anson Jacob <Anson.Jacob@amd.com>
+
+[ Upstream commit 1a394b3c3de2577f200cb623c52a5c2b82805cec ]
+
+link_rate is updated via debugfs using hex values, set it to output
+in hex as well.
+
+eg: Resolution: 1920x1080@144Hz
+cat /sys/kernel/debug/dri/0/DP-1/link_settings
+Current: 4 0x14 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 0 0x0 0
+
+echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings
+
+cat /sys/kernel/debug/dri/0/DP-1/link_settings
+Current: 4 0x1e 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 4 0x1e 0
+
+Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+index f1145086a468..1d15a9af9956 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -197,29 +197,29 @@ static ssize_t dp_link_settings_read(struct file *f, char __user *buf,
+
+ rd_buf_ptr = rd_buf;
+
+- str_len = strlen("Current: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Current: %d %d %d ",
++ str_len = strlen("Current: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Current: %d 0x%x %d ",
+ link->cur_link_settings.lane_count,
+ link->cur_link_settings.link_rate,
+ link->cur_link_settings.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Verified: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Verified: %d %d %d ",
++ str_len = strlen("Verified: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Verified: %d 0x%x %d ",
+ link->verified_link_cap.lane_count,
+ link->verified_link_cap.link_rate,
+ link->verified_link_cap.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Reported: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Reported: %d %d %d ",
++ str_len = strlen("Reported: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Reported: %d 0x%x %d ",
+ link->reported_link_cap.lane_count,
+ link->reported_link_cap.link_rate,
+ link->reported_link_cap.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Preferred: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Preferred: %d %d %d\n",
++ str_len = strlen("Preferred: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Preferred: %d 0x%x %d\n",
+ link->preferred_link_setting.lane_count,
+ link->preferred_link_setting.link_rate,
+ link->preferred_link_setting.link_spread);
+--
+2.30.2
+
--- /dev/null
+From aa3ff5a9a298b001bd42159af5b40e2242573c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 19:00:22 -0400
+Subject: drm/amd/display: fix incorrect CM/TF programming sequence in dwb
+
+From: Roy Chan <roy.chan@amd.com>
+
+[ Upstream commit 781e1e23131cce56fb557e6ec2260480a6bd08cc ]
+
+[How]
+the programming sequeune was for old asic.
+the correct programming sequeunce should be similar to the one
+used in mpc. the fix is copied from the mpc programming sequeunce.
+
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Roy Chan <roy.chan@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dcn30/dcn30_dwb_cm.c | 90 +++++++++++++------
+ 1 file changed, 64 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+index 3fe9e41e4dbd..6a3d3a0ec0a3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+@@ -49,6 +49,11 @@
+ static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
+ struct dcn3_xfer_func_reg *reg)
+ {
++ reg->shifts.field_region_start_base = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
++ reg->masks.field_region_start_base = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
++ reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
++ reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
++
+ reg->shifts.exp_region0_lut_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
+ reg->masks.exp_region0_lut_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
+ reg->shifts.exp_region0_num_segments = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS;
+@@ -66,8 +71,6 @@ static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
+ reg->masks.field_region_end_base = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_END_BASE_B;
+ reg->shifts.field_region_linear_slope = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
+ reg->masks.field_region_linear_slope = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
+- reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
+- reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
+ reg->shifts.exp_region_start = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_B;
+ reg->masks.exp_region_start = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_B;
+ reg->shifts.exp_resion_start_segment = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SEGMENT_B;
+@@ -147,18 +150,19 @@ static enum dc_lut_mode dwb3_get_ogam_current(
+ uint32_t state_mode;
+ uint32_t ram_select;
+
+- REG_GET(DWB_OGAM_CONTROL,
+- DWB_OGAM_MODE, &state_mode);
+- REG_GET(DWB_OGAM_CONTROL,
+- DWB_OGAM_SELECT, &ram_select);
++ REG_GET_2(DWB_OGAM_CONTROL,
++ DWB_OGAM_MODE_CURRENT, &state_mode,
++ DWB_OGAM_SELECT_CURRENT, &ram_select);
+
+ if (state_mode == 0) {
+ mode = LUT_BYPASS;
+ } else if (state_mode == 2) {
+ if (ram_select == 0)
+ mode = LUT_RAM_A;
+- else
++ else if (ram_select == 1)
+ mode = LUT_RAM_B;
++ else
++ mode = LUT_BYPASS;
+ } else {
+ // Reserved value
+ mode = LUT_BYPASS;
+@@ -172,10 +176,10 @@ static void dwb3_configure_ogam_lut(
+ struct dcn30_dwbc *dwbc30,
+ bool is_ram_a)
+ {
+- REG_UPDATE(DWB_OGAM_LUT_CONTROL,
+- DWB_OGAM_LUT_READ_COLOR_SEL, 7);
+- REG_UPDATE(DWB_OGAM_CONTROL,
+- DWB_OGAM_SELECT, is_ram_a == true ? 0 : 1);
++ REG_UPDATE_2(DWB_OGAM_LUT_CONTROL,
++ DWB_OGAM_LUT_WRITE_COLOR_MASK, 7,
++ DWB_OGAM_LUT_HOST_SEL, (is_ram_a == true) ? 0 : 1);
++
+ REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
+ }
+
+@@ -185,17 +189,45 @@ static void dwb3_program_ogam_pwl(struct dcn30_dwbc *dwbc30,
+ {
+ uint32_t i;
+
+- // triple base implementation
+- for (i = 0; i < num/2; i++) {
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].red_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].green_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].blue_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].red_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].green_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].blue_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].red_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].green_reg);
+- REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].blue_reg);
++ uint32_t last_base_value_red = rgb[num-1].red_reg + rgb[num-1].delta_red_reg;
++ uint32_t last_base_value_green = rgb[num-1].green_reg + rgb[num-1].delta_green_reg;
++ uint32_t last_base_value_blue = rgb[num-1].blue_reg + rgb[num-1].delta_blue_reg;
++
++ if (is_rgb_equal(rgb, num)) {
++ for (i = 0 ; i < num; i++)
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].red_reg);
++
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_red);
++
++ } else {
++
++ REG_UPDATE(DWB_OGAM_LUT_CONTROL,
++ DWB_OGAM_LUT_WRITE_COLOR_MASK, 4);
++
++ for (i = 0 ; i < num; i++)
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].red_reg);
++
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_red);
++
++ REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
++
++ REG_UPDATE(DWB_OGAM_LUT_CONTROL,
++ DWB_OGAM_LUT_WRITE_COLOR_MASK, 2);
++
++ for (i = 0 ; i < num; i++)
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].green_reg);
++
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_green);
++
++ REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
++
++ REG_UPDATE(DWB_OGAM_LUT_CONTROL,
++ DWB_OGAM_LUT_WRITE_COLOR_MASK, 1);
++
++ for (i = 0 ; i < num; i++)
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].blue_reg);
++
++ REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_blue);
+ }
+ }
+
+@@ -211,6 +243,8 @@ static bool dwb3_program_ogam_lut(
+ return false;
+ }
+
++ REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_MODE, 2);
++
+ current_mode = dwb3_get_ogam_current(dwbc30);
+ if (current_mode == LUT_BYPASS || current_mode == LUT_RAM_A)
+ next_mode = LUT_RAM_B;
+@@ -227,8 +261,7 @@ static bool dwb3_program_ogam_lut(
+ dwb3_program_ogam_pwl(
+ dwbc30, params->rgb_resulted, params->hw_points_num);
+
+- REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_MODE, 2);
+- REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_SELECT, next_mode == LUT_RAM_A ? 0 : 1);
++ REG_UPDATE(DWB_OGAM_CONTROL, DWB_OGAM_SELECT, next_mode == LUT_RAM_A ? 0 : 1);
+
+ return true;
+ }
+@@ -271,14 +304,19 @@ static void dwb3_program_gamut_remap(
+
+ struct color_matrices_reg gam_regs;
+
+- REG_UPDATE(DWB_GAMUT_REMAP_COEF_FORMAT, DWB_GAMUT_REMAP_COEF_FORMAT, coef_format);
+-
+ if (regval == NULL || select == CM_GAMUT_REMAP_MODE_BYPASS) {
+ REG_SET(DWB_GAMUT_REMAP_MODE, 0,
+ DWB_GAMUT_REMAP_MODE, 0);
+ return;
+ }
+
++ REG_UPDATE(DWB_GAMUT_REMAP_COEF_FORMAT, DWB_GAMUT_REMAP_COEF_FORMAT, coef_format);
++
++ gam_regs.shifts.csc_c11 = dwbc30->dwbc_shift->DWB_GAMUT_REMAPA_C11;
++ gam_regs.masks.csc_c11 = dwbc30->dwbc_mask->DWB_GAMUT_REMAPA_C11;
++ gam_regs.shifts.csc_c12 = dwbc30->dwbc_shift->DWB_GAMUT_REMAPA_C12;
++ gam_regs.masks.csc_c12 = dwbc30->dwbc_mask->DWB_GAMUT_REMAPA_C12;
++
+ switch (select) {
+ case CM_GAMUT_REMAP_MODE_RAMA_COEFF:
+ gam_regs.csc_c11_c12 = REG(DWB_GAMUT_REMAPA_C11_C12);
+--
+2.30.2
+
--- /dev/null
+From 093209909742dde594e7d66bb4c5e743bec2bdc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 19:33:26 -0400
+Subject: drm/amd/display: fix missing writeback disablement if plane is
+ removed
+
+From: Roy Chan <roy.chan@amd.com>
+
+[ Upstream commit 82367e7f22d085092728f45fd5fbb15e3fb997c0 ]
+
+[Why]
+If the plane has been removed, the writeback disablement logic
+doesn't run
+
+[How]
+fix the logic order
+
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Signed-off-by: Roy Chan <roy.chan@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 ++++++++------
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++++++++++-
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index 5c2853654cca..a47ba1d45be9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1723,13 +1723,15 @@ void dcn20_program_front_end_for_ctx(
+
+ pipe = pipe->bottom_pipe;
+ }
+- /* Program secondary blending tree and writeback pipes */
+- pipe = &context->res_ctx.pipe_ctx[i];
+- if (!pipe->prev_odm_pipe && pipe->stream->num_wb_info > 0
+- && (pipe->update_flags.raw || pipe->plane_state->update_flags.raw || pipe->stream->update_flags.raw)
+- && hws->funcs.program_all_writeback_pipes_in_tree)
+- hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
+ }
++ /* Program secondary blending tree and writeback pipes */
++ pipe = &context->res_ctx.pipe_ctx[i];
++ if (!pipe->top_pipe && !pipe->prev_odm_pipe
++ && pipe->stream && pipe->stream->num_wb_info > 0
++ && (pipe->update_flags.raw || (pipe->plane_state && pipe->plane_state->update_flags.raw)
++ || pipe->stream->update_flags.raw)
++ && hws->funcs.program_all_writeback_pipes_in_tree)
++ hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+index 2e8ab9775fa3..fafed1e4a998 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+@@ -398,12 +398,22 @@ void dcn30_program_all_writeback_pipes_in_tree(
+ for (i_pipe = 0; i_pipe < dc->res_pool->pipe_count; i_pipe++) {
+ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i_pipe];
+
++ if (!pipe_ctx->plane_state)
++ continue;
++
+ if (pipe_ctx->plane_state == wb_info.writeback_source_plane) {
+ wb_info.mpcc_inst = pipe_ctx->plane_res.mpcc_inst;
+ break;
+ }
+ }
+- ASSERT(wb_info.mpcc_inst != -1);
++
++ if (wb_info.mpcc_inst == -1) {
++ /* Disable writeback pipe and disconnect from MPCC
++ * if source plane has been removed
++ */
++ dc->hwss.disable_writeback(dc, wb_info.dwb_pipe_inst);
++ continue;
++ }
+
+ ASSERT(wb_info.dwb_pipe_inst < dc->res_pool->res_cap->num_dwb);
+ dwb = dc->res_pool->dwbc[wb_info.dwb_pipe_inst];
+--
+2.30.2
+
--- /dev/null
+From e57da219e6869901bc9334d599f81c552caeb0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 06:41:13 -0400
+Subject: drm/amd/display: Fix PSR command version
+
+From: Mikita Lipski <mikita.lipski@amd.com>
+
+[ Upstream commit af1f2b19fd7d404d299355cc95930efee5b3ed8b ]
+
+[why]
+For dual eDP when setting the new settings we need to set
+command version to DMUB_CMD_PSR_CONTROL_VERSION_1, otherwise
+DMUB will not read panel_inst parameter.
+[how]
+Instead of PSR_VERSION_1 pass DMUB_CMD_PSR_CONTROL_VERSION_1
+
+Reviewed-by: Wood Wyatt <Wyatt.Wood@amd.com>
+Acked-by: Solomon Chiu <solomon.chiu@amd.com>
+Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+index 10d42ae0cffe..3428334c6c57 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+@@ -207,7 +207,7 @@ static void dmub_psr_set_level(struct dmub_psr *dmub, uint16_t psr_level, uint8_
+ cmd.psr_set_level.header.sub_type = DMUB_CMD__PSR_SET_LEVEL;
+ cmd.psr_set_level.header.payload_bytes = sizeof(struct dmub_cmd_psr_set_level_data);
+ cmd.psr_set_level.psr_set_level_data.psr_level = psr_level;
+- cmd.psr_set_level.psr_set_level_data.cmd_version = PSR_VERSION_1;
++ cmd.psr_set_level.psr_set_level_data.cmd_version = DMUB_CMD_PSR_CONTROL_VERSION_1;
+ cmd.psr_set_level.psr_set_level_data.panel_inst = panel_inst;
+ dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
+ dc_dmub_srv_cmd_execute(dc->dmub_srv);
+@@ -293,7 +293,7 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
+ copy_settings_data->debug.bitfields.use_hw_lock_mgr = 1;
+ copy_settings_data->fec_enable_status = (link->fec_state == dc_link_fec_enabled);
+ copy_settings_data->fec_enable_delay_in100us = link->dc->debug.fec_enable_delay_in100us;
+- copy_settings_data->cmd_version = PSR_VERSION_1;
++ copy_settings_data->cmd_version = DMUB_CMD_PSR_CONTROL_VERSION_1;
+ copy_settings_data->panel_inst = panel_inst;
+
+ dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
+--
+2.30.2
+
--- /dev/null
+From 0eccdb9ce7b6b3c8c139f0b397489abaf874f47a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jun 2021 15:04:04 -0400
+Subject: drm/amd/display: Fix timer_per_pixel unit error
+
+From: Oliver Logush <oliver.logush@amd.com>
+
+[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]
+
+[why]
+The units of the time_per_pixel variable were incorrect, this had to be
+changed for the code to properly function.
+
+[how]
+The change was very straightforward, only required one line of code to
+be changed where the calculation was done.
+
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Oliver Logush <oliver.logush@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index b173fa3653b5..c78933a9d31c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -2462,7 +2462,7 @@ void dcn20_set_mcif_arb_params(
+ wb_arb_params->cli_watermark[k] = get_wm_writeback_urgent(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
+ wb_arb_params->pstate_watermark[k] = get_wm_writeback_dram_clock_change(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
+ }
+- wb_arb_params->time_per_pixel = 16.0 / context->res_ctx.pipe_ctx[i].stream->phy_pix_clk; /* 4 bit fraction, ms */
++ wb_arb_params->time_per_pixel = 16.0 * 1000 / (context->res_ctx.pipe_ctx[i].stream->phy_pix_clk / 1000); /* 4 bit fraction, ms */
+ wb_arb_params->slice_lines = 32;
+ wb_arb_params->arbitration_slice = 2;
+ wb_arb_params->max_scaled_time = dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,
+--
+2.30.2
+
--- /dev/null
+From 2f1d15ecc08337ff38ba8a352e23f82c20521524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 13:55:50 -0400
+Subject: drm/amd/display: Fixed hardware power down bypass during headless
+ boot
+
+From: Jake Wang <haonan.wang2@amd.com>
+
+[ Upstream commit 3addbde269f21ffc735f6d3d0c2237664923824e ]
+
+[Why]
+During headless boot, DIG may be on which causes HW/SW discrepancies.
+To avoid this we power down hardware on boot if DIG is turned on. With
+introduction of multiple eDP, hardware power down is being bypassed
+under certain conditions.
+
+[How]
+Fixed hardware power down bypass, and ensured hardware will power down
+if DIG is on and seamless boot is not enabled.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Jake Wang <haonan.wang2@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 27 +++++++++----------
+ .../drm/amd/display/dc/dcn30/dcn30_hwseq.c | 25 ++++++++---------
+ .../drm/amd/display/dc/dcn31/dcn31_hwseq.c | 5 +++-
+ 3 files changed, 27 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index c545eddabdcc..dee1ce5f9609 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -1502,25 +1502,22 @@ void dcn10_init_hw(struct dc *dc)
+ void dcn10_power_down_on_boot(struct dc *dc)
+ {
+ struct dc_link *edp_links[MAX_NUM_EDP];
+- struct dc_link *edp_link;
++ struct dc_link *edp_link = NULL;
+ int edp_num;
+ int i = 0;
+
+ get_edp_links(dc, edp_links, &edp_num);
+-
+- if (edp_num) {
+- for (i = 0; i < edp_num; i++) {
+- edp_link = edp_links[i];
+- if (edp_link->link_enc->funcs->is_dig_enabled &&
+- edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
+- dc->hwseq->funcs.edp_backlight_control &&
+- dc->hwss.power_down &&
+- dc->hwss.edp_power_control) {
+- dc->hwseq->funcs.edp_backlight_control(edp_link, false);
+- dc->hwss.power_down(dc);
+- dc->hwss.edp_power_control(edp_link, false);
+- }
+- }
++ if (edp_num)
++ edp_link = edp_links[0];
++
++ if (edp_link && edp_link->link_enc->funcs->is_dig_enabled &&
++ edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
++ dc->hwseq->funcs.edp_backlight_control &&
++ dc->hwss.power_down &&
++ dc->hwss.edp_power_control) {
++ dc->hwseq->funcs.edp_backlight_control(edp_link, false);
++ dc->hwss.power_down(dc);
++ dc->hwss.edp_power_control(edp_link, false);
+ } else {
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+index c68e3a708a33..2e8ab9775fa3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+@@ -580,22 +580,19 @@ void dcn30_init_hw(struct dc *dc)
+ */
+ if (dc->config.power_down_display_on_boot) {
+ struct dc_link *edp_links[MAX_NUM_EDP];
+- struct dc_link *edp_link;
++ struct dc_link *edp_link = NULL;
+
+ get_edp_links(dc, edp_links, &edp_num);
+- if (edp_num) {
+- for (i = 0; i < edp_num; i++) {
+- edp_link = edp_links[i];
+- if (edp_link->link_enc->funcs->is_dig_enabled &&
+- edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
+- dc->hwss.edp_backlight_control &&
+- dc->hwss.power_down &&
+- dc->hwss.edp_power_control) {
+- dc->hwss.edp_backlight_control(edp_link, false);
+- dc->hwss.power_down(dc);
+- dc->hwss.edp_power_control(edp_link, false);
+- }
+- }
++ if (edp_num)
++ edp_link = edp_links[0];
++ if (edp_link && edp_link->link_enc->funcs->is_dig_enabled &&
++ edp_link->link_enc->funcs->is_dig_enabled(edp_link->link_enc) &&
++ dc->hwss.edp_backlight_control &&
++ dc->hwss.power_down &&
++ dc->hwss.edp_power_control) {
++ dc->hwss.edp_backlight_control(edp_link, false);
++ dc->hwss.power_down(dc);
++ dc->hwss.edp_power_control(edp_link, false);
+ } else {
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
+index 8a2119d8ca0d..8189606537c5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
+@@ -226,6 +226,7 @@ void dcn31_init_hw(struct dc *dc)
+ if (dc->config.power_down_display_on_boot) {
+ struct dc_link *edp_links[MAX_NUM_EDP];
+ struct dc_link *edp_link;
++ bool power_down = false;
+
+ get_edp_links(dc, edp_links, &edp_num);
+ if (edp_num) {
+@@ -239,9 +240,11 @@ void dcn31_init_hw(struct dc *dc)
+ dc->hwss.edp_backlight_control(edp_link, false);
+ dc->hwss.power_down(dc);
+ dc->hwss.edp_power_control(edp_link, false);
++ power_down = true;
+ }
+ }
+- } else {
++ }
++ if (!power_down) {
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+
+--
+2.30.2
+
--- /dev/null
+From 4a0da70509c6131eeca7b5c0525fc4dd9cdc7c52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 09:50:37 -0500
+Subject: drm/amdgpu: Fix a printing message
+
+From: Oak Zeng <Oak.Zeng@amd.com>
+
+[ Upstream commit 95f71f12aa45d65b7f2ccab95569795edffd379a ]
+
+The printing message "PSP loading VCN firmware" is mis-leading because
+people might think driver is loading VCN firmware. Actually when this
+message is printed, driver is just preparing some VCN ucode, not loading
+VCN firmware yet. The actual VCN firmware loading will be in the PSP block
+hw_init. Fix the printing message
+
+Signed-off-by: Oak Zeng <Oak.Zeng@amd.com>
+Reviewed-by: Christian Konig <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 284bb42d6c86..121ee9f2b8d1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -119,7 +119,7 @@ static int vcn_v1_0_sw_init(void *handle)
+ adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
+ adev->firmware.fw_size +=
+ ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
+- DRM_INFO("PSP loading VCN firmware\n");
++ dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
+ }
+
+ r = amdgpu_vcn_resume(adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+index 8af567c546db..f4686e918e0d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+@@ -122,7 +122,7 @@ static int vcn_v2_0_sw_init(void *handle)
+ adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
+ adev->firmware.fw_size +=
+ ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
+- DRM_INFO("PSP loading VCN firmware\n");
++ dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
+ }
+
+ r = amdgpu_vcn_resume(adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index 888b17d84691..e0c0c3734432 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -152,7 +152,7 @@ static int vcn_v2_5_sw_init(void *handle)
+ adev->firmware.fw_size +=
+ ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
+ }
+- DRM_INFO("PSP loading VCN firmware\n");
++ dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
+ }
+
+ r = amdgpu_vcn_resume(adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+index 47d4f04cbd69..2f017560948e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -160,7 +160,7 @@ static int vcn_v3_0_sw_init(void *handle)
+ adev->firmware.fw_size +=
+ ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
+ }
+- DRM_INFO("PSP loading VCN firmware\n");
++ dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
+ }
+
+ r = amdgpu_vcn_resume(adev);
+--
+2.30.2
+
--- /dev/null
+From 2d2e3c814bbfe48df322b7779689bd0e3920245b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 16:40:22 -0400
+Subject: drm/amdgpu: Fix amdgpu_ras_eeprom_init()
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]
+
+No need to account for the 2 bytes of EEPROM
+address--this is now well abstracted away by
+the fixes the the lower layers.
+
+Cc: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Cc: Alexander Deucher <Alexander.Deucher@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alexander Deucher <Alexander.Deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+index 38222de921d1..8dd151c9e459 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+@@ -325,7 +325,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control,
+ return ret;
+ }
+
+- __decode_table_header_from_buff(hdr, &buff[2]);
++ __decode_table_header_from_buff(hdr, buff);
+
+ if (hdr->header == EEPROM_TABLE_HDR_VAL) {
+ control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
+--
+2.30.2
+
--- /dev/null
+From 0b8e1a929b444898eaa09b4a1feeb9ee92dd14fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 20:15:42 -0400
+Subject: drm/amdgpu: Fix koops when accessing RAS EEPROM
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit 1d9d2ca85b32605ac9c74c8fa42d0c1cfbe019d4 ]
+
+Debugfs RAS EEPROM files are available when
+the ASIC supports RAS, and when the debugfs is
+enabled, an also when "ras_enable" module
+parameter is set to 0. However in this case,
+we get a kernel oops when accessing some of
+the "ras_..." controls in debugfs. The reason
+for this is that struct amdgpu_ras::adev is
+unset. This commit sets it, thus enabling access
+to those facilities. Note that this facilitates
+EEPROM access and not necessarily RAS features or
+functionality.
+
+Cc: Alexander Deucher <Alexander.Deucher@amd.com>
+Cc: John Clements <john.clements@amd.com>
+Cc: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alexander Deucher <Alexander.Deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index fc66aca28594..95d5842385b3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -1966,11 +1966,20 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev)
+ bool exc_err_limit = false;
+ int ret;
+
+- if (adev->ras_enabled && con)
+- data = &con->eh_data;
+- else
++ if (!con)
++ return 0;
++
++ /* Allow access to RAS EEPROM via debugfs, when the ASIC
++ * supports RAS and debugfs is enabled, but when
++ * adev->ras_enabled is unset, i.e. when "ras_enable"
++ * module parameter is set to 0.
++ */
++ con->adev = adev;
++
++ if (!adev->ras_enabled)
+ return 0;
+
++ data = &con->eh_data;
+ *data = kmalloc(sizeof(**data), GFP_KERNEL | __GFP_ZERO);
+ if (!*data) {
+ ret = -ENOMEM;
+@@ -1980,7 +1989,6 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev)
+ mutex_init(&con->recovery_lock);
+ INIT_WORK(&con->recovery_work, amdgpu_ras_do_recovery);
+ atomic_set(&con->in_recovery, 0);
+- con->adev = adev;
+
+ max_eeprom_records_len = amdgpu_ras_eeprom_get_record_max_length();
+ amdgpu_ras_validate_threshold(adev, max_eeprom_records_len);
+--
+2.30.2
+
--- /dev/null
+From 6c95e5f061efe184f73460d36ad10f52c5c107cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 21:26:14 -0500
+Subject: drm/amdkfd: Account for SH/SE count when setting up cu masks.
+
+From: Sean Keely <Sean.Keely@amd.com>
+
+[ Upstream commit 1ec06c2dee679e9f089e78ed20cb74ee90155f61 ]
+
+On systems with multiple SH per SE compute_static_thread_mgmt_se#
+is split into independent masks, one for each SH, in the upper and
+lower 16 bits. We need to detect this and apply cu masking to each
+SH. The cu mask bits are assigned first to each SE, then to
+alternate SHs, then finally to higher CU id. This ensures that
+the maximum number of SPIs are engaged as early as possible while
+balancing CU assignment to each SH.
+
+v2: Use max SH/SE rather than max SH in cu_per_sh.
+
+v3: Fix comment blocks, ensure se_mask is initially zero filled,
+ and correctly assign se.sh.cu positions to unset bits in cu_mask.
+
+Signed-off-by: Sean Keely <Sean.Keely@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 84 +++++++++++++++-----
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 1 +
+ 2 files changed, 64 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+index 88813dad731f..c021519af810 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+@@ -98,36 +98,78 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ uint32_t *se_mask)
+ {
+ struct kfd_cu_info cu_info;
+- uint32_t cu_per_se[KFD_MAX_NUM_SE] = {0};
+- int i, se, sh, cu = 0;
+-
++ uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0};
++ int i, se, sh, cu;
+ amdgpu_amdkfd_get_cu_info(mm->dev->kgd, &cu_info);
+
+ if (cu_mask_count > cu_info.cu_active_number)
+ cu_mask_count = cu_info.cu_active_number;
+
++ /* Exceeding these bounds corrupts the stack and indicates a coding error.
++ * Returning with no CU's enabled will hang the queue, which should be
++ * attention grabbing.
++ */
++ if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) {
++ pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", cu_info.num_shader_engines);
++ return;
++ }
++ if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) {
++ pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
++ cu_info.num_shader_arrays_per_engine * cu_info.num_shader_engines);
++ return;
++ }
++ /* Count active CUs per SH.
++ *
++ * Some CUs in an SH may be disabled. HW expects disabled CUs to be
++ * represented in the high bits of each SH's enable mask (the upper and lower
++ * 16 bits of se_mask) and will take care of the actual distribution of
++ * disabled CUs within each SH automatically.
++ * Each half of se_mask must be filled only on bits 0-cu_per_sh[se][sh]-1.
++ *
++ * See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info.
++ */
+ for (se = 0; se < cu_info.num_shader_engines; se++)
+ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
+- cu_per_se[se] += hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]);
+-
+- /* Symmetrically map cu_mask to all SEs:
+- * cu_mask[0] bit0 -> se_mask[0] bit0;
+- * cu_mask[0] bit1 -> se_mask[1] bit0;
+- * ... (if # SE is 4)
+- * cu_mask[0] bit4 -> se_mask[0] bit1;
++ cu_per_sh[se][sh] = hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]);
++
++ /* Symmetrically map cu_mask to all SEs & SHs:
++ * se_mask programs up to 2 SH in the upper and lower 16 bits.
++ *
++ * Examples
++ * Assuming 1 SH/SE, 4 SEs:
++ * cu_mask[0] bit0 -> se_mask[0] bit0
++ * cu_mask[0] bit1 -> se_mask[1] bit0
++ * ...
++ * cu_mask[0] bit4 -> se_mask[0] bit1
++ * ...
++ *
++ * Assuming 2 SH/SE, 4 SEs
++ * cu_mask[0] bit0 -> se_mask[0] bit0 (SE0,SH0,CU0)
++ * cu_mask[0] bit1 -> se_mask[1] bit0 (SE1,SH0,CU0)
++ * ...
++ * cu_mask[0] bit4 -> se_mask[0] bit16 (SE0,SH1,CU0)
++ * cu_mask[0] bit5 -> se_mask[1] bit16 (SE1,SH1,CU0)
++ * ...
++ * cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1)
+ * ...
++ *
++ * First ensure all CUs are disabled, then enable user specified CUs.
+ */
+- se = 0;
+- for (i = 0; i < cu_mask_count; i++) {
+- if (cu_mask[i / 32] & (1 << (i % 32)))
+- se_mask[se] |= 1 << cu;
+-
+- do {
+- se++;
+- if (se == cu_info.num_shader_engines) {
+- se = 0;
+- cu++;
++ for (i = 0; i < cu_info.num_shader_engines; i++)
++ se_mask[i] = 0;
++
++ i = 0;
++ for (cu = 0; cu < 16; cu++) {
++ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) {
++ for (se = 0; se < cu_info.num_shader_engines; se++) {
++ if (cu_per_sh[se][sh] > cu) {
++ if (cu_mask[i / 32] & (1 << (i % 32)))
++ se_mask[se] |= 1 << (cu + sh * 16);
++ i++;
++ if (i == cu_mask_count)
++ return;
++ }
+ }
+- } while (cu >= cu_per_se[se] && cu < 32);
++ }
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
+index b5e2ea7550d4..6e6918ccedfd 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
+@@ -27,6 +27,7 @@
+ #include "kfd_priv.h"
+
+ #define KFD_MAX_NUM_SE 8
++#define KFD_MAX_NUM_SH_PER_SE 2
+
+ /**
+ * struct mqd_manager
+--
+2.30.2
+
--- /dev/null
+From 9c4ffe5e0197c0b00d8fa034c96221cacb5a882c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 16:09:00 +0800
+Subject: drm/ast: Disable fast reset after DRAM initial
+
+From: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
+
+[ Upstream commit f34bf652d680cf65783e7c57d61c94ee87f092bd ]
+
+[Bug][AST2500]
+
+V1:
+When AST2500 acts as stand-alone VGA so that DRAM and DVO initialization
+have to be achieved by VGA driver with P2A (PCI to AHB) enabling.
+However, HW suggests disable Fast reset mode after DRAM initializaton,
+because fast reset mode is mainly designed for ARM ICE debugger.
+Once Fast reset is checked as enabling, WDT (Watch Dog Timer) should be
+first enabled to avoid system deadlock before disable fast reset mode.
+
+V2:
+Use to_pci_dev() to get revision of PCI configuration.
+
+V3:
+If SCU00 is not unlocked, just enter its password again.
+It is unnecessary to clear AHB lock condition and restore WDT default
+setting again, before Fast-reset clearing.
+
+V4:
+repatch after "error : could not build fake ancestor" resolved.
+
+V5:
+Since CVE_2019_6260 item3, Most of AST2500 have disabled P2A(PCIe to AMBA).
+However, for backward compatibility, some patches about P2A, such as items
+of v5.2 and v5.3, are considered to be upstreamed with comments.
+1. Add define macro to improve source readability.
+ast_drv.h, ast_main.c, ast_post.c
+2. Add comment about "Fast restet" is enabled for ARM-ICE debugger
+ast_post.c
+3. Add comment about Reset USB port to patch USB unknown device issue
+ast_post.c
+
+Signed-off-by: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210709080900.4056-1-kuohsiang_chou@aspeedtech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_drv.h | 6 +++
+ drivers/gpu/drm/ast/ast_main.c | 5 ++
+ drivers/gpu/drm/ast/ast_post.c | 91 ++++++++++++++++++++++++----------
+ 3 files changed, 76 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
+index 911f9f414774..39ca338eb80b 100644
+--- a/drivers/gpu/drm/ast/ast_drv.h
++++ b/drivers/gpu/drm/ast/ast_drv.h
+@@ -337,6 +337,11 @@ int ast_mode_config_init(struct ast_private *ast);
+ #define AST_DP501_LINKRATE 0xf014
+ #define AST_DP501_EDID_DATA 0xf020
+
++/* Define for Soc scratched reg */
++#define AST_VRAM_INIT_STATUS_MASK GENMASK(7, 6)
++//#define AST_VRAM_INIT_BY_BMC BIT(7)
++//#define AST_VRAM_INIT_READY BIT(6)
++
+ int ast_mm_init(struct ast_private *ast);
+
+ /* ast post */
+@@ -346,6 +351,7 @@ bool ast_is_vga_enabled(struct drm_device *dev);
+ void ast_post_gpu(struct drm_device *dev);
+ u32 ast_mindwm(struct ast_private *ast, u32 r);
+ void ast_moutdwm(struct ast_private *ast, u32 r, u32 v);
++void ast_patch_ahb_2500(struct ast_private *ast);
+ /* ast dp501 */
+ void ast_set_dp501_video_output(struct drm_device *dev, u8 mode);
+ bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size);
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 2aff2e6cf450..79a361867955 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -97,6 +97,11 @@ static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev)
+ jregd0 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff);
+ jregd1 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd1, 0xff);
+ if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) {
++ /* Patch AST2500 */
++ if (((pdev->revision & 0xF0) == 0x40)
++ && ((jregd0 & AST_VRAM_INIT_STATUS_MASK) == 0))
++ ast_patch_ahb_2500(ast);
++
+ /* Double check it's actually working */
+ data = ast_read32(ast, 0xf004);
+ if ((data != 0xFFFFFFFF) && (data != 0x00)) {
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index 0607658dde51..b5d92f652fd8 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -2028,6 +2028,40 @@ static bool ast_dram_init_2500(struct ast_private *ast)
+ return true;
+ }
+
++void ast_patch_ahb_2500(struct ast_private *ast)
++{
++ u32 data;
++
++ /* Clear bus lock condition */
++ ast_moutdwm(ast, 0x1e600000, 0xAEED1A03);
++ ast_moutdwm(ast, 0x1e600084, 0x00010000);
++ ast_moutdwm(ast, 0x1e600088, 0x00000000);
++ ast_moutdwm(ast, 0x1e6e2000, 0x1688A8A8);
++ data = ast_mindwm(ast, 0x1e6e2070);
++ if (data & 0x08000000) { /* check fast reset */
++ /*
++ * If "Fast restet" is enabled for ARM-ICE debugger,
++ * then WDT needs to enable, that
++ * WDT04 is WDT#1 Reload reg.
++ * WDT08 is WDT#1 counter restart reg to avoid system deadlock
++ * WDT0C is WDT#1 control reg
++ * [6:5]:= 01:Full chip
++ * [4]:= 1:1MHz clock source
++ * [1]:= 1:WDT will be cleeared and disabled after timeout occurs
++ * [0]:= 1:WDT enable
++ */
++ ast_moutdwm(ast, 0x1E785004, 0x00000010);
++ ast_moutdwm(ast, 0x1E785008, 0x00004755);
++ ast_moutdwm(ast, 0x1E78500c, 0x00000033);
++ udelay(1000);
++ }
++ do {
++ ast_moutdwm(ast, 0x1e6e2000, 0x1688A8A8);
++ data = ast_mindwm(ast, 0x1e6e2000);
++ } while (data != 1);
++ ast_moutdwm(ast, 0x1e6e207c, 0x08000000); /* clear fast reset */
++}
++
+ void ast_post_chip_2500(struct drm_device *dev)
+ {
+ struct ast_private *ast = to_ast_private(dev);
+@@ -2035,39 +2069,44 @@ void ast_post_chip_2500(struct drm_device *dev)
+ u8 reg;
+
+ reg = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff);
+- if ((reg & 0x80) == 0) {/* vga only */
++ if ((reg & AST_VRAM_INIT_STATUS_MASK) == 0) {/* vga only */
+ /* Clear bus lock condition */
+- ast_moutdwm(ast, 0x1e600000, 0xAEED1A03);
+- ast_moutdwm(ast, 0x1e600084, 0x00010000);
+- ast_moutdwm(ast, 0x1e600088, 0x00000000);
+- ast_moutdwm(ast, 0x1e6e2000, 0x1688A8A8);
+- ast_write32(ast, 0xf004, 0x1e6e0000);
+- ast_write32(ast, 0xf000, 0x1);
+- ast_write32(ast, 0x12000, 0x1688a8a8);
+- while (ast_read32(ast, 0x12000) != 0x1)
+- ;
+-
+- ast_write32(ast, 0x10000, 0xfc600309);
+- while (ast_read32(ast, 0x10000) != 0x1)
+- ;
++ ast_patch_ahb_2500(ast);
++
++ /* Disable watchdog */
++ ast_moutdwm(ast, 0x1E78502C, 0x00000000);
++ ast_moutdwm(ast, 0x1E78504C, 0x00000000);
++
++ /*
++ * Reset USB port to patch USB unknown device issue
++ * SCU90 is Multi-function Pin Control #5
++ * [29]:= 1:Enable USB2.0 Host port#1 (that the mutually shared USB2.0 Hub
++ * port).
++ * SCU94 is Multi-function Pin Control #6
++ * [14:13]:= 1x:USB2.0 Host2 controller
++ * SCU70 is Hardware Strap reg
++ * [23]:= 1:CLKIN is 25MHz and USBCK1 = 24/48 MHz (determined by
++ * [18]: 0(24)/1(48) MHz)
++ * SCU7C is Write clear reg to SCU70
++ * [23]:= write 1 and then SCU70[23] will be clear as 0b.
++ */
++ ast_moutdwm(ast, 0x1E6E2090, 0x20000000);
++ ast_moutdwm(ast, 0x1E6E2094, 0x00004000);
++ if (ast_mindwm(ast, 0x1E6E2070) & 0x00800000) {
++ ast_moutdwm(ast, 0x1E6E207C, 0x00800000);
++ mdelay(100);
++ ast_moutdwm(ast, 0x1E6E2070, 0x00800000);
++ }
++ /* Modify eSPI reset pin */
++ temp = ast_mindwm(ast, 0x1E6E2070);
++ if (temp & 0x02000000)
++ ast_moutdwm(ast, 0x1E6E207C, 0x00004000);
+
+ /* Slow down CPU/AHB CLK in VGA only mode */
+ temp = ast_read32(ast, 0x12008);
+ temp |= 0x73;
+ ast_write32(ast, 0x12008, temp);
+
+- /* Reset USB port to patch USB unknown device issue */
+- ast_moutdwm(ast, 0x1e6e2090, 0x20000000);
+- temp = ast_mindwm(ast, 0x1e6e2094);
+- temp |= 0x00004000;
+- ast_moutdwm(ast, 0x1e6e2094, temp);
+- temp = ast_mindwm(ast, 0x1e6e2070);
+- if (temp & 0x00800000) {
+- ast_moutdwm(ast, 0x1e6e207c, 0x00800000);
+- mdelay(100);
+- ast_moutdwm(ast, 0x1e6e2070, 0x00800000);
+- }
+-
+ if (!ast_dram_init_2500(ast))
+ drm_err(dev, "DRAM init failed !\n");
+
+--
+2.30.2
+
--- /dev/null
+From 2effc9b2ac7825ec2cfc736c311a745f3eb26f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 12:35:05 +0800
+Subject: drm: avoid blocking in drm_clients_info's rcu section
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]
+
+Inside drm_clients_info, the rcu_read_lock is held to lock
+pid_task()->comm. However, within this protected section, a call to
+drm_is_current_master is made, which involves a mutex lock in a future
+patch. However, this is illegal because the mutex lock might block
+while in the RCU read-side critical section.
+
+Since drm_is_current_master isn't protected by rcu_read_lock, we avoid
+this by moving it out of the RCU critical section.
+
+The following report came from intel-gfx ci's
+igt@debugfs_test@read_all_entries testcase:
+
+=============================
+[ BUG: Invalid wait context ]
+5.13.0-CI-Patchwork_20515+ #1 Tainted: G W
+-----------------------------
+debugfs_test/1101 is trying to lock:
+ffff888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:
+drm_is_current_master+0x1e/0x50
+other info that might help us debug this:
+context-{4:4}
+3 locks held by debugfs_test/1101:
+ #0: ffff88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
+ seq_read_iter+0x53/0x3b0
+ #1: ffff888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
+ drm_clients_info+0x63/0x2a0
+ #2: ffffffff82734220 (rcu_read_lock){....}-{1:2}, at:
+ drm_clients_info+0x1b1/0x2a0
+stack backtrace:
+CPU: 8 PID: 1101 Comm: debugfs_test Tainted: G W
+5.13.0-CI-Patchwork_20515+ #1
+Hardware name: Intel Corporation CometLake Client Platform/CometLake S
+UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
+Call Trace:
+ dump_stack+0x7f/0xad
+ __lock_acquire.cold.78+0x2af/0x2ca
+ lock_acquire+0xd3/0x300
+ ? drm_is_current_master+0x1e/0x50
+ ? __mutex_lock+0x76/0x970
+ ? lockdep_hardirqs_on+0xbf/0x130
+ __mutex_lock+0xab/0x970
+ ? drm_is_current_master+0x1e/0x50
+ ? drm_is_current_master+0x1e/0x50
+ ? drm_is_current_master+0x1e/0x50
+ drm_is_current_master+0x1e/0x50
+ drm_clients_info+0x107/0x2a0
+ seq_read_iter+0x178/0x3b0
+ seq_read+0x104/0x150
+ full_proxy_read+0x4e/0x80
+ vfs_read+0xa5/0x1b0
+ ksys_read+0x5a/0xd0
+ do_syscall_64+0x39/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-3-desmondcheongzx@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
+index 3d7182001004..b0a826489488 100644
+--- a/drivers/gpu/drm/drm_debugfs.c
++++ b/drivers/gpu/drm/drm_debugfs.c
+@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
+ mutex_lock(&dev->filelist_mutex);
+ list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
+ struct task_struct *task;
++ bool is_current_master = drm_is_current_master(priv);
+
+ rcu_read_lock(); /* locks pid_task()->comm */
+ task = pid_task(priv->pid, PIDTYPE_PID);
+@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
+ task ? task->comm : "<unknown>",
+ pid_vnr(priv->pid),
+ priv->minor->index,
+- drm_is_current_master(priv) ? 'y' : 'n',
++ is_current_master ? 'y' : 'n',
+ priv->authenticated ? 'y' : 'n',
+ from_kuid_munged(seq_user_ns(m), uid),
+ priv->magic);
+--
+2.30.2
+
--- /dev/null
+From b1ec7a7d9f93fae944ae038a7b1f79aa7b430e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 11:48:06 +0200
+Subject: drm/bridge: nwl-dsi: Avoid potential multiplication overflow on
+ 32-bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 47956bc86ee4e8530cac386a04f62a6095f7afbe ]
+
+As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 1000000000L, the second
+multiplication in
+
+ dsi->lanes * 8 * NSEC_PER_SEC
+
+will overflow on a 32-bit platform. Fix this by making the constant
+unsigned long long, forcing 64-bit arithmetic.
+
+As iMX8 is arm64, this driver is currently used on 64-bit platforms
+only, where long is 64-bit, so this cannot happen. But the issue will
+start to happen when the driver is reused for a 32-bit SoC (e.g.
+i.MX7ULP), or when code is copied for a new driver.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/ebb82941a86b4e35c4fcfb1ef5a5cfad7c1fceab.1626255956.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/nwl-dsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
+index 873995f0a741..6002404ffcb9 100644
+--- a/drivers/gpu/drm/bridge/nwl-dsi.c
++++ b/drivers/gpu/drm/bridge/nwl-dsi.c
+@@ -196,7 +196,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps)
+ u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
+
+ return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp,
+- dsi->lanes * 8 * NSEC_PER_SEC);
++ dsi->lanes * 8ULL * NSEC_PER_SEC);
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 8d5818847f01c2d61f7f9abf1a1ec4d3516c82f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 21:07:03 -0700
+Subject: drm/display: fix possible null-pointer dereference in
+ dcn10_set_clock()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 554594567b1fa3da74f88ec7b2dc83d000c58e98 ]
+
+The variable dc->clk_mgr is checked in:
+ if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
+
+This indicates dc->clk_mgr can be NULL.
+However, it is dereferenced in:
+ if (!dc->clk_mgr->funcs->get_clock)
+
+To fix this null-pointer dereference, check dc->clk_mgr and the function
+pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them
+is NULL.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index dee1ce5f9609..75fa4adcf5f4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -3628,13 +3628,12 @@ enum dc_status dcn10_set_clock(struct dc *dc,
+ struct dc_clock_config clock_cfg = {0};
+ struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk;
+
+- if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
+- dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
+- context, clock_type, &clock_cfg);
+-
+- if (!dc->clk_mgr->funcs->get_clock)
++ if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
+ return DC_FAIL_UNSUPPORTED_1;
+
++ dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
++ context, clock_type, &clock_cfg);
++
+ if (clk_khz > clock_cfg.max_clock_khz)
+ return DC_FAIL_CLK_EXCEED_MAX;
+
+@@ -3652,7 +3651,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
+ else
+ return DC_ERROR_UNEXPECTED;
+
+- if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks)
++ if (dc->clk_mgr->funcs->update_clocks)
+ dc->clk_mgr->funcs->update_clocks(dc->clk_mgr,
+ context, true);
+ return DC_OK;
+--
+2.30.2
+
--- /dev/null
+From a36652d12c48fc524256690fb1d9b9b2b6a7f3ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 16:36:56 -0700
+Subject: drm/exynos: Always initialize mapping in exynos_drm_register_dma()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit c626f3864bbbb28bbe06476b0b497c1330aa4463 ]
+
+In certain randconfigs, clang warns:
+
+drivers/gpu/drm/exynos/exynos_drm_dma.c:121:19: warning: variable
+'mapping' is uninitialized when used here [-Wuninitialized]
+ priv->mapping = mapping;
+ ^~~~~~~
+drivers/gpu/drm/exynos/exynos_drm_dma.c:111:16: note: initialize the
+variable 'mapping' to silence this warning
+ void *mapping;
+ ^
+ = NULL
+1 warning generated.
+
+This occurs when CONFIG_EXYNOS_IOMMU is enabled and both
+CONFIG_ARM_DMA_USE_IOMMU and CONFIG_IOMMU_DMA are disabled, which makes
+the code look like
+
+ void *mapping;
+
+ if (0)
+ mapping = arm_iommu_create_mapping()
+ else if (0)
+ mapping = iommu_get_domain_for_dev()
+
+ ...
+ priv->mapping = mapping;
+
+Add an else branch that initializes mapping to the -ENODEV error pointer
+so that there is no more warning and the driver does not change during
+runtime.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c
+index 0644936afee2..bf33c3084cb4 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
+@@ -115,6 +115,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,
+ EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE);
+ else if (IS_ENABLED(CONFIG_IOMMU_DMA))
+ mapping = iommu_get_domain_for_dev(priv->dma_dev);
++ else
++ mapping = ERR_PTR(-ENODEV);
+
+ if (IS_ERR(mapping))
+ return PTR_ERR(mapping);
+--
+2.30.2
+
--- /dev/null
+From 6319f94340ffef7bb23131f7c33fc5e2490814ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 01:21:23 +0530
+Subject: drm/msm/a6xx: Fix llcc configuration for a660 gpu
+
+From: Akhil P Oommen <akhilpo@codeaurora.org>
+
+[ Upstream commit a6f24383f6c0a8d64d1f6afa10733ae4e8f236e0 ]
+
+Add the missing scache_cntl0 register programing which is required for
+a660 gpu.
+
+Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210730011945.v4.1.I110b87677ef16d97397fb7c81c07a16e1f5d211e@changeid
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 46 ++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 9c5e4618aa0a..183b9f9c1b31 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1383,13 +1383,13 @@ static void a6xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
+ {
+ struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+ struct msm_gpu *gpu = &adreno_gpu->base;
+- u32 cntl1_regval = 0;
++ u32 gpu_scid, cntl1_regval = 0;
+
+ if (IS_ERR(a6xx_gpu->llc_mmio))
+ return;
+
+ if (!llcc_slice_activate(a6xx_gpu->llc_slice)) {
+- u32 gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
++ gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
+
+ gpu_scid &= 0x1f;
+ cntl1_regval = (gpu_scid << 0) | (gpu_scid << 5) | (gpu_scid << 10) |
+@@ -1409,26 +1409,34 @@ static void a6xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
+ }
+ }
+
+- if (cntl1_regval) {
++ if (!cntl1_regval)
++ return;
++
++ /*
++ * Program the slice IDs for the various GPU blocks and GPU MMU
++ * pagetables
++ */
++ if (!a6xx_gpu->have_mmu500) {
++ a6xx_llc_write(a6xx_gpu,
++ REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_1, cntl1_regval);
++
+ /*
+- * Program the slice IDs for the various GPU blocks and GPU MMU
+- * pagetables
++ * Program cacheability overrides to not allocate cache
++ * lines on a write miss
+ */
+- if (a6xx_gpu->have_mmu500)
+- gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL1, GENMASK(24, 0),
+- cntl1_regval);
+- else {
+- a6xx_llc_write(a6xx_gpu,
+- REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_1, cntl1_regval);
+-
+- /*
+- * Program cacheability overrides to not allocate cache
+- * lines on a write miss
+- */
+- a6xx_llc_rmw(a6xx_gpu,
+- REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_0, 0xF, 0x03);
+- }
++ a6xx_llc_rmw(a6xx_gpu,
++ REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_0, 0xF, 0x03);
++ return;
+ }
++
++ gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL1, GENMASK(24, 0), cntl1_regval);
++
++ /* On A660, the SCID programming for UCHE traffic is done in
++ * A6XX_GBIF_SCACHE_CNTL0[14:10]
++ */
++ if (adreno_is_a660(adreno_gpu))
++ gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL0, (0x1f << 10) |
++ (1 << 8), (gpu_scid << 10) | (1 << 8));
+ }
+
+ static void a6xx_llc_slices_destroy(struct a6xx_gpu *a6xx_gpu)
+--
+2.30.2
+
--- /dev/null
+From 57bb0125d3dda69048b4dbe8cd4781b4343dfc1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:44:55 -0700
+Subject: drm/msm/dp: do not end dp link training until video is ready
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 2e0adc765d884cc080baa501e250bfad97035b09 ]
+
+Initialize both pre-emphasis and voltage swing level to 0 before
+start link training and do not end link training until video is
+ready to reduce the period between end of link training and video
+start to meet Link Layer CTS requirement. Some dongle main link
+symbol may become unlocked again if host did not end link training
+soon enough after completion of link training 2. Host have to re
+train main link if loss of symbol locked detected before end link
+training so that the coming video stream can be transmitted to sink
+properly. This fixes Link Layer CTS cases 4.3.2.1, 4.3.2.2, 4.3.2.3
+and 4.3.2.4.
+
+Changes in v3:
+-- merge retrain link if loss of symbol locked happen into this patch
+-- replace dp_ctrl_loss_symbol_lock() with dp_ctrl_channel_eq_ok()
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1628196295-7382-7-git-send-email-khsieh@codeaurora.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 56 +++++++++++++++++++++++---------
+ 1 file changed, 41 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 30d20e3beb29..6f5e45d54b26 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1480,6 +1480,9 @@ static int dp_ctrl_link_maintenance(struct dp_ctrl_private *ctrl)
+
+ dp_ctrl_push_idle(&ctrl->dp_ctrl);
+
++ ctrl->link->phy_params.p_level = 0;
++ ctrl->link->phy_params.v_level = 0;
++
+ ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
+
+ ret = dp_ctrl_setup_main_link(ctrl, &training_step);
+@@ -1632,6 +1635,16 @@ static bool dp_ctrl_clock_recovery_any_ok(
+ return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
+ }
+
++static bool dp_ctrl_channel_eq_ok(struct dp_ctrl_private *ctrl)
++{
++ u8 link_status[DP_LINK_STATUS_SIZE];
++ int num_lanes = ctrl->link->link_params.num_lanes;
++
++ dp_ctrl_read_link_status(ctrl, link_status);
++
++ return drm_dp_channel_eq_ok(link_status, num_lanes);
++}
++
+ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ {
+ int rc = 0;
+@@ -1666,6 +1679,9 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ ctrl->link->link_params.rate,
+ ctrl->link->link_params.num_lanes, ctrl->dp_ctrl.pixel_rate);
+
++ ctrl->link->phy_params.p_level = 0;
++ ctrl->link->phy_params.v_level = 0;
++
+ rc = dp_ctrl_enable_mainlink_clocks(ctrl);
+ if (rc)
+ return rc;
+@@ -1731,17 +1747,19 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
+ return rc;
+
+- /* stop txing train pattern */
+- dp_ctrl_clear_training_pattern(ctrl);
++ if (rc == 0) { /* link train successfully */
++ /*
++ * do not stop train pattern here
++ * stop link training at on_stream
++ * to pass compliance test
++ */
++ } else {
++ /*
++ * link training failed
++ * end txing train pattern here
++ */
++ dp_ctrl_clear_training_pattern(ctrl);
+
+- /*
+- * keep transmitting idle pattern until video ready
+- * to avoid main link from loss of sync
+- */
+- if (rc == 0) /* link train successfully */
+- dp_ctrl_push_idle(dp_ctrl);
+- else {
+- /* link training failed */
+ dp_ctrl_deinitialize_mainlink(ctrl);
+ rc = -ECONNRESET;
+ }
+@@ -1749,9 +1767,15 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ return rc;
+ }
+
++static int dp_ctrl_link_retrain(struct dp_ctrl_private *ctrl)
++{
++ int training_step = DP_TRAINING_NONE;
++
++ return dp_ctrl_setup_main_link(ctrl, &training_step);
++}
++
+ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
+ {
+- u32 rate = 0;
+ int ret = 0;
+ bool mainlink_ready = false;
+ struct dp_ctrl_private *ctrl;
+@@ -1761,10 +1785,6 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
+
+ ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+
+- rate = ctrl->panel->link_info.rate;
+-
+- ctrl->link->link_params.rate = rate;
+- ctrl->link->link_params.num_lanes = ctrl->panel->link_info.num_lanes;
+ ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
+
+ DRM_DEBUG_DP("rate=%d, num_lanes=%d, pixel_rate=%d\n",
+@@ -1779,6 +1799,12 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl)
+ }
+ }
+
++ if (!dp_ctrl_channel_eq_ok(ctrl))
++ dp_ctrl_link_retrain(ctrl);
++
++ /* stop txing train pattern to end link training */
++ dp_ctrl_clear_training_pattern(ctrl);
++
+ ret = dp_ctrl_enable_stream_clocks(ctrl);
+ if (ret) {
+ DRM_ERROR("Failed to start pixel clocks. ret=%d\n", ret);
+--
+2.30.2
+
--- /dev/null
+From 282fe5f0c7f3c680dd2d2aa5bd4f3e9dbe69132a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:44:51 -0700
+Subject: drm/msm/dp: reduce link rate if failed at link training 1
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 4b85d405cfe938ae7ad61656484ae88dee289e3b ]
+
+Reduce link rate and re start link training if link training 1
+failed due to loss of clock recovery done to fix Link Layer
+CTS case 4.3.1.7. Also only update voltage and pre-emphasis
+swing level after link training started to fix Link Layer CTS
+case 4.3.1.6.
+
+Changes in V2:
+-- replaced cr_status with link_status[DP_LINK_STATUS_SIZE]
+-- replaced dp_ctrl_any_lane_cr_done() with dp_ctrl_colco_recovery_any_ok()
+-- replaced dp_ctrl_any_ane_cr_lose() with !drm_dp_clock_recovery_ok()
+
+Changes in V3:
+-- return failed if lane_count <= 1
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1628196295-7382-3-git-send-email-khsieh@codeaurora.org
+[remove unused cr_status variable]
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 78 ++++++++++++++++++--------------
+ 1 file changed, 44 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index eaddfd739885..30d20e3beb29 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -81,13 +81,6 @@ struct dp_ctrl_private {
+ struct completion video_comp;
+ };
+
+-struct dp_cr_status {
+- u8 lane_0_1;
+- u8 lane_2_3;
+-};
+-
+-#define DP_LANE0_1_CR_DONE 0x11
+-
+ static int dp_aux_link_configure(struct drm_dp_aux *aux,
+ struct dp_link_info *link)
+ {
+@@ -1078,7 +1071,7 @@ static int dp_ctrl_read_link_status(struct dp_ctrl_private *ctrl,
+ }
+
+ static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
+- struct dp_cr_status *cr, int *training_step)
++ int *training_step)
+ {
+ int tries, old_v_level, ret = 0;
+ u8 link_status[DP_LINK_STATUS_SIZE];
+@@ -1107,9 +1100,6 @@ static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
+ if (ret)
+ return ret;
+
+- cr->lane_0_1 = link_status[0];
+- cr->lane_2_3 = link_status[1];
+-
+ if (drm_dp_clock_recovery_ok(link_status,
+ ctrl->link->link_params.num_lanes)) {
+ return 0;
+@@ -1186,7 +1176,7 @@ static void dp_ctrl_clear_training_pattern(struct dp_ctrl_private *ctrl)
+ }
+
+ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+- struct dp_cr_status *cr, int *training_step)
++ int *training_step)
+ {
+ int tries = 0, ret = 0;
+ char pattern;
+@@ -1202,10 +1192,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+ else
+ pattern = DP_TRAINING_PATTERN_2;
+
+- ret = dp_ctrl_update_vx_px(ctrl);
+- if (ret)
+- return ret;
+-
+ ret = dp_catalog_ctrl_set_pattern(ctrl->catalog, pattern);
+ if (ret)
+ return ret;
+@@ -1218,8 +1204,6 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+ ret = dp_ctrl_read_link_status(ctrl, link_status);
+ if (ret)
+ return ret;
+- cr->lane_0_1 = link_status[0];
+- cr->lane_2_3 = link_status[1];
+
+ if (drm_dp_channel_eq_ok(link_status,
+ ctrl->link->link_params.num_lanes)) {
+@@ -1239,7 +1223,7 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+ static int dp_ctrl_reinitialize_mainlink(struct dp_ctrl_private *ctrl);
+
+ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+- struct dp_cr_status *cr, int *training_step)
++ int *training_step)
+ {
+ int ret = 0;
+ u8 encoding = DP_SET_ANSI_8B10B;
+@@ -1255,7 +1239,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+ drm_dp_dpcd_write(ctrl->aux, DP_MAIN_LINK_CHANNEL_CODING_SET,
+ &encoding, 1);
+
+- ret = dp_ctrl_link_train_1(ctrl, cr, training_step);
++ ret = dp_ctrl_link_train_1(ctrl, training_step);
+ if (ret) {
+ DRM_ERROR("link training #1 failed. ret=%d\n", ret);
+ goto end;
+@@ -1264,7 +1248,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+ /* print success info as this is a result of user initiated action */
+ DRM_DEBUG_DP("link training #1 successful\n");
+
+- ret = dp_ctrl_link_train_2(ctrl, cr, training_step);
++ ret = dp_ctrl_link_train_2(ctrl, training_step);
+ if (ret) {
+ DRM_ERROR("link training #2 failed. ret=%d\n", ret);
+ goto end;
+@@ -1280,7 +1264,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+ }
+
+ static int dp_ctrl_setup_main_link(struct dp_ctrl_private *ctrl,
+- struct dp_cr_status *cr, int *training_step)
++ int *training_step)
+ {
+ int ret = 0;
+
+@@ -1295,7 +1279,7 @@ static int dp_ctrl_setup_main_link(struct dp_ctrl_private *ctrl,
+ * a link training pattern, we have to first do soft reset.
+ */
+
+- ret = dp_ctrl_link_train(ctrl, cr, training_step);
++ ret = dp_ctrl_link_train(ctrl, training_step);
+
+ return ret;
+ }
+@@ -1492,14 +1476,13 @@ static int dp_ctrl_deinitialize_mainlink(struct dp_ctrl_private *ctrl)
+ static int dp_ctrl_link_maintenance(struct dp_ctrl_private *ctrl)
+ {
+ int ret = 0;
+- struct dp_cr_status cr;
+ int training_step = DP_TRAINING_NONE;
+
+ dp_ctrl_push_idle(&ctrl->dp_ctrl);
+
+ ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
+
+- ret = dp_ctrl_setup_main_link(ctrl, &cr, &training_step);
++ ret = dp_ctrl_setup_main_link(ctrl, &training_step);
+ if (ret)
+ goto end;
+
+@@ -1630,6 +1613,25 @@ void dp_ctrl_handle_sink_request(struct dp_ctrl *dp_ctrl)
+ }
+ }
+
++static bool dp_ctrl_clock_recovery_any_ok(
++ const u8 link_status[DP_LINK_STATUS_SIZE],
++ int lane_count)
++{
++ int reduced_cnt;
++
++ if (lane_count <= 1)
++ return false;
++
++ /*
++ * only interested in the lane number after reduced
++ * lane_count = 4, then only interested in 2 lanes
++ * lane_count = 2, then only interested in 1 lane
++ */
++ reduced_cnt = lane_count >> 1;
++
++ return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
++}
++
+ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ {
+ int rc = 0;
+@@ -1637,7 +1639,7 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ u32 rate = 0;
+ int link_train_max_retries = 5;
+ u32 const phy_cts_pixel_clk_khz = 148500;
+- struct dp_cr_status cr;
++ u8 link_status[DP_LINK_STATUS_SIZE];
+ unsigned int training_step;
+
+ if (!dp_ctrl)
+@@ -1677,19 +1679,21 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ }
+
+ training_step = DP_TRAINING_NONE;
+- rc = dp_ctrl_setup_main_link(ctrl, &cr, &training_step);
++ rc = dp_ctrl_setup_main_link(ctrl, &training_step);
+ if (rc == 0) {
+ /* training completed successfully */
+ break;
+ } else if (training_step == DP_TRAINING_1) {
+ /* link train_1 failed */
+- if (!dp_catalog_link_is_connected(ctrl->catalog)) {
++ if (!dp_catalog_link_is_connected(ctrl->catalog))
+ break;
+- }
++
++ dp_ctrl_read_link_status(ctrl, link_status);
+
+ rc = dp_ctrl_link_rate_down_shift(ctrl);
+ if (rc < 0) { /* already in RBR = 1.6G */
+- if (cr.lane_0_1 & DP_LANE0_1_CR_DONE) {
++ if (dp_ctrl_clock_recovery_any_ok(link_status,
++ ctrl->link->link_params.num_lanes)) {
+ /*
+ * some lanes are ready,
+ * reduce lane number
+@@ -1705,12 +1709,18 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ }
+ }
+ } else if (training_step == DP_TRAINING_2) {
+- /* link train_2 failed, lower lane rate */
+- if (!dp_catalog_link_is_connected(ctrl->catalog)) {
++ /* link train_2 failed */
++ if (!dp_catalog_link_is_connected(ctrl->catalog))
+ break;
+- }
+
+- rc = dp_ctrl_link_lane_down_shift(ctrl);
++ dp_ctrl_read_link_status(ctrl, link_status);
++
++ if (!drm_dp_clock_recovery_ok(link_status,
++ ctrl->link->link_params.num_lanes))
++ rc = dp_ctrl_link_rate_down_shift(ctrl);
++ else
++ rc = dp_ctrl_link_lane_down_shift(ctrl);
++
+ if (rc < 0) {
+ /* end with failure */
+ break; /* lane == 1 already */
+--
+2.30.2
+
--- /dev/null
+From 76a43c61a4e78b8e764d4ff2e7521f2decbd0346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:44:52 -0700
+Subject: drm/msm/dp: reset aux controller after dp_aux_cmd_fifo_tx() failed.
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 0b324564ff74fa0556002be8fbbace556b9b2ad0 ]
+
+Aux hardware calibration sequence requires resetting the aux controller
+in order for the new setting to take effect. However resetting the AUX
+controller will also clear HPD interrupt status which may accidentally
+cause pending unplug interrupt to get lost. Therefore reset aux
+controller only when link is in connection state when dp_aux_cmd_fifo_tx()
+fail. This fixes Link Layer CTS cases 4.2.1.1 and 4.2.1.2.
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1628196295-7382-4-git-send-email-khsieh@codeaurora.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_aux.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_aux.c b/drivers/gpu/drm/msm/dp/dp_aux.c
+index 4a3293b590b0..eb40d8413bca 100644
+--- a/drivers/gpu/drm/msm/dp/dp_aux.c
++++ b/drivers/gpu/drm/msm/dp/dp_aux.c
+@@ -353,6 +353,9 @@ static ssize_t dp_aux_transfer(struct drm_dp_aux *dp_aux,
+ if (!(aux->retry_cnt % MAX_AUX_RETRIES))
+ dp_catalog_aux_update_cfg(aux->catalog);
+ }
++ /* reset aux if link is in connected state */
++ if (dp_catalog_link_is_connected(aux->catalog))
++ dp_catalog_aux_reset(aux->catalog);
+ } else {
+ aux->retry_cnt = 0;
+ switch (aux->aux_error_num) {
+--
+2.30.2
+
--- /dev/null
+From 97ce41603c4e29a7e46d184d372b85a6b3ebd3ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:44:54 -0700
+Subject: drm/msm/dp: return correct edid checksum after corrupted edid
+ checksum read
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 7948fe12d47a946fb8025a0534c900e3dd4b5839 ]
+
+Response with correct edid checksum saved at connector after corrupted edid
+checksum read. This fixes Link Layer CTS cases 4.2.2.3, 4.2.2.6.
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1628196295-7382-6-git-send-email-khsieh@codeaurora.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_panel.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
+index 440b32753430..2181b60e1d1d 100644
+--- a/drivers/gpu/drm/msm/dp/dp_panel.c
++++ b/drivers/gpu/drm/msm/dp/dp_panel.c
+@@ -271,7 +271,7 @@ static u8 dp_panel_get_edid_checksum(struct edid *edid)
+ {
+ struct edid *last_block;
+ u8 *raw_edid;
+- bool is_edid_corrupt;
++ bool is_edid_corrupt = false;
+
+ if (!edid) {
+ DRM_ERROR("invalid edid input\n");
+@@ -303,7 +303,12 @@ void dp_panel_handle_sink_request(struct dp_panel *dp_panel)
+ panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+
+ if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
+- u8 checksum = dp_panel_get_edid_checksum(dp_panel->edid);
++ u8 checksum;
++
++ if (dp_panel->edid)
++ checksum = dp_panel_get_edid_checksum(dp_panel->edid);
++ else
++ checksum = dp_panel->connector->real_edid_checksum;
+
+ dp_link_send_edid_checksum(panel->link, checksum);
+ dp_link_send_test_response(panel->link);
+--
+2.30.2
+
--- /dev/null
+From cd29f2a1b73d1fe7772624a60d65961719d6a10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 00:20:54 +0200
+Subject: drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+[ Upstream commit 462f7017a6918d152870bfb8852f3c70fd74b296 ]
+
+VDDA is not present and the specified load value is wrong. Fix it.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20210728222057.52641-1-konrad.dybcio@somainline.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_cfg.c | 1 -
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +-
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+index f3f1c03c7db9..763f127e4621 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+@@ -154,7 +154,6 @@ static const struct msm_dsi_config sdm660_dsi_cfg = {
+ .reg_cfg = {
+ .num = 2,
+ .regs = {
+- {"vdd", 73400, 32 }, /* 0.9 V */
+ {"vdda", 12560, 4 }, /* 1.2 V */
+ },
+ },
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+index a34cf151c517..bb31230721bd 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+@@ -1050,7 +1050,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = {
+ .reg_cfg = {
+ .num = 1,
+ .regs = {
+- {"vcca", 17000, 32},
++ {"vcca", 73400, 32},
+ },
+ },
+ .ops = {
+--
+2.30.2
+
--- /dev/null
+From c6ccbc0d01da8a701e599f730db7824999d77452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 08:09:25 +0200
+Subject: drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 56bd931ae506730c9ab1e4cc4bfefa43fc2d18fa ]
+
+msm_atomic is doing vblank get/put's already,
+currently there no need to duplicate the effort in MDP4
+
+Fix warning:
+...
+WARNING: CPU: 3 PID: 79 at drivers/gpu/drm/drm_vblank.c:1194 drm_vblank_put+0x1cc/0x1d4
+...
+and multiple vblank time-outs:
+...
+msm 5100000.mdp: vblank time out, crtc=1
+...
+
+Tested on Nexus 7 2013 (deb), LTS 5.10.50.
+
+Introduced by: 119ecb7fd3b5 ("drm/msm/mdp4: request vblank during modeset")
+
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Link: https://lore.kernel.org/r/20210715060925.7880-1-david@ixit.cz
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+index 0712752742f4..1f12bccee2b8 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+@@ -89,13 +89,6 @@ static void mdp4_disable_commit(struct msm_kms *kms)
+
+ static void mdp4_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *state)
+ {
+- int i;
+- struct drm_crtc *crtc;
+- struct drm_crtc_state *crtc_state;
+-
+- /* see 119ecb7fd */
+- for_each_new_crtc_in_state(state, crtc, crtc_state, i)
+- drm_crtc_vblank_get(crtc);
+ }
+
+ static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
+@@ -114,12 +107,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned crtc_mask)
+
+ static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
+ {
+- struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+- struct drm_crtc *crtc;
+-
+- /* see 119ecb7fd */
+- for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask)
+- drm_crtc_vblank_put(crtc);
+ }
+
+ static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,
+--
+2.30.2
+
--- /dev/null
+From 1e5a4db6f835382e7cf921e46d804518e92a8a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 18:55:07 +0200
+Subject: drm/omap: Follow implicit fencing in prepare_fb
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit 942d8344d5f14b9ea2ae43756f319b9f44216ba4 ]
+
+I guess no one ever tried running omap together with lima or panfrost,
+not even sure that's possible. Anyway for consistency, fix this.
+
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Cc: Tomi Valkeinen <tomba@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210622165511.3169559-12-daniel.vetter@ffwll.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_plane.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c b/drivers/gpu/drm/omapdrm/omap_plane.c
+index 801da917507d..512af976b7e9 100644
+--- a/drivers/gpu/drm/omapdrm/omap_plane.c
++++ b/drivers/gpu/drm/omapdrm/omap_plane.c
+@@ -6,6 +6,7 @@
+
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
++#include <drm/drm_gem_atomic_helper.h>
+ #include <drm/drm_plane_helper.h>
+
+ #include "omap_dmm_tiler.h"
+@@ -29,6 +30,8 @@ static int omap_plane_prepare_fb(struct drm_plane *plane,
+ if (!new_state->fb)
+ return 0;
+
++ drm_gem_plane_helper_prepare_fb(plane, new_state);
++
+ return omap_framebuffer_pin(new_state->fb);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 68c44cda594338a1b734ba29098689d40f5c000a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 23:36:18 +0200
+Subject: drm/panel: Fix up DT bindings for Samsung lms397kf04
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 710fa9aa16321f2ffdd8383f6f780c9cc1e5a197 ]
+
+Improve the bindings and make them more usable:
+
+- Pick in spi-cpha and spi-cpol from the SPI node parent,
+ this will specify that we are "type 3" in the device tree
+ rather than hardcoding it in the operating system.
+- Drop the u32 ref from the SPI frequency: comes in from
+ the SPI host bindings.
+- Make spi-cpha, spi-cpol and port compulsory.
+- Update the example with a real-world SPI controller,
+ spi-gpio.
+
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Cc: devicetree@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210701213618.3818821-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/panel/samsung,lms397kf04.yaml | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml b/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
+index 4cb75a5f2e3a..cd62968426fb 100644
+--- a/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
++++ b/Documentation/devicetree/bindings/display/panel/samsung,lms397kf04.yaml
+@@ -33,8 +33,11 @@ properties:
+
+ backlight: true
+
++ spi-cpha: true
++
++ spi-cpol: true
++
+ spi-max-frequency:
+- $ref: /schemas/types.yaml#/definitions/uint32
+ description: inherited as a SPI client node, the datasheet specifies
+ maximum 300 ns minimum cycle which gives around 3 MHz max frequency
+ maximum: 3000000
+@@ -44,6 +47,9 @@ properties:
+ required:
+ - compatible
+ - reg
++ - spi-cpha
++ - spi-cpol
++ - port
+
+ additionalProperties: false
+
+@@ -52,15 +58,23 @@ examples:
+ #include <dt-bindings/gpio/gpio.h>
+
+ spi {
++ compatible = "spi-gpio";
++ sck-gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
++ miso-gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
++ mosi-gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
++ cs-gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
++ num-chipselects = <1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ panel@0 {
+ compatible = "samsung,lms397kf04";
+ spi-max-frequency = <3000000>;
++ spi-cpha;
++ spi-cpol;
+ reg = <0>;
+ vci-supply = <&lcd_3v0_reg>;
+ vccio-supply = <&lcd_1v8_reg>;
+- reset-gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++ reset-gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+ backlight = <&ktd259>;
+
+ port {
+--
+2.30.2
+
--- /dev/null
+From b760f3b7d80c29d2affa165075849ca7db9c3fff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 12:35:08 +0800
+Subject: drm: protect drm_master pointers in drm_lease.c
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 56f0729a510f92151682ff6c89f69724d5595d6e ]
+
+drm_file->master pointers should be protected by
+drm_device.master_mutex or drm_file.master_lookup_lock when being
+dereferenced.
+
+However, in drm_lease.c, there are multiple instances where
+drm_file->master is accessed and dereferenced while neither lock is
+held. This makes drm_lease.c vulnerable to use-after-free bugs.
+
+We address this issue in 2 ways:
+
+1. Add a new drm_file_get_master() function that calls drm_master_get
+on drm_file->master while holding on to
+drm_file.master_lookup_lock. Since drm_master_get increments the
+reference count of master, this prevents master from being freed until
+we unreference it with drm_master_put.
+
+2. In each case where drm_file->master is directly accessed and
+eventually dereferenced in drm_lease.c, we wrap the access in a call
+to the new drm_file_get_master function, then unreference the master
+pointer once we are done using it.
+
+Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheongzx@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
+ drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
+ include/drm/drm_auth.h | 1 +
+ include/drm/drm_file.h | 6 +++
+ 4 files changed, 93 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index cbb896b91d94..3a298df00901 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -377,6 +377,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
+ }
+ EXPORT_SYMBOL(drm_master_get);
+
++/**
++ * drm_file_get_master - reference &drm_file.master of @file_priv
++ * @file_priv: DRM file private
++ *
++ * Increments the reference count of @file_priv's &drm_file.master and returns
++ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
++ *
++ * Master pointers returned from this function should be unreferenced using
++ * drm_master_put().
++ */
++struct drm_master *drm_file_get_master(struct drm_file *file_priv)
++{
++ struct drm_master *master = NULL;
++
++ spin_lock(&file_priv->master_lookup_lock);
++ if (!file_priv->master)
++ goto unlock;
++ master = drm_master_get(file_priv->master);
++
++unlock:
++ spin_unlock(&file_priv->master_lookup_lock);
++ return master;
++}
++EXPORT_SYMBOL(drm_file_get_master);
++
+ static void drm_master_destroy(struct kref *kref)
+ {
+ struct drm_master *master = container_of(kref, struct drm_master, refcount);
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index 00fb433bcef1..92eac73d9001 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
+ */
+ bool _drm_lease_held(struct drm_file *file_priv, int id)
+ {
+- if (!file_priv || !file_priv->master)
++ bool ret;
++ struct drm_master *master;
++
++ if (!file_priv)
+ return true;
+
+- return _drm_lease_held_master(file_priv->master, id);
++ master = drm_file_get_master(file_priv);
++ if (!master)
++ return true;
++ ret = _drm_lease_held_master(master, id);
++ drm_master_put(&master);
++
++ return ret;
+ }
+
+ /**
+@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
+ struct drm_master *master;
+ bool ret;
+
+- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
++ if (!file_priv)
+ return true;
+
+- master = file_priv->master;
++ master = drm_file_get_master(file_priv);
++ if (!master)
++ return true;
++ if (!master->lessor) {
++ ret = true;
++ goto out;
++ }
+ mutex_lock(&master->dev->mode_config.idr_mutex);
+ ret = _drm_lease_held_master(master, id);
+ mutex_unlock(&master->dev->mode_config.idr_mutex);
++
++out:
++ drm_master_put(&master);
+ return ret;
+ }
+
+@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
+ int count_in, count_out;
+ uint32_t crtcs_out = 0;
+
+- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
++ if (!file_priv)
+ return crtcs_in;
+
+- master = file_priv->master;
++ master = drm_file_get_master(file_priv);
++ if (!master)
++ return crtcs_in;
++ if (!master->lessor) {
++ crtcs_out = crtcs_in;
++ goto out;
++ }
+ dev = master->dev;
+
+ count_in = count_out = 0;
+@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
+ count_in++;
+ }
+ mutex_unlock(&master->dev->mode_config.idr_mutex);
++
++out:
++ drm_master_put(&master);
+ return crtcs_out;
+ }
+
+@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ size_t object_count;
+ int ret = 0;
+ struct idr leases;
+- struct drm_master *lessor = lessor_priv->master;
++ struct drm_master *lessor;
+ struct drm_master *lessee = NULL;
+ struct file *lessee_file = NULL;
+ struct file *lessor_file = lessor_priv->filp;
+@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EOPNOTSUPP;
+
+- /* Do not allow sub-leases */
+- if (lessor->lessor) {
+- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+- return -EINVAL;
+- }
+-
+ /* need some objects */
+ if (cl->object_count == 0) {
+ DRM_DEBUG_LEASE("no objects in lease\n");
+@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ return -EINVAL;
+ }
+
++ lessor = drm_file_get_master(lessor_priv);
++ /* Do not allow sub-leases */
++ if (lessor->lessor) {
++ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
++ ret = -EINVAL;
++ goto out_lessor;
++ }
++
+ object_count = cl->object_count;
+
+ object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
+ array_size(object_count, sizeof(__u32)));
+- if (IS_ERR(object_ids))
+- return PTR_ERR(object_ids);
++ if (IS_ERR(object_ids)) {
++ ret = PTR_ERR(object_ids);
++ goto out_lessor;
++ }
+
+ idr_init(&leases);
+
+@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ if (ret) {
+ DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
+ idr_destroy(&leases);
+- return ret;
++ goto out_lessor;
+ }
+
+ /* Allocate a file descriptor for the lease */
+ fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
+ if (fd < 0) {
+ idr_destroy(&leases);
+- return fd;
++ ret = fd;
++ goto out_lessor;
+ }
+
+ DRM_DEBUG_LEASE("Creating lease\n");
+@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ /* Hook up the fd */
+ fd_install(fd, lessee_file);
+
++ drm_master_put(&lessor);
+ DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
+ return 0;
+
+@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ out_leases:
+ put_unused_fd(fd);
+
++out_lessor:
++ drm_master_put(&lessor);
+ DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
+ return ret;
+ }
+@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
+ struct drm_mode_list_lessees *arg = data;
+ __u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
+ __u32 count_lessees = arg->count_lessees;
+- struct drm_master *lessor = lessor_priv->master, *lessee;
++ struct drm_master *lessor, *lessee;
+ int count;
+ int ret = 0;
+
+@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EOPNOTSUPP;
+
++ lessor = drm_file_get_master(lessor_priv);
+ DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
+
+ mutex_lock(&dev->mode_config.idr_mutex);
+@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
+ arg->count_lessees = count;
+
+ mutex_unlock(&dev->mode_config.idr_mutex);
++ drm_master_put(&lessor);
+
+ return ret;
+ }
+@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
+ struct drm_mode_get_lease *arg = data;
+ __u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
+ __u32 count_objects = arg->count_objects;
+- struct drm_master *lessee = lessee_priv->master;
++ struct drm_master *lessee;
+ struct idr *object_idr;
+ int count;
+ void *entry;
+@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EOPNOTSUPP;
+
++ lessee = drm_file_get_master(lessee_priv);
+ DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
+
+ mutex_lock(&dev->mode_config.idr_mutex);
+@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
+ arg->count_objects = count;
+
+ mutex_unlock(&dev->mode_config.idr_mutex);
++ drm_master_put(&lessee);
+
+ return ret;
+ }
+@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
+ void *data, struct drm_file *lessor_priv)
+ {
+ struct drm_mode_revoke_lease *arg = data;
+- struct drm_master *lessor = lessor_priv->master;
++ struct drm_master *lessor;
+ struct drm_master *lessee;
+ int ret = 0;
+
+@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EOPNOTSUPP;
+
++ lessor = drm_file_get_master(lessor_priv);
+ mutex_lock(&dev->mode_config.idr_mutex);
+
+ lessee = _drm_find_lessee(lessor, arg->lessee_id);
+@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
+
+ fail:
+ mutex_unlock(&dev->mode_config.idr_mutex);
++ drm_master_put(&lessor);
+
+ return ret;
+ }
+diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
+index 6bf8b2b78991..f99d3417f304 100644
+--- a/include/drm/drm_auth.h
++++ b/include/drm/drm_auth.h
+@@ -107,6 +107,7 @@ struct drm_master {
+ };
+
+ struct drm_master *drm_master_get(struct drm_master *master);
++struct drm_master *drm_file_get_master(struct drm_file *file_priv);
+ void drm_master_put(struct drm_master **master);
+ bool drm_is_current_master(struct drm_file *fpriv);
+
+diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
+index 9b82988e3427..726cfe0ff5f5 100644
+--- a/include/drm/drm_file.h
++++ b/include/drm/drm_file.h
+@@ -233,6 +233,12 @@ struct drm_file {
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
++ * When dereferencing this pointer, either hold struct
++ * &drm_device.master_mutex for the duration of the pointer's use, or
++ * use drm_file_get_master() if struct &drm_device.master_mutex is not
++ * currently held and there is no other need to hold it. This prevents
++ * @master from being freed during use.
++ *
+ * See also @authentication and @is_master and the :ref:`section on
+ * primary nodes and authentication <drm_primary_node>`.
+ */
+--
+2.30.2
+
--- /dev/null
+From 727e02914e8bc54ddddfc9485d0c4b4a5734e68f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 02:09:53 +0200
+Subject: drm: rcar-du: Shutdown the display on system shutdown
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 015f2ebb93767d40c442e749642fffaf10316d78 ]
+
+When the system shuts down or warm reboots, the display may be active,
+with the hardware accessing system memory. Upon reboot, the DDR will not
+be accessible, which may cause issues.
+
+Implement the platform_driver .shutdown() operation and shut down the
+display to fix this.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index c22551c2facb..2a06ec1cbefb 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -559,6 +559,13 @@ static int rcar_du_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rcar_du_shutdown(struct platform_device *pdev)
++{
++ struct rcar_du_device *rcdu = platform_get_drvdata(pdev);
++
++ drm_atomic_helper_shutdown(&rcdu->ddev);
++}
++
+ static int rcar_du_probe(struct platform_device *pdev)
+ {
+ struct rcar_du_device *rcdu;
+@@ -615,6 +622,7 @@ static int rcar_du_probe(struct platform_device *pdev)
+ static struct platform_driver rcar_du_platform_driver = {
+ .probe = rcar_du_probe,
+ .remove = rcar_du_remove,
++ .shutdown = rcar_du_shutdown,
+ .driver = {
+ .name = "rcar-du",
+ .pm = &rcar_du_pm_ops,
+--
+2.30.2
+
--- /dev/null
+From 44c16bba883371189ccff5d998bef1662844db2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 12:35:07 +0800
+Subject: drm: serialize drm_file.master with a new spinlock
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 ]
+
+Currently, drm_file.master pointers should be protected by
+drm_device.master_mutex when being dereferenced. This is because
+drm_file.master is not invariant for the lifetime of drm_file. If
+drm_file is not the creator of master, then drm_file.is_master is
+false, and a call to drm_setmaster_ioctl will invoke
+drm_new_set_master, which then allocates a new master for drm_file and
+puts the old master.
+
+Thus, without holding drm_device.master_mutex, the old value of
+drm_file.master could be freed while it is being used by another
+concurrent process.
+
+However, it is not always possible to lock drm_device.master_mutex to
+dereference drm_file.master. Through the fbdev emulation code, this
+might occur in a deep nest of other locks. But drm_device.master_mutex
+is also the outermost lock in the nesting hierarchy, so this leads to
+potential deadlocks.
+
+To address this, we introduce a new spin lock at the bottom of the
+lock hierarchy that only serializes drm_file.master. With this change,
+the value of drm_file.master changes only when both
+drm_device.master_mutex and drm_file.master_lookup_lock are
+held. Hence, any process holding either of those locks can ensure that
+the value of drm_file.master will not change concurrently.
+
+Since no lock depends on the new drm_file.master_lookup_lock, when
+drm_file.master is dereferenced, but drm_device.master_mutex cannot be
+held, we can safely protect the master pointer with
+drm_file.master_lookup_lock.
+
+Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-5-desmondcheongzx@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_auth.c | 17 +++++++++++------
+ drivers/gpu/drm/drm_file.c | 1 +
+ include/drm/drm_file.h | 12 +++++++++---
+ 3 files changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index b59b26a71ad5..cbb896b91d94 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -135,16 +135,18 @@ static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv,
+ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
+ {
+ struct drm_master *old_master;
++ struct drm_master *new_master;
+
+ lockdep_assert_held_once(&dev->master_mutex);
+
+ WARN_ON(fpriv->is_master);
+ old_master = fpriv->master;
+- fpriv->master = drm_master_create(dev);
+- if (!fpriv->master) {
+- fpriv->master = old_master;
++ new_master = drm_master_create(dev);
++ if (!new_master)
+ return -ENOMEM;
+- }
++ spin_lock(&fpriv->master_lookup_lock);
++ fpriv->master = new_master;
++ spin_unlock(&fpriv->master_lookup_lock);
+
+ fpriv->is_master = 1;
+ fpriv->authenticated = 1;
+@@ -303,10 +305,13 @@ int drm_master_open(struct drm_file *file_priv)
+ * any master object for render clients
+ */
+ mutex_lock(&dev->master_mutex);
+- if (!dev->master)
++ if (!dev->master) {
+ ret = drm_new_set_master(dev, file_priv);
+- else
++ } else {
++ spin_lock(&file_priv->master_lookup_lock);
+ file_priv->master = drm_master_get(dev->master);
++ spin_unlock(&file_priv->master_lookup_lock);
++ }
+ mutex_unlock(&dev->master_mutex);
+
+ return ret;
+diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
+index d4f0bac6f8f8..ceb1a9723855 100644
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -176,6 +176,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
+ init_waitqueue_head(&file->event_wait);
+ file->event_space = 4096; /* set aside 4k for event buffer */
+
++ spin_lock_init(&file->master_lookup_lock);
+ mutex_init(&file->event_read_lock);
+
+ if (drm_core_check_feature(dev, DRIVER_GEM))
+diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
+index b81b3bfb08c8..9b82988e3427 100644
+--- a/include/drm/drm_file.h
++++ b/include/drm/drm_file.h
+@@ -226,15 +226,21 @@ struct drm_file {
+ /**
+ * @master:
+ *
+- * Master this node is currently associated with. Only relevant if
+- * drm_is_primary_client() returns true. Note that this only
+- * matches &drm_device.master if the master is the currently active one.
++ * Master this node is currently associated with. Protected by struct
++ * &drm_device.master_mutex, and serialized by @master_lookup_lock.
++ *
++ * Only relevant if drm_is_primary_client() returns true. Note that
++ * this only matches &drm_device.master if the master is the currently
++ * active one.
+ *
+ * See also @authentication and @is_master and the :ref:`section on
+ * primary nodes and authentication <drm_primary_node>`.
+ */
+ struct drm_master *master;
+
++ /** @master_lock: Serializes @master. */
++ spinlock_t master_lookup_lock;
++
+ /** @pid: Process that opened this file. */
+ struct pid *pid;
+
+--
+2.30.2
+
--- /dev/null
+From 2f47ed58c649b9894565f2f8f9f046dc6fcd94b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 12:23:39 -0400
+Subject: drm/ttm: Fix multihop assert on eviction.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+
+[ Upstream commit 403797925768d9fa870f5b1ebcd20016b397083b ]
+
+Problem:
+Under memory pressure when GTT domain is almost full multihop assert
+will come up when trying to evict LRU BO from VRAM to SYSTEM.
+
+Fix:
+Don't assert on multihop error in evict code but rather do a retry
+as we do in ttm_bo_move_buffer
+
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210622162339.761651-6-andrey.grodzovsky@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 63 +++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 8d7fd65ccced..32202385073a 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -488,6 +488,31 @@ void ttm_bo_unlock_delayed_workqueue(struct ttm_device *bdev, int resched)
+ }
+ EXPORT_SYMBOL(ttm_bo_unlock_delayed_workqueue);
+
++static int ttm_bo_bounce_temp_buffer(struct ttm_buffer_object *bo,
++ struct ttm_resource **mem,
++ struct ttm_operation_ctx *ctx,
++ struct ttm_place *hop)
++{
++ struct ttm_placement hop_placement;
++ struct ttm_resource *hop_mem;
++ int ret;
++
++ hop_placement.num_placement = hop_placement.num_busy_placement = 1;
++ hop_placement.placement = hop_placement.busy_placement = hop;
++
++ /* find space in the bounce domain */
++ ret = ttm_bo_mem_space(bo, &hop_placement, &hop_mem, ctx);
++ if (ret)
++ return ret;
++ /* move to the bounce domain */
++ ret = ttm_bo_handle_move_mem(bo, hop_mem, false, ctx, NULL);
++ if (ret) {
++ ttm_resource_free(bo, &hop_mem);
++ return ret;
++ }
++ return 0;
++}
++
+ static int ttm_bo_evict(struct ttm_buffer_object *bo,
+ struct ttm_operation_ctx *ctx)
+ {
+@@ -527,12 +552,17 @@ static int ttm_bo_evict(struct ttm_buffer_object *bo,
+ goto out;
+ }
+
++bounce:
+ ret = ttm_bo_handle_move_mem(bo, evict_mem, true, ctx, &hop);
+- if (unlikely(ret)) {
+- WARN(ret == -EMULTIHOP, "Unexpected multihop in eviction - likely driver bug\n");
+- if (ret != -ERESTARTSYS)
++ if (ret == -EMULTIHOP) {
++ ret = ttm_bo_bounce_temp_buffer(bo, &evict_mem, ctx, &hop);
++ if (ret) {
+ pr_err("Buffer eviction failed\n");
+- ttm_resource_free(bo, &evict_mem);
++ ttm_resource_free(bo, &evict_mem);
++ goto out;
++ }
++ /* try and move to final place now. */
++ goto bounce;
+ }
+ out:
+ return ret;
+@@ -847,31 +877,6 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
+ }
+ EXPORT_SYMBOL(ttm_bo_mem_space);
+
+-static int ttm_bo_bounce_temp_buffer(struct ttm_buffer_object *bo,
+- struct ttm_resource **mem,
+- struct ttm_operation_ctx *ctx,
+- struct ttm_place *hop)
+-{
+- struct ttm_placement hop_placement;
+- struct ttm_resource *hop_mem;
+- int ret;
+-
+- hop_placement.num_placement = hop_placement.num_busy_placement = 1;
+- hop_placement.placement = hop_placement.busy_placement = hop;
+-
+- /* find space in the bounce domain */
+- ret = ttm_bo_mem_space(bo, &hop_placement, &hop_mem, ctx);
+- if (ret)
+- return ret;
+- /* move to the bounce domain */
+- ret = ttm_bo_handle_move_mem(bo, hop_mem, false, ctx, NULL);
+- if (ret) {
+- ttm_resource_free(bo, &hop_mem);
+- return ret;
+- }
+- return 0;
+-}
+-
+ static int ttm_bo_move_buffer(struct ttm_buffer_object *bo,
+ struct ttm_placement *placement,
+ struct ttm_operation_ctx *ctx)
+--
+2.30.2
+
--- /dev/null
+From d822bfa73fc80d27193ed836d2f4352ec266ccc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 15:05:33 +0200
+Subject: drm: vc4: Fix pixel-wrap issue with DVP teardown
+
+From: Tim Gover <tim.gover@raspberrypi.com>
+
+[ Upstream commit 0b066a6809d0f8fd9868e383add36aa5a2fa409d ]
+
+Adjust the DVP enable/disable sequence to avoid a pixel getting stuck
+in an internal, non resettable FIFO within PixelValve when changing
+HDMI resolution.
+
+The blank pixels features of the DVP can prevent signals back to
+pixelvalve causing it to not clear the FIFO. Adjust the ordering
+and timing of operations to ensure the clear signal makes it through to
+pixelvalve.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210628130533.144617-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index ad92dbb128b3..f91d37beb113 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -613,12 +613,12 @@ static void vc4_hdmi_encoder_post_crtc_disable(struct drm_encoder *encoder,
+
+ HDMI_WRITE(HDMI_RAM_PACKET_CONFIG, 0);
+
+- HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) |
+- VC4_HD_VID_CTL_CLRRGB | VC4_HD_VID_CTL_CLRSYNC);
++ HDMI_WRITE(HDMI_VID_CTL, HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_CLRRGB);
+
+- HDMI_WRITE(HDMI_VID_CTL,
+- HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_BLANKPIX);
++ mdelay(1);
+
++ HDMI_WRITE(HDMI_VID_CTL,
++ HDMI_READ(HDMI_VID_CTL) & ~VC4_HD_VID_CTL_ENABLE);
+ vc4_hdmi_disable_scrambling(encoder);
+ }
+
+@@ -628,12 +628,12 @@ static void vc4_hdmi_encoder_post_crtc_powerdown(struct drm_encoder *encoder,
+ struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder);
+ int ret;
+
++ HDMI_WRITE(HDMI_VID_CTL,
++ HDMI_READ(HDMI_VID_CTL) | VC4_HD_VID_CTL_BLANKPIX);
++
+ if (vc4_hdmi->variant->phy_disable)
+ vc4_hdmi->variant->phy_disable(vc4_hdmi);
+
+- HDMI_WRITE(HDMI_VID_CTL,
+- HDMI_READ(HDMI_VID_CTL) & ~VC4_HD_VID_CTL_ENABLE);
+-
+ clk_disable_unprepare(vc4_hdmi->pixel_bvb_clock);
+ clk_disable_unprepare(vc4_hdmi->pixel_clock);
+
+@@ -1015,6 +1015,7 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct drm_encoder *encoder,
+
+ HDMI_WRITE(HDMI_VID_CTL,
+ VC4_HD_VID_CTL_ENABLE |
++ VC4_HD_VID_CTL_CLRRGB |
+ VC4_HD_VID_CTL_UNDERFLOW_ENABLE |
+ VC4_HD_VID_CTL_FRAME_COUNTER_RESET |
+ (vsync_pos ? 0 : VC4_HD_VID_CTL_VSYNC_LOW) |
+--
+2.30.2
+
--- /dev/null
+From 043d5ab217613790b34bfafc1957172af554876e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 15:23:48 +0200
+Subject: drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]
+
+Symptom is random switching of speakers when using multichannel.
+
+Repeatedly running speakertest -c8 occasionally starts with
+channels jumbled. This is fixed with HD_CTL_WHOLSMP.
+
+The other bit looks beneficial and apears harmless in testing so
+I'd suggest adding it too.
+
+Documentation says: HD_CTL_WHILSMP_SET
+Wait for whole sample. When this bit is set MAI transmit will start
+only when there is at least one whole sample available in the fifo.
+
+Documentation says: HD_CTL_CHALIGN_SET
+Channel Align When Overflow. This bit is used to realign the audio
+channels in case of an overflow.
+If this bit is set, after the detection of an overflow, equal
+amount of dummy words to the missing words will be written to fifo,
+filling up the broken sample and maintaining alignment.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210525132354.297468-7-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index c2876731ee2d..ad92dbb128b3 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1372,7 +1372,9 @@ static int vc4_hdmi_audio_trigger(struct snd_pcm_substream *substream, int cmd,
+ HDMI_WRITE(HDMI_MAI_CTL,
+ VC4_SET_FIELD(vc4_hdmi->audio.channels,
+ VC4_HD_MAI_CTL_CHNUM) |
+- VC4_HD_MAI_CTL_ENABLE);
++ VC4_HD_MAI_CTL_WHOLSMP |
++ VC4_HD_MAI_CTL_CHALIGN |
++ VC4_HD_MAI_CTL_ENABLE);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ HDMI_WRITE(HDMI_MAI_CTL,
+--
+2.30.2
+
--- /dev/null
+From be32fcb8098d5cc4312ebf2bb80139c458ac886a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 09:46:32 +0200
+Subject: drm/vkms: Let shadow-plane helpers prepare the plane's FB
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit b43e2ec03b0de040d536591713ea9c875ff34ba9 ]
+
+Replace vkms' prepare_fb and cleanup_fb functions with the generic
+code for shadow-buffered planes. No functional changes.
+
+This change also fixes a problem where IGT kms_flip tests would
+create a segmentation fault within vkms. The driver's prepare_fb
+function did not report an error if a BO's vmap operation failed.
+The kernel later tried to operate on the non-mapped memory areas.
+The shared shadow-plane helpers handle errors correctly, so that
+the driver now avoids the segmantation fault.
+
+v2:
+ * include paragraph about IGT tests in commit message (Melissa)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210705074633.9425-4-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_plane.c | 38 +------------------------------
+ 1 file changed, 1 insertion(+), 37 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
+index 107521ace597..092514a2155f 100644
+--- a/drivers/gpu/drm/vkms/vkms_plane.c
++++ b/drivers/gpu/drm/vkms/vkms_plane.c
+@@ -8,7 +8,6 @@
+ #include <drm/drm_gem_atomic_helper.h>
+ #include <drm/drm_gem_framebuffer_helper.h>
+ #include <drm/drm_plane_helper.h>
+-#include <drm/drm_gem_shmem_helper.h>
+
+ #include "vkms_drv.h"
+
+@@ -150,45 +149,10 @@ static int vkms_plane_atomic_check(struct drm_plane *plane,
+ return 0;
+ }
+
+-static int vkms_prepare_fb(struct drm_plane *plane,
+- struct drm_plane_state *state)
+-{
+- struct drm_gem_object *gem_obj;
+- struct dma_buf_map map;
+- int ret;
+-
+- if (!state->fb)
+- return 0;
+-
+- gem_obj = drm_gem_fb_get_obj(state->fb, 0);
+- ret = drm_gem_shmem_vmap(gem_obj, &map);
+- if (ret)
+- DRM_ERROR("vmap failed: %d\n", ret);
+-
+- return drm_gem_plane_helper_prepare_fb(plane, state);
+-}
+-
+-static void vkms_cleanup_fb(struct drm_plane *plane,
+- struct drm_plane_state *old_state)
+-{
+- struct drm_gem_object *gem_obj;
+- struct drm_gem_shmem_object *shmem_obj;
+- struct dma_buf_map map;
+-
+- if (!old_state->fb)
+- return;
+-
+- gem_obj = drm_gem_fb_get_obj(old_state->fb, 0);
+- shmem_obj = to_drm_gem_shmem_obj(drm_gem_fb_get_obj(old_state->fb, 0));
+- dma_buf_map_set_vaddr(&map, shmem_obj->vaddr);
+- drm_gem_shmem_vunmap(gem_obj, &map);
+-}
+-
+ static const struct drm_plane_helper_funcs vkms_primary_helper_funcs = {
+ .atomic_update = vkms_plane_atomic_update,
+ .atomic_check = vkms_plane_atomic_check,
+- .prepare_fb = vkms_prepare_fb,
+- .cleanup_fb = vkms_cleanup_fb,
++ DRM_GEM_SHADOW_PLANE_HELPER_FUNCS,
+ };
+
+ struct vkms_plane *vkms_plane_init(struct vkms_device *vkmsdev,
+--
+2.30.2
+
--- /dev/null
+From e4b62170fce1c4aa3b6db24b6db24991427a07ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Jul 2021 19:18:24 +0800
+Subject: drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f ]
+
+drm_file.master should be protected by either drm_device.master_mutex
+or drm_file.master_lookup_lock when being dereferenced. However,
+drm_master_get is called on unprotected file_priv->master pointers in
+vmw_surface_define_ioctl and vmw_gb_surface_define_internal.
+
+This is fixed by replacing drm_master_get with drm_file_get_master.
+
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Zack Rusin <zackr@vmware.com>
+Signed-off-by: Zack Rusin <zackr@vmware.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheongzx@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+index 47c03a276515..a04ad7812960 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -865,7 +865,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
+ user_srf->prime.base.shareable = false;
+ user_srf->prime.base.tfile = NULL;
+ if (drm_is_primary_client(file_priv))
+- user_srf->master = drm_master_get(file_priv->master);
++ user_srf->master = drm_file_get_master(file_priv);
+
+ /**
+ * From this point, the generic resource management functions
+@@ -1534,7 +1534,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
+
+ user_srf = container_of(srf, struct vmw_user_surface, srf);
+ if (drm_is_primary_client(file_priv))
+- user_srf->master = drm_master_get(file_priv->master);
++ user_srf->master = drm_file_get_master(file_priv);
+
+ res = &user_srf->srf.res;
+
+--
+2.30.2
+
--- /dev/null
+From 3754c4b48bfc07ac56f0f080f49ee6179da5248f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jun 2021 13:23:02 -0400
+Subject: drm/vmwgfx: Fix some static checker warnings
+
+From: Zack Rusin <zackr@vmware.com>
+
+[ Upstream commit 74231041d14030f1ae6582b9233bfe782ac23e33 ]
+
+Fix some minor issues that Coverity spotted in the code. None
+of that are serious but they're all valid concerns so fixing
+them makes sense.
+
+Signed-off-by: Zack Rusin <zackr@vmware.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Reviewed-by: Martin Krastev <krastevm@vmware.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-5-zackr@vmware.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/ttm_memory.c | 2 ++
+ drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++++++++------------
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 2 +-
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +++-
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 ++
+ drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +++-
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 ++++--
+ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 8 ++++++--
+ drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 ++-
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 ++--
+ 10 files changed, 33 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/ttm_memory.c b/drivers/gpu/drm/vmwgfx/ttm_memory.c
+index aeb0a22a2c34..edd17c30d5a5 100644
+--- a/drivers/gpu/drm/vmwgfx/ttm_memory.c
++++ b/drivers/gpu/drm/vmwgfx/ttm_memory.c
+@@ -435,8 +435,10 @@ int ttm_mem_global_init(struct ttm_mem_global *glob, struct device *dev)
+
+ si_meminfo(&si);
+
++ spin_lock(&glob->lock);
+ /* set it as 0 by default to keep original behavior of OOM */
+ glob->lower_mem_limit = 0;
++ spin_unlock(&glob->lock);
+
+ ret = ttm_mem_init_kernel_zone(glob, &si);
+ if (unlikely(ret != 0))
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
+index 05b324825900..ea6d8c86985f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_binding.c
+@@ -715,7 +715,7 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo *bi, bool rebind)
+ * without checking which bindings actually need to be emitted
+ *
+ * @cbs: Pointer to the context's struct vmw_ctx_binding_state
+- * @bi: Pointer to where the binding info array is stored in @cbs
++ * @biv: Pointer to where the binding info array is stored in @cbs
+ * @max_num: Maximum number of entries in the @bi array.
+ *
+ * Scans the @bi array for bindings and builds a buffer of view id data.
+@@ -725,11 +725,9 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo *bi, bool rebind)
+ * contains the command data.
+ */
+ static void vmw_collect_view_ids(struct vmw_ctx_binding_state *cbs,
+- const struct vmw_ctx_bindinfo *bi,
++ const struct vmw_ctx_bindinfo_view *biv,
+ u32 max_num)
+ {
+- const struct vmw_ctx_bindinfo_view *biv =
+- container_of(bi, struct vmw_ctx_bindinfo_view, bi);
+ unsigned long i;
+
+ cbs->bind_cmd_count = 0;
+@@ -838,7 +836,7 @@ static int vmw_emit_set_sr(struct vmw_ctx_binding_state *cbs,
+ */
+ static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)
+ {
+- const struct vmw_ctx_bindinfo *loc = &cbs->render_targets[0].bi;
++ const struct vmw_ctx_bindinfo_view *loc = &cbs->render_targets[0];
+ struct {
+ SVGA3dCmdHeader header;
+ SVGA3dCmdDXSetRenderTargets body;
+@@ -874,7 +872,7 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)
+ * without checking which bindings actually need to be emitted
+ *
+ * @cbs: Pointer to the context's struct vmw_ctx_binding_state
+- * @bi: Pointer to where the binding info array is stored in @cbs
++ * @biso: Pointer to where the binding info array is stored in @cbs
+ * @max_num: Maximum number of entries in the @bi array.
+ *
+ * Scans the @bi array for bindings and builds a buffer of SVGA3dSoTarget data.
+@@ -884,11 +882,9 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)
+ * contains the command data.
+ */
+ static void vmw_collect_so_targets(struct vmw_ctx_binding_state *cbs,
+- const struct vmw_ctx_bindinfo *bi,
++ const struct vmw_ctx_bindinfo_so_target *biso,
+ u32 max_num)
+ {
+- const struct vmw_ctx_bindinfo_so_target *biso =
+- container_of(bi, struct vmw_ctx_bindinfo_so_target, bi);
+ unsigned long i;
+ SVGA3dSoTarget *so_buffer = (SVGA3dSoTarget *) cbs->bind_cmd_buffer;
+
+@@ -919,7 +915,7 @@ static void vmw_collect_so_targets(struct vmw_ctx_binding_state *cbs,
+ */
+ static int vmw_emit_set_so_target(struct vmw_ctx_binding_state *cbs)
+ {
+- const struct vmw_ctx_bindinfo *loc = &cbs->so_targets[0].bi;
++ const struct vmw_ctx_bindinfo_so_target *loc = &cbs->so_targets[0];
+ struct {
+ SVGA3dCmdHeader header;
+ SVGA3dCmdDXSetSOTargets body;
+@@ -1066,7 +1062,7 @@ static int vmw_emit_set_vb(struct vmw_ctx_binding_state *cbs)
+
+ static int vmw_emit_set_uav(struct vmw_ctx_binding_state *cbs)
+ {
+- const struct vmw_ctx_bindinfo *loc = &cbs->ua_views[0].views[0].bi;
++ const struct vmw_ctx_bindinfo_view *loc = &cbs->ua_views[0].views[0];
+ struct {
+ SVGA3dCmdHeader header;
+ SVGA3dCmdDXSetUAViews body;
+@@ -1096,7 +1092,7 @@ static int vmw_emit_set_uav(struct vmw_ctx_binding_state *cbs)
+
+ static int vmw_emit_set_cs_uav(struct vmw_ctx_binding_state *cbs)
+ {
+- const struct vmw_ctx_bindinfo *loc = &cbs->ua_views[1].views[0].bi;
++ const struct vmw_ctx_bindinfo_view *loc = &cbs->ua_views[1].views[0];
+ struct {
+ SVGA3dCmdHeader header;
+ SVGA3dCmdDXSetCSUAViews body;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+index 6bb4961e64a5..9656d4a2abff 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+@@ -516,7 +516,7 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ struct vmw_cmdbuf_man *man =
+ container_of(work, struct vmw_cmdbuf_man, work);
+ struct vmw_cmdbuf_header *entry, *next;
+- uint32_t dummy;
++ uint32_t dummy = 0;
+ bool send_fence = false;
+ struct list_head restart_head[SVGA_CB_CONTEXT_MAX];
+ int i;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index b262d61d839d..9487faff5229 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -159,6 +159,7 @@ void vmw_cmdbuf_res_commit(struct list_head *list)
+ void vmw_cmdbuf_res_revert(struct list_head *list)
+ {
+ struct vmw_cmdbuf_res *entry, *next;
++ int ret;
+
+ list_for_each_entry_safe(entry, next, list, head) {
+ switch (entry->state) {
+@@ -166,7 +167,8 @@ void vmw_cmdbuf_res_revert(struct list_head *list)
+ vmw_cmdbuf_res_free(entry->man, entry);
+ break;
+ case VMW_CMDBUF_RES_DEL:
+- drm_ht_insert_item(&entry->man->resources, &entry->hash);
++ ret = drm_ht_insert_item(&entry->man->resources, &entry->hash);
++ BUG_ON(ret);
+ list_del(&entry->head);
+ list_add_tail(&entry->head, &entry->man->list);
+ entry->state = VMW_CMDBUF_RES_COMMITTED;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index a2b8464b3f56..06e8332682c5 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -2546,6 +2546,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv,
+
+ so_type = vmw_so_cmd_to_type(header->id);
+ res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);
++ if (IS_ERR(res))
++ return PTR_ERR(res);
+ cmd = container_of(header, typeof(*cmd), header);
+ ret = vmw_cotable_notify(res, cmd->defined_id);
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+index f2d625415458..2d8caf09f172 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+@@ -506,11 +506,13 @@ static void vmw_mob_pt_setup(struct vmw_mob *mob,
+ {
+ unsigned long num_pt_pages = 0;
+ struct ttm_buffer_object *bo = mob->pt_bo;
+- struct vmw_piter save_pt_iter;
++ struct vmw_piter save_pt_iter = {0};
+ struct vmw_piter pt_iter;
+ const struct vmw_sg_table *vsgt;
+ int ret;
+
++ BUG_ON(num_data_pages == 0);
++
+ ret = ttm_bo_reserve(bo, false, true, NULL);
+ BUG_ON(ret != 0);
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index 3d08f5700bdb..7e3f99722d02 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -155,6 +155,7 @@ static unsigned long vmw_port_hb_out(struct rpc_channel *channel,
+ /* HB port can't access encrypted memory. */
+ if (hb && !mem_encrypt_active()) {
+ unsigned long bp = channel->cookie_high;
++ u32 channel_id = (channel->channel_id << 16);
+
+ si = (uintptr_t) msg;
+ di = channel->cookie_low;
+@@ -162,7 +163,7 @@ static unsigned long vmw_port_hb_out(struct rpc_channel *channel,
+ VMW_PORT_HB_OUT(
+ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+ msg_len, si, di,
+- VMWARE_HYPERVISOR_HB | (channel->channel_id << 16) |
++ VMWARE_HYPERVISOR_HB | channel_id |
+ VMWARE_HYPERVISOR_OUT,
+ VMW_HYPERVISOR_MAGIC, bp,
+ eax, ebx, ecx, edx, si, di);
+@@ -210,6 +211,7 @@ static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,
+ /* HB port can't access encrypted memory */
+ if (hb && !mem_encrypt_active()) {
+ unsigned long bp = channel->cookie_low;
++ u32 channel_id = (channel->channel_id << 16);
+
+ si = channel->cookie_high;
+ di = (uintptr_t) reply;
+@@ -217,7 +219,7 @@ static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,
+ VMW_PORT_HB_IN(
+ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+ reply_len, si, di,
+- VMWARE_HYPERVISOR_HB | (channel->channel_id << 16),
++ VMWARE_HYPERVISOR_HB | channel_id,
+ VMW_HYPERVISOR_MAGIC, bp,
+ eax, ebx, ecx, edx, si, di);
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+index 7b45393ad98e..3b6f6044c325 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+@@ -114,6 +114,7 @@ static void vmw_resource_release(struct kref *kref)
+ container_of(kref, struct vmw_resource, kref);
+ struct vmw_private *dev_priv = res->dev_priv;
+ int id;
++ int ret;
+ struct idr *idr = &dev_priv->res_idr[res->func->res_type];
+
+ spin_lock(&dev_priv->resource_lock);
+@@ -122,7 +123,8 @@ static void vmw_resource_release(struct kref *kref)
+ if (res->backup) {
+ struct ttm_buffer_object *bo = &res->backup->base;
+
+- ttm_bo_reserve(bo, false, false, NULL);
++ ret = ttm_bo_reserve(bo, false, false, NULL);
++ BUG_ON(ret);
+ if (vmw_resource_mob_attached(res) &&
+ res->func->unbind != NULL) {
+ struct ttm_validate_buffer val_buf;
+@@ -1001,7 +1003,9 @@ int vmw_resource_pin(struct vmw_resource *res, bool interruptible)
+ if (res->backup) {
+ vbo = res->backup;
+
+- ttm_bo_reserve(&vbo->base, interruptible, false, NULL);
++ ret = ttm_bo_reserve(&vbo->base, interruptible, false, NULL);
++ if (ret)
++ goto out_no_validate;
+ if (!vbo->base.pin_count) {
+ ret = ttm_bo_validate
+ (&vbo->base,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_so.c b/drivers/gpu/drm/vmwgfx/vmwgfx_so.c
+index c3a8d6e8380e..9efb4463ce99 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_so.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_so.c
+@@ -539,7 +539,8 @@ const SVGACOTableType vmw_so_cotables[] = {
+ [vmw_so_ds] = SVGA_COTABLE_DEPTHSTENCIL,
+ [vmw_so_rs] = SVGA_COTABLE_RASTERIZERSTATE,
+ [vmw_so_ss] = SVGA_COTABLE_SAMPLER,
+- [vmw_so_so] = SVGA_COTABLE_STREAMOUTPUT
++ [vmw_so_so] = SVGA_COTABLE_STREAMOUTPUT,
++ [vmw_so_max]= SVGA_COTABLE_MAX
+ };
+
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index 8338b1d20f2a..b09094b50c5d 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -586,13 +586,13 @@ int vmw_validation_bo_validate(struct vmw_validation_context *ctx, bool intr)
+ container_of(entry->base.bo, typeof(*vbo), base);
+
+ if (entry->cpu_blit) {
+- struct ttm_operation_ctx ctx = {
++ struct ttm_operation_ctx ttm_ctx = {
+ .interruptible = intr,
+ .no_wait_gpu = false
+ };
+
+ ret = ttm_bo_validate(entry->base.bo,
+- &vmw_nonfixed_placement, &ctx);
++ &vmw_nonfixed_placement, &ttm_ctx);
+ } else {
+ ret = vmw_validation_bo_validate_single
+ (entry->base.bo, intr, entry->as_mob);
+--
+2.30.2
+
--- /dev/null
+From 458800015ec19d1c8a01fb9f26bd8dbbc53cff6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jun 2021 13:23:01 -0400
+Subject: drm/vmwgfx: Fix subresource updates with new contexts
+
+From: Zack Rusin <zackr@vmware.com>
+
+[ Upstream commit a12be0277316ed923411c9c80b2899ee74d2b033 ]
+
+The has_dx variable was only set during the initialization which
+meant that UPDATE_SUBRESOURCE was never used. We were emulating it
+with UPDATE_GB_IMAGE but that's always been a stop-gap. Instead
+of has_dx which has been deprecated a long time ago we need to check
+for whether shader model 4.0 or newer is available to the device.
+
+Signed-off-by: Zack Rusin <zackr@vmware.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Reviewed-by: Martin Krastev <krastevm@vmware.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-4-zackr@vmware.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+index 0835468bb2ee..47c03a276515 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -1872,7 +1872,6 @@ static void vmw_surface_dirty_range_add(struct vmw_resource *res, size_t start,
+ static int vmw_surface_dirty_sync(struct vmw_resource *res)
+ {
+ struct vmw_private *dev_priv = res->dev_priv;
+- bool has_dx = 0;
+ u32 i, num_dirty;
+ struct vmw_surface_dirty *dirty =
+ (struct vmw_surface_dirty *) res->dirty;
+@@ -1899,7 +1898,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource *res)
+ if (!num_dirty)
+ goto out;
+
+- alloc_size = num_dirty * ((has_dx) ? sizeof(*cmd1) : sizeof(*cmd2));
++ alloc_size = num_dirty * ((has_sm4_context(dev_priv)) ? sizeof(*cmd1) : sizeof(*cmd2));
+ cmd = VMW_CMD_RESERVE(dev_priv, alloc_size);
+ if (!cmd)
+ return -ENOMEM;
+@@ -1917,7 +1916,7 @@ static int vmw_surface_dirty_sync(struct vmw_resource *res)
+ * DX_UPDATE_SUBRESOURCE is aware of array surfaces.
+ * UPDATE_GB_IMAGE is not.
+ */
+- if (has_dx) {
++ if (has_sm4_context(dev_priv)) {
+ cmd1->header.id = SVGA_3D_CMD_DX_UPDATE_SUBRESOURCE;
+ cmd1->header.size = sizeof(cmd1->body);
+ cmd1->body.sid = res->id;
+--
+2.30.2
+
--- /dev/null
+From 2c72d58c0f5c87919869507568e65f136be7c2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 10:55:01 +0800
+Subject: drm: xlnx: zynqmp: release reset to DP controller before accessing DP
+ registers
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a338619bd76011035d462f0f9e8b2f24d7fe5a1e ]
+
+When insmod zynqmp-dpsub.ko after rmmod it, system will hang with the
+error log as below:
+
+root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
+[ 88.391289] [drm] Initialized zynqmp-dpsub 1.0.0 20130509 for fd4a0000.display on minor 0
+[ 88.529906] Console: switching to colour frame buffer device 128x48
+[ 88.549402] zynqmp-dpsub fd4a0000.display: [drm] fb0: zynqmp-dpsubdrm frame buffer device
+[ 88.571624] zynqmp-dpsub fd4a0000.display: ZynqMP DisplayPort Subsystem driver probed
+root@xilinx-zynqmp:~# rmmod zynqmp_dpsub
+[ 94.023404] Console: switching to colour dummy device 80x25
+root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
+ <hang here>
+
+This is because that in zynqmp_dp_probe it tries to access some DP
+registers while the DP controller is still in the reset state. When
+running "rmmod zynqmp_dpsub", zynqmp_dp_reset(dp, true) in
+zynqmp_dp_phy_exit is called to force the DP controller into the reset
+state. Then insmod will call zynqmp_dp_probe to program the DP registers,
+but at this moment the DP controller hasn't been brought out of the reset
+state yet since the function zynqmp_dp_reset(dp, false) is called later and
+this will result the system hang.
+
+Releasing the reset to DP controller before any read/write operation to it
+will fix this issue. And for symmetry, move zynqmp_dp_reset() call from
+zynqmp_dp_phy_exit() to zynqmp_dp_remove().
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_dp.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
+index 82430ca9b913..6f588dc09ba6 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
+@@ -402,10 +402,6 @@ static int zynqmp_dp_phy_init(struct zynqmp_dp *dp)
+ }
+ }
+
+- ret = zynqmp_dp_reset(dp, false);
+- if (ret < 0)
+- return ret;
+-
+ zynqmp_dp_clr(dp, ZYNQMP_DP_PHY_RESET, ZYNQMP_DP_PHY_RESET_ALL_RESET);
+
+ /*
+@@ -441,8 +437,6 @@ static void zynqmp_dp_phy_exit(struct zynqmp_dp *dp)
+ ret);
+ }
+
+- zynqmp_dp_reset(dp, true);
+-
+ for (i = 0; i < dp->num_lanes; i++) {
+ ret = phy_exit(dp->phy[i]);
+ if (ret)
+@@ -1683,9 +1677,13 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
+ return PTR_ERR(dp->reset);
+ }
+
++ ret = zynqmp_dp_reset(dp, false);
++ if (ret < 0)
++ return ret;
++
+ ret = zynqmp_dp_phy_probe(dp);
+ if (ret)
+- return ret;
++ goto err_reset;
+
+ /* Initialize the hardware. */
+ zynqmp_dp_write(dp, ZYNQMP_DP_TX_PHY_POWER_DOWN,
+@@ -1697,7 +1695,7 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
+
+ ret = zynqmp_dp_phy_init(dp);
+ if (ret)
+- return ret;
++ goto err_reset;
+
+ zynqmp_dp_write(dp, ZYNQMP_DP_TRANSMITTER_ENABLE, 1);
+
+@@ -1709,15 +1707,18 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
+ zynqmp_dp_irq_handler, IRQF_ONESHOT,
+ dev_name(dp->dev), dp);
+ if (ret < 0)
+- goto error;
++ goto err_phy_exit;
+
+ dev_dbg(dp->dev, "ZynqMP DisplayPort Tx probed with %u lanes\n",
+ dp->num_lanes);
+
+ return 0;
+
+-error:
++err_phy_exit:
+ zynqmp_dp_phy_exit(dp);
++err_reset:
++ zynqmp_dp_reset(dp, true);
++
+ return ret;
+ }
+
+@@ -1735,4 +1736,5 @@ void zynqmp_dp_remove(struct zynqmp_dpsub *dpsub)
+ zynqmp_dp_write(dp, ZYNQMP_DP_INT_DS, 0xffffffff);
+
+ zynqmp_dp_phy_exit(dp);
++ zynqmp_dp_reset(dp, true);
+ }
+--
+2.30.2
+
--- /dev/null
+From 99cae142d471b95a87a9c7f728a7d8e8167c75c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 12:59:45 +0800
+Subject: drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting
+ pixel clock
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a19effb6dbe5bd1be77a6d68eba04dba8993ffeb ]
+
+The Runtime PM subsystem will force the device "fd4a0000.zynqmp-display"
+to enter suspend state while booting if the following conditions are met:
+- the usage counter is zero (pm_runtime_get_sync hasn't been called yet)
+- no 'active' children (no zynqmp-dp-snd-xx node under dpsub node)
+- no other device in the same power domain (dpdma node has no
+ "power-domains = <&zynqmp_firmware PD_DP>" property)
+
+So there is a scenario as below:
+1) DP device enters suspend state <- call zynqmp_gpd_power_off
+2) zynqmp_disp_crtc_setup_clock <- configurate register VPLL_FRAC_CFG
+3) pm_runtime_get_sync <- call zynqmp_gpd_power_on and clear previous
+ VPLL_FRAC_CFG configuration
+4) clk_prepare_enable(disp->pclk) <- enable failed since VPLL_FRAC_CFG
+ configuration is corrupted
+
+From above, we can see that pm_runtime_get_sync may clear register
+VPLL_FRAC_CFG configuration and result the failure of clk enabling.
+Putting pm_runtime_get_sync at the very beginning of the function
+zynqmp_disp_crtc_atomic_enable can resolve this issue.
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_disp.c b/drivers/gpu/drm/xlnx/zynqmp_disp.c
+index 109d627968ac..01c6ce7784dd 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_disp.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_disp.c
+@@ -1452,9 +1452,10 @@ zynqmp_disp_crtc_atomic_enable(struct drm_crtc *crtc,
+ struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
+ int ret, vrefresh;
+
++ pm_runtime_get_sync(disp->dev);
++
+ zynqmp_disp_crtc_setup_clock(crtc, adjusted_mode);
+
+- pm_runtime_get_sync(disp->dev);
+ ret = clk_prepare_enable(disp->pclk);
+ if (ret) {
+ dev_err(disp->dev, "failed to enable a pixel clock\n");
+--
+2.30.2
+
--- /dev/null
+From bf52f184db6e0eec5e888b35337ae1b8c8208bab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 16:28:59 +0200
+Subject: ethtool: improve compat ioctl handling
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit dd98d2895de6485c884a9cb42de69fed02826fa4 ]
+
+The ethtool compat ioctl handling is hidden away in net/socket.c,
+which introduces a couple of minor oddities:
+
+- The implementation may end up diverging, as seen in the RXNFC
+ extension in commit 84a1d9c48200 ("net: ethtool: extend RXNFC
+ API to support RSS spreading of filter matches") that does not work
+ in compat mode.
+
+- Most architectures do not need the compat handling at all
+ because u64 and compat_u64 have the same alignment.
+
+- On x86, the conversion is done for both x32 and i386 user space,
+ but it's actually wrong to do it for x32 and cannot work there.
+
+- On 32-bit Arm, it never worked for compat oabi user space, since
+ that needs to do the same conversion but does not.
+
+- It would be nice to get rid of both compat_alloc_user_space()
+ and copy_in_user() throughout the kernel.
+
+None of these actually seems to be a serious problem that real
+users are likely to encounter, but fixing all of them actually
+leads to code that is both shorter and more readable.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ethtool.h | 4 --
+ net/ethtool/ioctl.c | 136 +++++++++++++++++++++++++++++++++++-----
+ net/socket.c | 125 +-----------------------------------
+ 3 files changed, 121 insertions(+), 144 deletions(-)
+
+diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
+index 232daaec56e4..4711b96dae0c 100644
+--- a/include/linux/ethtool.h
++++ b/include/linux/ethtool.h
+@@ -17,8 +17,6 @@
+ #include <linux/compat.h>
+ #include <uapi/linux/ethtool.h>
+
+-#ifdef CONFIG_COMPAT
+-
+ struct compat_ethtool_rx_flow_spec {
+ u32 flow_type;
+ union ethtool_flow_union h_u;
+@@ -38,8 +36,6 @@ struct compat_ethtool_rxnfc {
+ u32 rule_locs[];
+ };
+
+-#endif /* CONFIG_COMPAT */
+-
+ #include <linux/rculist.h>
+
+ /**
+diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
+index baa5d10043cb..6134b180f59f 100644
+--- a/net/ethtool/ioctl.c
++++ b/net/ethtool/ioctl.c
+@@ -7,6 +7,7 @@
+ * the information ethtool needs.
+ */
+
++#include <linux/compat.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+ #include <linux/capability.h>
+@@ -807,6 +808,120 @@ static noinline_for_stack int ethtool_get_sset_info(struct net_device *dev,
+ return ret;
+ }
+
++static noinline_for_stack int
++ethtool_rxnfc_copy_from_compat(struct ethtool_rxnfc *rxnfc,
++ const struct compat_ethtool_rxnfc __user *useraddr,
++ size_t size)
++{
++ struct compat_ethtool_rxnfc crxnfc = {};
++
++ /* We expect there to be holes between fs.m_ext and
++ * fs.ring_cookie and at the end of fs, but nowhere else.
++ * On non-x86, no conversion should be needed.
++ */
++ BUILD_BUG_ON(!IS_ENABLED(CONFIG_X86_64) &&
++ sizeof(struct compat_ethtool_rxnfc) !=
++ sizeof(struct ethtool_rxnfc));
++ BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
++ sizeof(useraddr->fs.m_ext) !=
++ offsetof(struct ethtool_rxnfc, fs.m_ext) +
++ sizeof(rxnfc->fs.m_ext));
++ BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.location) -
++ offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
++ offsetof(struct ethtool_rxnfc, fs.location) -
++ offsetof(struct ethtool_rxnfc, fs.ring_cookie));
++
++ if (copy_from_user(&crxnfc, useraddr, min(size, sizeof(crxnfc))))
++ return -EFAULT;
++
++ *rxnfc = (struct ethtool_rxnfc) {
++ .cmd = crxnfc.cmd,
++ .flow_type = crxnfc.flow_type,
++ .data = crxnfc.data,
++ .fs = {
++ .flow_type = crxnfc.fs.flow_type,
++ .h_u = crxnfc.fs.h_u,
++ .h_ext = crxnfc.fs.h_ext,
++ .m_u = crxnfc.fs.m_u,
++ .m_ext = crxnfc.fs.m_ext,
++ .ring_cookie = crxnfc.fs.ring_cookie,
++ .location = crxnfc.fs.location,
++ },
++ .rule_cnt = crxnfc.rule_cnt,
++ };
++
++ return 0;
++}
++
++static int ethtool_rxnfc_copy_from_user(struct ethtool_rxnfc *rxnfc,
++ const void __user *useraddr,
++ size_t size)
++{
++ if (compat_need_64bit_alignment_fixup())
++ return ethtool_rxnfc_copy_from_compat(rxnfc, useraddr, size);
++
++ if (copy_from_user(rxnfc, useraddr, size))
++ return -EFAULT;
++
++ return 0;
++}
++
++static int ethtool_rxnfc_copy_to_compat(void __user *useraddr,
++ const struct ethtool_rxnfc *rxnfc,
++ size_t size, const u32 *rule_buf)
++{
++ struct compat_ethtool_rxnfc crxnfc;
++
++ memset(&crxnfc, 0, sizeof(crxnfc));
++ crxnfc = (struct compat_ethtool_rxnfc) {
++ .cmd = rxnfc->cmd,
++ .flow_type = rxnfc->flow_type,
++ .data = rxnfc->data,
++ .fs = {
++ .flow_type = rxnfc->fs.flow_type,
++ .h_u = rxnfc->fs.h_u,
++ .h_ext = rxnfc->fs.h_ext,
++ .m_u = rxnfc->fs.m_u,
++ .m_ext = rxnfc->fs.m_ext,
++ .ring_cookie = rxnfc->fs.ring_cookie,
++ .location = rxnfc->fs.location,
++ },
++ .rule_cnt = rxnfc->rule_cnt,
++ };
++
++ if (copy_to_user(useraddr, &crxnfc, min(size, sizeof(crxnfc))))
++ return -EFAULT;
++
++ return 0;
++}
++
++static int ethtool_rxnfc_copy_to_user(void __user *useraddr,
++ const struct ethtool_rxnfc *rxnfc,
++ size_t size, const u32 *rule_buf)
++{
++ int ret;
++
++ if (compat_need_64bit_alignment_fixup()) {
++ ret = ethtool_rxnfc_copy_to_compat(useraddr, rxnfc, size,
++ rule_buf);
++ useraddr += offsetof(struct compat_ethtool_rxnfc, rule_locs);
++ } else {
++ ret = copy_to_user(useraddr, &rxnfc, size);
++ useraddr += offsetof(struct ethtool_rxnfc, rule_locs);
++ }
++
++ if (ret)
++ return -EFAULT;
++
++ if (rule_buf) {
++ if (copy_to_user(useraddr, rule_buf,
++ rxnfc->rule_cnt * sizeof(u32)))
++ return -EFAULT;
++ }
++
++ return 0;
++}
++
+ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
+ u32 cmd, void __user *useraddr)
+ {
+@@ -825,7 +940,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
+ info_size = (offsetof(struct ethtool_rxnfc, data) +
+ sizeof(info.data));
+
+- if (copy_from_user(&info, useraddr, info_size))
++ if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
+ return -EFAULT;
+
+ rc = dev->ethtool_ops->set_rxnfc(dev, &info);
+@@ -833,7 +948,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
+ return rc;
+
+ if (cmd == ETHTOOL_SRXCLSRLINS &&
+- copy_to_user(useraddr, &info, info_size))
++ ethtool_rxnfc_copy_to_user(useraddr, &info, info_size, NULL))
+ return -EFAULT;
+
+ return 0;
+@@ -859,7 +974,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
+ info_size = (offsetof(struct ethtool_rxnfc, data) +
+ sizeof(info.data));
+
+- if (copy_from_user(&info, useraddr, info_size))
++ if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
+ return -EFAULT;
+
+ /* If FLOW_RSS was requested then user-space must be using the
+@@ -867,7 +982,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
+ */
+ if (cmd == ETHTOOL_GRXFH && info.flow_type & FLOW_RSS) {
+ info_size = sizeof(info);
+- if (copy_from_user(&info, useraddr, info_size))
++ if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
+ return -EFAULT;
+ /* Since malicious users may modify the original data,
+ * we need to check whether FLOW_RSS is still requested.
+@@ -893,18 +1008,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
+ if (ret < 0)
+ goto err_out;
+
+- ret = -EFAULT;
+- if (copy_to_user(useraddr, &info, info_size))
+- goto err_out;
+-
+- if (rule_buf) {
+- useraddr += offsetof(struct ethtool_rxnfc, rule_locs);
+- if (copy_to_user(useraddr, rule_buf,
+- info.rule_cnt * sizeof(u32)))
+- goto err_out;
+- }
+- ret = 0;
+-
++ ret = ethtool_rxnfc_copy_to_user(useraddr, &info, info_size, rule_buf);
+ err_out:
+ kfree(rule_buf);
+
+diff --git a/net/socket.c b/net/socket.c
+index 8808b3617dac..c5b6f5c5cad9 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -3154,128 +3154,6 @@ static int compat_dev_ifconf(struct net *net, struct compat_ifconf __user *uifc3
+ return 0;
+ }
+
+-static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+-{
+- struct compat_ethtool_rxnfc __user *compat_rxnfc;
+- bool convert_in = false, convert_out = false;
+- size_t buf_size = 0;
+- struct ethtool_rxnfc __user *rxnfc = NULL;
+- struct ifreq ifr;
+- u32 rule_cnt = 0, actual_rule_cnt;
+- u32 ethcmd;
+- u32 data;
+- int ret;
+-
+- if (get_user(data, &ifr32->ifr_ifru.ifru_data))
+- return -EFAULT;
+-
+- compat_rxnfc = compat_ptr(data);
+-
+- if (get_user(ethcmd, &compat_rxnfc->cmd))
+- return -EFAULT;
+-
+- /* Most ethtool structures are defined without padding.
+- * Unfortunately struct ethtool_rxnfc is an exception.
+- */
+- switch (ethcmd) {
+- default:
+- break;
+- case ETHTOOL_GRXCLSRLALL:
+- /* Buffer size is variable */
+- if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
+- return -EFAULT;
+- if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
+- return -ENOMEM;
+- buf_size += rule_cnt * sizeof(u32);
+- fallthrough;
+- case ETHTOOL_GRXRINGS:
+- case ETHTOOL_GRXCLSRLCNT:
+- case ETHTOOL_GRXCLSRULE:
+- case ETHTOOL_SRXCLSRLINS:
+- convert_out = true;
+- fallthrough;
+- case ETHTOOL_SRXCLSRLDEL:
+- buf_size += sizeof(struct ethtool_rxnfc);
+- convert_in = true;
+- rxnfc = compat_alloc_user_space(buf_size);
+- break;
+- }
+-
+- if (copy_from_user(&ifr.ifr_name, &ifr32->ifr_name, IFNAMSIZ))
+- return -EFAULT;
+-
+- ifr.ifr_data = convert_in ? rxnfc : (void __user *)compat_rxnfc;
+-
+- if (convert_in) {
+- /* We expect there to be holes between fs.m_ext and
+- * fs.ring_cookie and at the end of fs, but nowhere else.
+- */
+- BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
+- sizeof(compat_rxnfc->fs.m_ext) !=
+- offsetof(struct ethtool_rxnfc, fs.m_ext) +
+- sizeof(rxnfc->fs.m_ext));
+- BUILD_BUG_ON(
+- offsetof(struct compat_ethtool_rxnfc, fs.location) -
+- offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
+- offsetof(struct ethtool_rxnfc, fs.location) -
+- offsetof(struct ethtool_rxnfc, fs.ring_cookie));
+-
+- if (copy_in_user(rxnfc, compat_rxnfc,
+- (void __user *)(&rxnfc->fs.m_ext + 1) -
+- (void __user *)rxnfc) ||
+- copy_in_user(&rxnfc->fs.ring_cookie,
+- &compat_rxnfc->fs.ring_cookie,
+- (void __user *)(&rxnfc->fs.location + 1) -
+- (void __user *)&rxnfc->fs.ring_cookie))
+- return -EFAULT;
+- if (ethcmd == ETHTOOL_GRXCLSRLALL) {
+- if (put_user(rule_cnt, &rxnfc->rule_cnt))
+- return -EFAULT;
+- } else if (copy_in_user(&rxnfc->rule_cnt,
+- &compat_rxnfc->rule_cnt,
+- sizeof(rxnfc->rule_cnt)))
+- return -EFAULT;
+- }
+-
+- ret = dev_ioctl(net, SIOCETHTOOL, &ifr, NULL);
+- if (ret)
+- return ret;
+-
+- if (convert_out) {
+- if (copy_in_user(compat_rxnfc, rxnfc,
+- (const void __user *)(&rxnfc->fs.m_ext + 1) -
+- (const void __user *)rxnfc) ||
+- copy_in_user(&compat_rxnfc->fs.ring_cookie,
+- &rxnfc->fs.ring_cookie,
+- (const void __user *)(&rxnfc->fs.location + 1) -
+- (const void __user *)&rxnfc->fs.ring_cookie) ||
+- copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
+- sizeof(rxnfc->rule_cnt)))
+- return -EFAULT;
+-
+- if (ethcmd == ETHTOOL_GRXCLSRLALL) {
+- /* As an optimisation, we only copy the actual
+- * number of rules that the underlying
+- * function returned. Since Mallory might
+- * change the rule count in user memory, we
+- * check that it is less than the rule count
+- * originally given (as the user buffer size),
+- * which has been range-checked.
+- */
+- if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
+- return -EFAULT;
+- if (actual_rule_cnt < rule_cnt)
+- rule_cnt = actual_rule_cnt;
+- if (copy_in_user(&compat_rxnfc->rule_locs[0],
+- &rxnfc->rule_locs[0],
+- rule_cnt * sizeof(u32)))
+- return -EFAULT;
+- }
+- }
+-
+- return 0;
+-}
+-
+ static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
+ {
+ compat_uptr_t uptr32;
+@@ -3432,8 +3310,6 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+ return old_bridge_ioctl(argp);
+ case SIOCGIFCONF:
+ return compat_dev_ifconf(net, argp);
+- case SIOCETHTOOL:
+- return ethtool_ioctl(net, argp);
+ case SIOCWANDEV:
+ return compat_siocwandev(net, argp);
+ case SIOCGIFMAP:
+@@ -3446,6 +3322,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+ return sock->ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
+ !COMPAT_USE_64BIT_TIME);
+
++ case SIOCETHTOOL:
+ case SIOCBONDSLAVEINFOQUERY:
+ case SIOCBONDINFOQUERY:
+ case SIOCSHWTSTAMP:
+--
+2.30.2
+
--- /dev/null
+From 988d33895877d3368bfe14e3b4537b45e6ad75a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jul 2021 08:21:41 +0800
+Subject: f2fs: compress: fix to set zstd compress level correctly
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 01f6afd0f3ccaa2d5f7fb87e7bd910dc17eef06b ]
+
+As 5kft reported in [1]:
+
+set_compress_context() should set compress level into .i_compress_flag
+for zstd as well as lz4hc, otherwise, zstd compressor will still use
+default zstd compress level during compression, fix it.
+
+[1] https://lore.kernel.org/linux-f2fs-devel/8e29f52b-6b0d-45ec-9520-e63eb254287a@www.fastmail.com/T/#u
+
+Fixes: 3fde13f817e2 ("f2fs: compress: support compress level")
+Reported-by: 5kft <5kft@5kft.org>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index ee8eb33e2c25..bfcd5ef36907 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -4137,7 +4137,8 @@ static inline void set_compress_context(struct inode *inode)
+ 1 << COMPRESS_CHKSUM : 0;
+ F2FS_I(inode)->i_cluster_size =
+ 1 << F2FS_I(inode)->i_log_cluster_size;
+- if (F2FS_I(inode)->i_compress_algorithm == COMPRESS_LZ4 &&
++ if ((F2FS_I(inode)->i_compress_algorithm == COMPRESS_LZ4 ||
++ F2FS_I(inode)->i_compress_algorithm == COMPRESS_ZSTD) &&
+ F2FS_OPTION(sbi).compress_level)
+ F2FS_I(inode)->i_compress_flag |=
+ F2FS_OPTION(sbi).compress_level <<
+--
+2.30.2
+
--- /dev/null
+From af727bfc7b1c3a275ada3e11c7ed68aba5eabf14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 11:37:32 -0700
+Subject: f2fs: deallocate compressed pages when error happens
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 827f02842e40ea2e00f401e8f4cb1bccf3b8cd86 ]
+
+In f2fs_write_multi_pages(), f2fs_compress_pages() allocates pages for
+compression work in cc->cpages[]. Then, f2fs_write_compressed_pages() initiates
+bio submission. But, if there's any error before submitting the IOs like early
+f2fs_cp_error(), previously it didn't free cpages by f2fs_compress_free_page().
+Let's fix memory leak by putting that just before deallocating cc->cpages.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 455561826c7d..b8b3f1160afa 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1340,12 +1340,6 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+
+ for (--i; i >= 0; i--)
+ fscrypt_finalize_bounce_page(&cc->cpages[i]);
+- for (i = 0; i < cc->nr_cpages; i++) {
+- if (!cc->cpages[i])
+- continue;
+- f2fs_compress_free_page(cc->cpages[i]);
+- cc->cpages[i] = NULL;
+- }
+ out_put_cic:
+ kmem_cache_free(cic_entry_slab, cic);
+ out_put_dnode:
+@@ -1356,6 +1350,12 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ else
+ f2fs_unlock_op(sbi);
+ out_free:
++ for (i = 0; i < cc->nr_cpages; i++) {
++ if (!cc->cpages[i])
++ continue;
++ f2fs_compress_free_page(cc->cpages[i]);
++ cc->cpages[i] = NULL;
++ }
+ page_array_free(cc->inode, cc->cpages, cc->nr_cpages);
+ cc->cpages = NULL;
+ return -EAGAIN;
+--
+2.30.2
+
--- /dev/null
+From 0cfbc59a1d5e564be9db94667cc754272c22d67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 09:12:15 -0700
+Subject: f2fs: do not submit NEW_ADDR to read node block
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit b7ec2061737f12c33e45beeb967d17f31abc1ada ]
+
+After the below patch, give cp is errored, we drop dirty node pages. This
+can give NEW_ADDR to read node pages. Don't do WARN_ON() which gives
+generic/475 failure.
+
+Fixes: 28607bf3aa6f ("f2fs: drop dirty node pages when cp is in error status")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 0be9e2d7120e..1b0fe6e64b7d 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1321,7 +1321,8 @@ static int read_node_page(struct page *page, int op_flags)
+ if (err)
+ return err;
+
+- if (unlikely(ni.blk_addr == NULL_ADDR) ||
++ /* NEW_ADDR can be seen, after cp_error drops some dirty node pages */
++ if (unlikely(ni.blk_addr == NULL_ADDR || ni.blk_addr == NEW_ADDR) ||
+ is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)) {
+ ClearPageUptodate(page);
+ return -ENOENT;
+--
+2.30.2
+
--- /dev/null
+From 2d995cf086c1967cc0eb58c9483e69763b424a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Aug 2021 08:12:08 +0800
+Subject: f2fs: fix to account missing .skipped_gc_rwsem
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit ad126ebddecbf696e0cf214ff56c7b170fa9f0f7 ]
+
+There is a missing place we forgot to account .skipped_gc_rwsem, fix it.
+
+Fixes: 6f8d4455060d ("f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 0e42ee5f7770..70234a7040c8 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1497,8 +1497,10 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
+ int err;
+
+ if (S_ISREG(inode->i_mode)) {
+- if (!down_write_trylock(&fi->i_gc_rwsem[READ]))
++ if (!down_write_trylock(&fi->i_gc_rwsem[READ])) {
++ sbi->skipped_gc_rwsem++;
+ continue;
++ }
+ if (!down_write_trylock(
+ &fi->i_gc_rwsem[WRITE])) {
+ sbi->skipped_gc_rwsem++;
+--
+2.30.2
+
--- /dev/null
+From a599c93c716546df7ce5718d79272c1fa0756c97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 10:45:20 +0800
+Subject: f2fs: fix to keep compatibility of fault injection interface
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit b96d9b3b09f0427b289332c6f6bfbf747a19b654 ]
+
+The value of FAULT_* macros and its description in f2fs.rst became
+inconsistent, fix this to keep compatibility of fault injection
+interface.
+
+Fixes: 67883ade7a98 ("f2fs: remove FAULT_ALLOC_BIO")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/filesystems/f2fs.rst | 1 +
+ fs/f2fs/f2fs.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/Documentation/filesystems/f2fs.rst b/Documentation/filesystems/f2fs.rst
+index ff9e7cc97c65..b5285599d972 100644
+--- a/Documentation/filesystems/f2fs.rst
++++ b/Documentation/filesystems/f2fs.rst
+@@ -185,6 +185,7 @@ fault_type=%d Support configuring fault injection type, should be
+ FAULT_KVMALLOC 0x000000002
+ FAULT_PAGE_ALLOC 0x000000004
+ FAULT_PAGE_GET 0x000000008
++ FAULT_ALLOC_BIO 0x000000010 (obsolete)
+ FAULT_ALLOC_NID 0x000000020
+ FAULT_ORPHAN 0x000000040
+ FAULT_BLOCK 0x000000080
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index bfcd5ef36907..db95829904e5 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -43,6 +43,7 @@ enum {
+ FAULT_KVMALLOC,
+ FAULT_PAGE_ALLOC,
+ FAULT_PAGE_GET,
++ FAULT_ALLOC_BIO, /* it's obsolete due to bio_alloc() will never fail */
+ FAULT_ALLOC_NID,
+ FAULT_ORPHAN,
+ FAULT_BLOCK,
+--
+2.30.2
+
--- /dev/null
+From 5b24f3d8cf0b6601e84a6facbd77ab6b434f5f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 19:34:19 +0800
+Subject: f2fs: fix to unmap pages from userspace process in punch_hole()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c8dc3047c48540183744f959412d44b08c5435e1 ]
+
+We need to unmap pages from userspace process before removing pagecache
+in punch_hole() like we did in f2fs_setattr().
+
+Similar change:
+commit 5e44f8c374dc ("ext4: hole-punch use truncate_pagecache_range")
+
+Fixes: fbfa2cc58d53 ("f2fs: add file operations")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 97d48c5bdebc..74f934da825f 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1084,7 +1084,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ }
+
+ if (pg_start < pg_end) {
+- struct address_space *mapping = inode->i_mapping;
+ loff_t blk_start, blk_end;
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+
+@@ -1096,8 +1095,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ down_write(&F2FS_I(inode)->i_mmap_sem);
+
+- truncate_inode_pages_range(mapping, blk_start,
+- blk_end - 1);
++ truncate_pagecache_range(inode, blk_start, blk_end - 1);
+
+ f2fs_lock_op(sbi);
+ ret = f2fs_truncate_hole(inode, pg_start, pg_end);
+--
+2.30.2
+
--- /dev/null
+From eb507fd7c32d1c2de86d77826bcf982f72230eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 10:03:15 +0800
+Subject: f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit adf9ea89c719c1d23794e363f631e376b3ff8cbc ]
+
+In below path, it will return ENOENT if filesystem is shutdown:
+
+- f2fs_map_blocks
+ - f2fs_get_dnode_of_data
+ - f2fs_get_node_page
+ - __get_node_page
+ - read_node_page
+ - is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)
+ return -ENOENT
+ - force return value from ENOENT to 0
+
+It should be fine for read case, since it indicates a hole condition,
+and caller could use .m_next_pgofs to skip the hole and continue the
+lookup.
+
+However it may cause confusing for write case, since leaving a hole
+there, and said nothing was wrong doesn't help.
+
+There is at least one case from dax_iomap_actor() will complain that,
+so fix this in prior to supporting dax in f2fs.
+
+xfstest generic/388 reports below warning:
+
+ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 485833 at fs/dax.c:1127 dax_iomap_actor+0x339/0x370
+Call Trace:
+ iomap_apply+0x1c4/0x7b0
+ ? dax_iomap_rw+0x1c0/0x1c0
+ dax_iomap_rw+0xad/0x1c0
+ ? dax_iomap_rw+0x1c0/0x1c0
+ f2fs_file_write_iter+0x5ab/0x970 [f2fs]
+ do_iter_readv_writev+0x273/0x2e0
+ do_iter_write+0xab/0x1f0
+ vfs_iter_write+0x21/0x40
+ iter_file_splice_write+0x287/0x540
+ do_splice+0x37c/0xa60
+ __x64_sys_splice+0x15f/0x3a0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
+------------[ cut here ]------------
+RIP: 0010:dax_iomap_pte_fault.isra.0+0x72e/0x14a0
+Call Trace:
+ dax_iomap_fault+0x44/0x70
+ f2fs_dax_huge_fault+0x155/0x400 [f2fs]
+ f2fs_dax_fault+0x18/0x30 [f2fs]
+ __do_fault+0x4e/0x120
+ do_fault+0x3cf/0x7a0
+ __handle_mm_fault+0xa8c/0xf20
+ ? find_held_lock+0x39/0xd0
+ handle_mm_fault+0x1b6/0x480
+ do_user_addr_fault+0x320/0xcd0
+ ? rcu_read_lock_sched_held+0x67/0xc0
+ exc_page_fault+0x77/0x3f0
+ ? asm_exc_page_fault+0x8/0x30
+ asm_exc_page_fault+0x1e/0x30
+
+Fixes: 83a3bfdb5a8a ("f2fs: indicate shutdown f2fs to allow unmount successfully")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 6eda24768d4b..f2498e4ad89d 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1492,7 +1492,21 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ if (err) {
+ if (flag == F2FS_GET_BLOCK_BMAP)
+ map->m_pblk = 0;
++
+ if (err == -ENOENT) {
++ /*
++ * There is one exceptional case that read_node_page()
++ * may return -ENOENT due to filesystem has been
++ * shutdown or cp_error, so force to convert error
++ * number to EIO for such case.
++ */
++ if (map->m_may_create &&
++ (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) ||
++ f2fs_cp_error(sbi))) {
++ err = -EIO;
++ goto unlock_out;
++ }
++
+ err = 0;
+ if (map->m_next_pgofs)
+ *map->m_next_pgofs =
+--
+2.30.2
+
--- /dev/null
+From a0bb8ff5596bcff3bf5deb3a84febdd5659553ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 09:22:17 +0800
+Subject: f2fs: fix wrong checkpoint_changed value in f2fs_remount()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 277afbde6ca2b38729683fc17c031b4bc942068d ]
+
+In f2fs_remount(), return value of test_opt() is an unsigned int type
+variable, however when we compare it to a bool type variable, it cause
+wrong result, fix it.
+
+Fixes: 4354994f097d ("f2fs: checkpoint disabling")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 7cdccb79b378..2b093a209ae4 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2071,11 +2071,10 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
+ bool need_restart_ckpt = false, need_stop_ckpt = false;
+ bool need_restart_flush = false, need_stop_flush = false;
+ bool no_extent_cache = !test_opt(sbi, EXTENT_CACHE);
+- bool disable_checkpoint = test_opt(sbi, DISABLE_CHECKPOINT);
++ bool enable_checkpoint = !test_opt(sbi, DISABLE_CHECKPOINT);
+ bool no_io_align = !F2FS_IO_ALIGNED(sbi);
+ bool no_atgc = !test_opt(sbi, ATGC);
+ bool no_compress_cache = !test_opt(sbi, COMPRESS_CACHE);
+- bool checkpoint_changed;
+ #ifdef CONFIG_QUOTA
+ int i, j;
+ #endif
+@@ -2120,8 +2119,6 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
+ err = parse_options(sb, data, true);
+ if (err)
+ goto restore_opts;
+- checkpoint_changed =
+- disable_checkpoint != test_opt(sbi, DISABLE_CHECKPOINT);
+
+ /*
+ * Previous and new state of filesystem is RO,
+@@ -2243,7 +2240,7 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)
+ need_stop_flush = true;
+ }
+
+- if (checkpoint_changed) {
++ if (enable_checkpoint == !!test_opt(sbi, DISABLE_CHECKPOINT)) {
+ if (test_opt(sbi, DISABLE_CHECKPOINT)) {
+ err = f2fs_disable_checkpoint(sbi);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From d8c142f8b7aa2e86510adcbeaf3603dbd601b162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 16:46:47 +0800
+Subject: f2fs: quota: fix potential deadlock
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]
+
+xfstest generic/587 reports a deadlock issue as below:
+
+======================================================
+WARNING: possible circular locking dependency detected
+5.14.0-rc1 #69 Not tainted
+------------------------------------------------------
+repquota/8606 is trying to acquire lock:
+ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]
+
+but task is already holding lock:
+ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&sbi->quota_sem){.+.+}-{3:3}:
+ __lock_acquire+0x648/0x10b0
+ lock_acquire+0x128/0x470
+ down_read+0x3b/0x2a0
+ f2fs_quota_sync+0x59/0x300 [f2fs]
+ f2fs_quota_on+0x48/0x100 [f2fs]
+ do_quotactl+0x5e3/0xb30
+ __x64_sys_quotactl+0x23a/0x4e0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+-> #1 (&sbi->cp_rwsem){++++}-{3:3}:
+ __lock_acquire+0x648/0x10b0
+ lock_acquire+0x128/0x470
+ down_read+0x3b/0x2a0
+ f2fs_unlink+0x353/0x670 [f2fs]
+ vfs_unlink+0x1c7/0x380
+ do_unlinkat+0x413/0x4b0
+ __x64_sys_unlinkat+0x50/0xb0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:
+ check_prev_add+0xdc/0xb30
+ validate_chain+0xa67/0xb20
+ __lock_acquire+0x648/0x10b0
+ lock_acquire+0x128/0x470
+ down_write+0x39/0xc0
+ f2fs_quota_sync+0x207/0x300 [f2fs]
+ do_quotactl+0xaff/0xb30
+ __x64_sys_quotactl+0x23a/0x4e0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+other info that might help us debug this:
+
+Chain exists of:
+ &sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&sbi->quota_sem);
+ lock(&sbi->cp_rwsem);
+ lock(&sbi->quota_sem);
+ lock(&sb->s_type->i_mutex_key#18);
+
+ *** DEADLOCK ***
+
+3 locks held by repquota/8606:
+ #0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190
+ #1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs]
+ #2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
+
+stack backtrace:
+CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69
+Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+Call Trace:
+ dump_stack_lvl+0xce/0x134
+ dump_stack+0x17/0x20
+ print_circular_bug.isra.0.cold+0x239/0x253
+ check_noncircular+0x1be/0x1f0
+ check_prev_add+0xdc/0xb30
+ validate_chain+0xa67/0xb20
+ __lock_acquire+0x648/0x10b0
+ lock_acquire+0x128/0x470
+ down_write+0x39/0xc0
+ f2fs_quota_sync+0x207/0x300 [f2fs]
+ do_quotactl+0xaff/0xb30
+ __x64_sys_quotactl+0x23a/0x4e0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x7f883b0b4efe
+
+The root cause is ABBA deadlock of inode lock and cp_rwsem,
+reorder locks in f2fs_quota_sync() as below to fix this issue:
+- lock inode
+- lock cp_rwsem
+- lock quota_sem
+
+Fixes: db6ec53b7e03 ("f2fs: add a rw_sem to cover quota flag changes")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 84 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 48 insertions(+), 36 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 2f4e4bfb31d3..7cdccb79b378 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2527,6 +2527,33 @@ static int f2fs_enable_quotas(struct super_block *sb)
+ return 0;
+ }
+
++static int f2fs_quota_sync_file(struct f2fs_sb_info *sbi, int type)
++{
++ struct quota_info *dqopt = sb_dqopt(sbi->sb);
++ struct address_space *mapping = dqopt->files[type]->i_mapping;
++ int ret = 0;
++
++ ret = dquot_writeback_dquots(sbi->sb, type);
++ if (ret)
++ goto out;
++
++ ret = filemap_fdatawrite(mapping);
++ if (ret)
++ goto out;
++
++ /* if we are using journalled quota */
++ if (is_journalled_quota(sbi))
++ goto out;
++
++ ret = filemap_fdatawait(mapping);
++
++ truncate_inode_pages(&dqopt->files[type]->i_data, 0);
++out:
++ if (ret)
++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
++ return ret;
++}
++
+ int f2fs_quota_sync(struct super_block *sb, int type)
+ {
+ struct f2fs_sb_info *sbi = F2FS_SB(sb);
+@@ -2534,57 +2561,42 @@ int f2fs_quota_sync(struct super_block *sb, int type)
+ int cnt;
+ int ret;
+
+- /*
+- * do_quotactl
+- * f2fs_quota_sync
+- * down_read(quota_sem)
+- * dquot_writeback_dquots()
+- * f2fs_dquot_commit
+- * block_operation
+- * down_read(quota_sem)
+- */
+- f2fs_lock_op(sbi);
+-
+- down_read(&sbi->quota_sem);
+- ret = dquot_writeback_dquots(sb, type);
+- if (ret)
+- goto out;
+-
+ /*
+ * Now when everything is written we can discard the pagecache so
+ * that userspace sees the changes.
+ */
+ for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+- struct address_space *mapping;
+
+ if (type != -1 && cnt != type)
+ continue;
+- if (!sb_has_quota_active(sb, cnt))
+- continue;
+
+- mapping = dqopt->files[cnt]->i_mapping;
++ if (!sb_has_quota_active(sb, type))
++ return 0;
+
+- ret = filemap_fdatawrite(mapping);
+- if (ret)
+- goto out;
++ inode_lock(dqopt->files[cnt]);
+
+- /* if we are using journalled quota */
+- if (is_journalled_quota(sbi))
+- continue;
++ /*
++ * do_quotactl
++ * f2fs_quota_sync
++ * down_read(quota_sem)
++ * dquot_writeback_dquots()
++ * f2fs_dquot_commit
++ * block_operation
++ * down_read(quota_sem)
++ */
++ f2fs_lock_op(sbi);
++ down_read(&sbi->quota_sem);
+
+- ret = filemap_fdatawait(mapping);
+- if (ret)
+- set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
++ ret = f2fs_quota_sync_file(sbi, cnt);
++
++ up_read(&sbi->quota_sem);
++ f2fs_unlock_op(sbi);
+
+- inode_lock(dqopt->files[cnt]);
+- truncate_inode_pages(&dqopt->files[cnt]->i_data, 0);
+ inode_unlock(dqopt->files[cnt]);
++
++ if (ret)
++ break;
+ }
+-out:
+- if (ret)
+- set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
+- up_read(&sbi->quota_sem);
+- f2fs_unlock_op(sbi);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f4de8c7c6fa2ffc0d91537d6fc63714cdfb5a196 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 11:29:46 +0800
+Subject: f2fs: reduce the scope of setting fsck tag when de->name_len is zero
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit d4bf15a7ce172d186d400d606adf4f34a59130d6 ]
+
+I recently found a case where de->name_len is 0 in f2fs_fill_dentries()
+easily reproduced, and finally set the fsck flag.
+
+Thread A Thread B
+- f2fs_readdir
+ - f2fs_read_inline_dir
+ - ctx->pos = d.max
+ - f2fs_add_dentry
+ - f2fs_add_inline_entry
+ - do_convert_inline_dir
+ - f2fs_add_regular_entry
+- f2fs_readdir
+ - f2fs_fill_dentries
+ - set_sbi_flag(sbi, SBI_NEED_FSCK)
+
+Process A opens the folder, and has been reading without closing it.
+During this period, Process B created a file under the folder (occupying
+multiple f2fs_dir_entry, exceeding the d.max of the inline dir). After
+creation, process A uses the d.max of inline dir to read it again, and
+it will read that de->name_len is 0.
+
+And Chao pointed out that w/o inline conversion, the race condition still
+can happen as below:
+
+dir_entry1: A
+dir_entry2: B
+dir_entry3: C
+free slot: _
+ctx->pos: ^
+
+Thread A is traversing directory,
+ctx-pos moves to below position after readdir() by thread A:
+AAAABBBB___
+ ^
+
+Then thread B delete dir_entry2, and create dir_entry3.
+
+Thread A calls readdir() to lookup dirents starting from middle
+of new dirent slots as below:
+AAAACCCCCC_
+ ^
+In these scenarios, the file system is not damaged, and it's hard to
+avoid it. But we can bypass tagging FSCK flag if:
+a) bit_pos (:= ctx->pos % d->max) is non-zero and
+b) before bit_pos moves to first valid dir_entry.
+
+Fixes: ddf06b753a85 ("f2fs: fix to trigger fsck if dirent.name_len is zero")
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+[Chao: clean up description]
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/dir.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 456651682daf..c250bf46ef5e 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -1000,6 +1000,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ struct f2fs_sb_info *sbi = F2FS_I_SB(d->inode);
+ struct blk_plug plug;
+ bool readdir_ra = sbi->readdir_ra == 1;
++ bool found_valid_dirent = false;
+ int err = 0;
+
+ bit_pos = ((unsigned long)ctx->pos % d->max);
+@@ -1014,13 +1015,15 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+
+ de = &d->dentry[bit_pos];
+ if (de->name_len == 0) {
++ if (found_valid_dirent || !bit_pos) {
++ printk_ratelimited(
++ "%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.",
++ KERN_WARNING, sbi->sb->s_id,
++ le32_to_cpu(de->ino));
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ }
+ bit_pos++;
+ ctx->pos = start_pos + bit_pos;
+- printk_ratelimited(
+- "%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.",
+- KERN_WARNING, sbi->sb->s_id,
+- le32_to_cpu(de->ino));
+- set_sbi_flag(sbi, SBI_NEED_FSCK);
+ continue;
+ }
+
+@@ -1063,6 +1066,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ f2fs_ra_node_page(sbi, le32_to_cpu(de->ino));
+
+ ctx->pos = start_pos + bit_pos;
++ found_valid_dirent = true;
+ }
+ out:
+ if (readdir_ra)
+--
+2.30.2
+
--- /dev/null
+From 489232de6cc7cccdde3c5c259c266802d0ffe98d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 13:30:45 -0700
+Subject: f2fs: should put a page beyond EOF when preparing a write
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 9605f75cf36e0bcc0f4ada07b5be712d30107607 ]
+
+The prepare_compress_overwrite() gets/locks a page to prepare a read, and calls
+f2fs_read_multi_pages() which checks EOF first. If there's any page beyond EOF,
+we unlock the page and set cc->rpages[i] = NULL, which we can't put the page
+anymore. This makes page leak, so let's fix by putting that page.
+
+Fixes: a949dc5f2c5c ("f2fs: compress: fix race condition of overwrite vs truncate")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index f2498e4ad89d..a86f004c0c07 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2153,6 +2153,8 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
+ continue;
+ }
+ unlock_page(page);
++ if (for_write)
++ put_page(page);
+ cc->rpages[i] = NULL;
+ cc->nr_rpages--;
+ }
+--
+2.30.2
+
--- /dev/null
+From b426feabe58100b896bb2d27224281bd79e003a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 12:38:11 -0700
+Subject: f2fs: turn back remapped address in compressed page endio
+
+From: Daeho Jeong <daehojeong@google.com>
+
+[ Upstream commit 4931e0c93e124357308893a3e5e224cbeeabc721 ]
+
+Turned back the remmaped sector address to the address in the partition,
+when ending io, for compress cache to work properly.
+
+Fixes: 6ce19aff0b8c ("f2fs: compress: add compress_inode to cache
+compressed blocks")
+Signed-off-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Youngjin Gil <youngjin.gil@samsung.com>
+Signed-off-by: Hyeong Jun Kim <hj514.kim@samsung.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index ba120d55e9b1..6eda24768d4b 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -116,6 +116,7 @@ struct bio_post_read_ctx {
+ struct f2fs_sb_info *sbi;
+ struct work_struct work;
+ unsigned int enabled_steps;
++ block_t fs_blkaddr;
+ };
+
+ static void f2fs_finish_read_bio(struct bio *bio)
+@@ -228,7 +229,7 @@ static void f2fs_handle_step_decompress(struct bio_post_read_ctx *ctx)
+ struct bio_vec *bv;
+ struct bvec_iter_all iter_all;
+ bool all_compressed = true;
+- block_t blkaddr = SECTOR_TO_BLOCK(ctx->bio->bi_iter.bi_sector);
++ block_t blkaddr = ctx->fs_blkaddr;
+
+ bio_for_each_segment_all(bv, ctx->bio, iter_all) {
+ struct page *page = bv->bv_page;
+@@ -1003,6 +1004,7 @@ static struct bio *f2fs_grab_read_bio(struct inode *inode, block_t blkaddr,
+ ctx->bio = bio;
+ ctx->sbi = sbi;
+ ctx->enabled_steps = post_read_steps;
++ ctx->fs_blkaddr = blkaddr;
+ bio->bi_private = ctx;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 906f197b94b05fada6d100484535203fbbfa3978 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 11:47:01 +0800
+Subject: fix array-index-out-of-bounds in taprio_change
+
+From: Haimin Zhang <tcs_kernel@tencent.com>
+
+[ Upstream commit efe487fce3061d94222c6501d7be3aa549b3dc78 ]
+
+syzbot report an array-index-out-of-bounds in taprio_change
+index 16 is out of range for type '__u16 [16]'
+that's because mqprio->num_tc is lager than TC_MAX_QUEUE,so we check
+the return value of netdev_set_num_tc.
+
+Reported-by: syzbot+2b3e5fb6c7ef285a94f6@syzkaller.appspotmail.com
+Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_taprio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
+index 9c79374457a0..1ab2fc933a21 100644
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1513,7 +1513,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
+ taprio_set_picos_per_byte(dev, q);
+
+ if (mqprio) {
+- netdev_set_num_tc(dev, mqprio->num_tc);
++ err = netdev_set_num_tc(dev, mqprio->num_tc);
++ if (err)
++ goto free_sched;
+ for (i = 0; i < mqprio->num_tc; i++)
+ netdev_set_tc_queue(dev, i,
+ mqprio->count[i],
+--
+2.30.2
+
--- /dev/null
+From cf312ad4016d4963ddf2e97f5df44537cb6d8339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 14:25:11 -0500
+Subject: flow_dissector: Fix out-of-bounds warnings
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 323e0cb473e2a8706ff162b6b4f4fa16023c9ba7 ]
+
+Fix the following out-of-bounds warnings:
+
+ net/core/flow_dissector.c: In function '__skb_flow_dissect':
+>> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds]
+ 1104 | memcpy(&key_addrs->v6addrs, &iph->saddr,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 1105 | sizeof(key_addrs->v6addrs));
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ In file included from include/linux/ipv6.h:5,
+ from net/core/flow_dissector.c:6:
+ include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
+ 133 | struct in6_addr saddr;
+ | ^~~~~
+>> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
+ 1059 | memcpy(&key_addrs->v4addrs, &iph->saddr,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 1060 | sizeof(key_addrs->v4addrs));
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ In file included from include/linux/ip.h:17,
+ from net/core/flow_dissector.c:5:
+ include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
+ 103 | __be32 saddr;
+ | ^~~~~
+
+The problem is that the original code is trying to copy data into a
+couple of struct members adjacent to each other in a single call to
+memcpy(). So, the compiler legitimately complains about it. As these
+are just a couple of members, fix this by copying each one of them in
+separate calls to memcpy().
+
+This helps with the ongoing efforts to globally enable -Warray-bounds
+and get us closer to being able to tighten the FORTIFY_SOURCE routines
+on memcpy().
+
+Link: https://github.com/KSPP/linux/issues/109
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/flow_dissector.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 4b2415d34873..bac0184cf3de 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -1056,8 +1056,10 @@ bool __skb_flow_dissect(const struct net *net,
+ FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+ target_container);
+
+- memcpy(&key_addrs->v4addrs, &iph->saddr,
+- sizeof(key_addrs->v4addrs));
++ memcpy(&key_addrs->v4addrs.src, &iph->saddr,
++ sizeof(key_addrs->v4addrs.src));
++ memcpy(&key_addrs->v4addrs.dst, &iph->daddr,
++ sizeof(key_addrs->v4addrs.dst));
+ key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+ }
+
+@@ -1101,8 +1103,10 @@ bool __skb_flow_dissect(const struct net *net,
+ FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+ target_container);
+
+- memcpy(&key_addrs->v6addrs, &iph->saddr,
+- sizeof(key_addrs->v6addrs));
++ memcpy(&key_addrs->v6addrs.src, &iph->saddr,
++ sizeof(key_addrs->v6addrs.src));
++ memcpy(&key_addrs->v6addrs.dst, &iph->daddr,
++ sizeof(key_addrs->v6addrs.dst));
+ key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 7cbe2d98f27e3f9c130c432268d8f015d4f0728f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 14:21:00 +0100
+Subject: fscache: Fix cookie key hashing
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 35b72573e977ed6b18b094136a4fa3e0ffb13603 ]
+
+The current hash algorithm used for hashing cookie keys is really bad,
+producing almost no dispersion (after a test kernel build, ~30000 files
+were split over just 18 out of the 32768 hash buckets).
+
+Borrow the full_name_hash() hash function into fscache to do the hashing
+for cookie keys and, in the future, volume keys.
+
+I don't want to use full_name_hash() as-is because I want the hash value to
+be consistent across arches and over time as the hash value produced may
+get used on disk.
+
+I can also optimise parts of it away as the key will always be a padded
+array of aligned 32-bit words.
+
+Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+cc: linux-cachefs@redhat.com
+Link: https://lore.kernel.org/r/162431201844.2908479.8293647220901514696.stgit@warthog.procyon.org.uk/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fscache/cookie.c | 14 +-------------
+ fs/fscache/internal.h | 2 ++
+ fs/fscache/main.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 42 insertions(+), 13 deletions(-)
+
+diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
+index 751bc5b1cddf..6104f627cc71 100644
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -74,10 +74,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie)
+ static int fscache_set_key(struct fscache_cookie *cookie,
+ const void *index_key, size_t index_key_len)
+ {
+- unsigned long long h;
+ u32 *buf;
+ int bufs;
+- int i;
+
+ bufs = DIV_ROUND_UP(index_key_len, sizeof(*buf));
+
+@@ -91,17 +89,7 @@ static int fscache_set_key(struct fscache_cookie *cookie,
+ }
+
+ memcpy(buf, index_key, index_key_len);
+-
+- /* Calculate a hash and combine this with the length in the first word
+- * or first half word
+- */
+- h = (unsigned long)cookie->parent;
+- h += index_key_len + cookie->type;
+-
+- for (i = 0; i < bufs; i++)
+- h += buf[i];
+-
+- cookie->key_hash = h ^ (h >> 32);
++ cookie->key_hash = fscache_hash(0, buf, bufs);
+ return 0;
+ }
+
+diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
+index c483863b740a..aee639d980ba 100644
+--- a/fs/fscache/internal.h
++++ b/fs/fscache/internal.h
+@@ -97,6 +97,8 @@ extern struct workqueue_struct *fscache_object_wq;
+ extern struct workqueue_struct *fscache_op_wq;
+ DECLARE_PER_CPU(wait_queue_head_t, fscache_object_cong_wait);
+
++extern unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n);
++
+ static inline bool fscache_object_congested(void)
+ {
+ return workqueue_congested(WORK_CPU_UNBOUND, fscache_object_wq);
+diff --git a/fs/fscache/main.c b/fs/fscache/main.c
+index c1e6cc9091aa..4207f98e405f 100644
+--- a/fs/fscache/main.c
++++ b/fs/fscache/main.c
+@@ -93,6 +93,45 @@ static struct ctl_table fscache_sysctls_root[] = {
+ };
+ #endif
+
++/*
++ * Mixing scores (in bits) for (7,20):
++ * Input delta: 1-bit 2-bit
++ * 1 round: 330.3 9201.6
++ * 2 rounds: 1246.4 25475.4
++ * 3 rounds: 1907.1 31295.1
++ * 4 rounds: 2042.3 31718.6
++ * Perfect: 2048 31744
++ * (32*64) (32*31/2 * 64)
++ */
++#define HASH_MIX(x, y, a) \
++ ( x ^= (a), \
++ y ^= x, x = rol32(x, 7),\
++ x += y, y = rol32(y,20),\
++ y *= 9 )
++
++static inline unsigned int fold_hash(unsigned long x, unsigned long y)
++{
++ /* Use arch-optimized multiply if one exists */
++ return __hash_32(y ^ __hash_32(x));
++}
++
++/*
++ * Generate a hash. This is derived from full_name_hash(), but we want to be
++ * sure it is arch independent and that it doesn't change as bits of the
++ * computed hash value might appear on disk. The caller also guarantees that
++ * the hashed data will be a series of aligned 32-bit words.
++ */
++unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n)
++{
++ unsigned int a, x = 0, y = salt;
++
++ for (; n; n--) {
++ a = *data++;
++ HASH_MIX(x, y, a);
++ }
++ return fold_hash(x, y);
++}
++
+ /*
+ * initialise the fs caching module
+ */
+--
+2.30.2
+
--- /dev/null
+From 41c15602361f0b74584c947aaa0f2071f31e6da6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 12:41:49 -0500
+Subject: gfs2: Don't call dlm after protocol is unmounted
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit d1340f80f0b8066321b499a376780da00560e857 ]
+
+In the gfs2 withdraw sequence, the dlm protocol is unmounted with a call
+to lm_unmount. After a withdraw, users are allowed to unmount the
+withdrawn file system. But at that point we may still have glocks left
+over that we need to free via unmount's call to gfs2_gl_hash_clear.
+These glocks may have never been completed because of whatever problem
+caused the withdraw (IO errors or whatever).
+
+Before this patch, function gdlm_put_lock would still try to call into
+dlm to unlock these leftover glocks, which resulted in dlm returning
+-EINVAL because the lock space was abandoned. These glocks were never
+freed because there was no mechanism after that to free them.
+
+This patch adds a check to gdlm_put_lock to see if the locking protocol
+was inactive (DFL_UNMOUNT flag) and if so, free the glock and not
+make the invalid call into dlm.
+
+I could have combined this "if" with the one that follows, related to
+leftover glock LVBs, but I felt the code was more readable with its own
+if clause.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/lock_dlm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index dac040162ecc..50578f881e6d 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -299,6 +299,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_update_request_times(gl);
+
++ /* don't want to call dlm if we've unmounted the lock protocol */
++ if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
++ gfs2_glock_free(gl);
++ return;
++ }
+ /* don't want to skip dlm_unlock writing the lvb when lock has one */
+
+ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
+--
+2.30.2
+
--- /dev/null
+From f52f83178bf80bf135e0976d7c4b566a102eac95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jun 2021 09:41:40 -0500
+Subject: gfs2: Fix glock recursion in freeze_go_xmote_bh
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 9d9b16054b7d357afde69a027514c695092b0d22 ]
+
+We must not call gfs2_consist (which does a file system withdraw) from
+the freeze glock's freeze_go_xmote_bh function because the withdraw
+will try to use the freeze glock, thus causing a glock recursion error.
+
+This patch changes freeze_go_xmote_bh to call function
+gfs2_assert_withdraw_delayed instead of gfs2_consist to avoid recursion.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glops.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
+index 54d3fbeb3002..384565d63eea 100644
+--- a/fs/gfs2/glops.c
++++ b/fs/gfs2/glops.c
+@@ -610,16 +610,13 @@ static int freeze_go_xmote_bh(struct gfs2_glock *gl)
+ j_gl->gl_ops->go_inval(j_gl, DIO_METADATA);
+
+ error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
+- if (error)
+- gfs2_consist(sdp);
+- if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT))
+- gfs2_consist(sdp);
+-
+- /* Initialize some head of the log stuff */
+- if (!gfs2_withdrawn(sdp)) {
+- sdp->sd_log_sequence = head.lh_sequence + 1;
+- gfs2_log_pointers_init(sdp, head.lh_blkno);
+- }
++ if (gfs2_assert_withdraw_delayed(sdp, !error))
++ return error;
++ if (gfs2_assert_withdraw_delayed(sdp, head.lh_flags &
++ GFS2_LOG_HEAD_UNMOUNT))
++ return -EIO;
++ sdp->sd_log_sequence = head.lh_sequence + 1;
++ gfs2_log_pointers_init(sdp, head.lh_blkno);
+ }
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 384f59116efa71c4eedc7b671d9f02fa6d5e81b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 04:34:58 -0700
+Subject: gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible
+ uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit a211260c34cfadc6068fece8c9e99e0fe1e2a2b6 ]
+
+The variable val is declared without initialization, and its address is
+passed to amdgpu_i2c_get_byte(). In this function, the value of val is
+accessed in:
+ DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
+ addr, *val);
+
+Also, when amdgpu_i2c_get_byte() returns, val may remain uninitialized,
+but it is accessed in:
+ val &= ~amdgpu_connector->router.ddc_mux_control_pin;
+
+To fix this possible uninitialized-variable access, initialize val to 0 in
+amdgpu_i2c_router_select_ddc_port().
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+index bca4dddd5a15..82608df43396 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus,
+ void
+ amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector *amdgpu_connector)
+ {
+- u8 val;
++ u8 val = 0;
+
+ if (!amdgpu_connector->router.ddc_valid)
+ return;
+--
+2.30.2
+
--- /dev/null
+From 0736b46ca4518d213349b69aab1e8043d0bd4673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 19:33:37 +0530
+Subject: HID: amd_sfh: Fix period data field to enable sensor
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 3978f54817559b28535c58a00d3d31bbd5d0b65a ]
+
+Existing amd-sfh driver is programming the MP2 firmware period field in
+units of jiffies, but the MP2 firmware expects in milliseconds unit.
+
+Changing it to milliseconds.
+
+Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)")
+Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+index efb849411d25..4710b9aa24a5 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+@@ -184,7 +184,7 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
+ rc = -ENOMEM;
+ goto cleanup;
+ }
+- info.period = msecs_to_jiffies(AMD_SFH_IDLE_LOOP);
++ info.period = AMD_SFH_IDLE_LOOP;
+ info.sensor_idx = cl_idx;
+ info.dma_address = cl_data->sensor_dma_addr[i];
+
+--
+2.30.2
+
--- /dev/null
+From 45808c1cd376bc60bbc8fd3564a9d58f1e4da91f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 23:55:05 -0700
+Subject: HID: i2c-hid: Fix Elan touchpad regression
+
+From: Jim Broadus <jbroadus@gmail.com>
+
+[ Upstream commit 786537063bbfb3a7ebc6fc21b2baf37fb91df401 ]
+
+A quirk was recently added for Elan devices that has same device match
+as an entry earlier in the list. The i2c_hid_lookup_quirk function will
+always return the last match in the list, so the new entry shadows the
+old entry. The quirk in the previous entry, I2C_HID_QUIRK_BOGUS_IRQ,
+silenced a flood of messages which have reappeared in the 5.13 kernel.
+
+This change moves the two quirk flags into the same entry.
+
+Fixes: ca66a6770bd9 (HID: i2c-hid: Skip ELAN power-on command after reset)
+Signed-off-by: Jim Broadus <jbroadus@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 46474612e73c..517141138b00 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -171,8 +171,6 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+- { USB_VENDOR_ID_ELAN, HID_ANY_ID,
+- I2C_HID_QUIRK_BOGUS_IRQ },
+ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
+ I2C_HID_QUIRK_RESET_ON_RESUME },
+ { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
+@@ -183,7 +181,8 @@ static const struct i2c_hid_quirks {
+ * Sending the wakeup after reset actually break ELAN touchscreen controller
+ */
+ { USB_VENDOR_ID_ELAN, HID_ANY_ID,
+- I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET },
++ I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET |
++ I2C_HID_QUIRK_BOGUS_IRQ },
+ { 0, 0 }
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 3686acf2412b704eee544b1b2b22bd4f2246da4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 11:25:50 -0700
+Subject: HID: input: do not report stylus battery state as "full"
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]
+
+The power supply states of discharging, charging, full, etc, represent
+state of charging, not the capacity level of the battery (for which
+we have a separate property). Current HID usage tables to not allow
+for expressing charging state of the batteries found in generic
+styli, so we should simply assume that the battery is discharging
+even if current capacity is at 100% when battery strength reporting
+is done via HID interface. In fact, we were doing just that before
+commit 581c4484769e.
+
+This change helps UIs to not mis-represent fully charged batteries in
+styli as being charging/topping-off.
+
+Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
+Reported-by: Kenneth Albanowski <kenalba@google.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 4286a51f7f16..4b5ebeacd283 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -419,8 +419,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+
+ if (dev->battery_status == HID_BATTERY_UNKNOWN)
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+- else if (dev->battery_capacity == 100)
+- val->intval = POWER_SUPPLY_STATUS_FULL;
+ else
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+--
+2.30.2
+
--- /dev/null
+From a2fd895086f7600af3d155a2a206fa66a3b43b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:21:48 +0200
+Subject: HID: thrustmaster: clean up Makefile and adapt quirks
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit 462ba66198a4a8ea996028915af10a698086e302 ]
+
+Commit c49c33637802 ("HID: support for initialization of some Thrustmaster
+wheels") messed up the Makefile and quirks during the refactoring of this
+commit.
+
+Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs:
+
+HID_TMINIT
+Referencing files: drivers/hid/Makefile, drivers/hid/hid-quirks.c
+
+Following the discussion (see Link), CONFIG_HID_THRUSTMASTER is the
+intended config for CONFIG_HID_TMINIT and the file hid-tminit.c was
+actually added as hid-thrustmaster.c.
+
+So, clean up Makefile and adapt quirks to that refactoring.
+
+Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
+Link: https://lore.kernel.org/linux-input/CAKXUXMx6dByO03f3dX0X5zjvQp0j2AhJBg0vQFDmhZUhtKxRxw@mail.gmail.com/
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Makefile | 1 -
+ drivers/hid/hid-quirks.c | 2 --
+ 2 files changed, 3 deletions(-)
+
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index 1ea1a7c0b20f..e29efcb1c040 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -115,7 +115,6 @@ obj-$(CONFIG_HID_STEELSERIES) += hid-steelseries.o
+ obj-$(CONFIG_HID_SUNPLUS) += hid-sunplus.o
+ obj-$(CONFIG_HID_GREENASIA) += hid-gaff.o
+ obj-$(CONFIG_HID_THRUSTMASTER) += hid-tmff.o hid-thrustmaster.o
+-obj-$(CONFIG_HID_TMINIT) += hid-tminit.o
+ obj-$(CONFIG_HID_TIVO) += hid-tivo.o
+ obj-$(CONFIG_HID_TOPSEED) += hid-topseed.o
+ obj-$(CONFIG_HID_TWINHAN) += hid-twinhan.o
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 51b39bda9a9d..2e104682c22b 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -662,8 +662,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb653) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
+-#endif
+-#if IS_ENABLED(CONFIG_HID_TMINIT)
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65d) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_TIVO)
+--
+2.30.2
+
--- /dev/null
+From 736c47a8479295ff044af2c46f640cdc83e4cf00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 09:43:11 +0200
+Subject: hvsi: don't panic on tty_register_driver failure
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit 7ccbdcc4d08a6d7041e4849219bbb12ffa45db4c ]
+
+The alloc_tty_driver failure is handled gracefully in hvsi_init. But
+tty_register_driver is not. panic is called if that one fails.
+
+So handle the failure of tty_register_driver gracefully too. This will
+keep at least the console functional as it was enabled earlier by
+console_initcall in hvsi_console_init. Instead of shooting down the
+whole system.
+
+This means, we disable interrupts and restore hvsi_wait back to
+poll_for_state().
+
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20210723074317.32690-3-jslaby@suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/hvc/hvsi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c
+index bfc15279d5bc..f0bc8e780051 100644
+--- a/drivers/tty/hvc/hvsi.c
++++ b/drivers/tty/hvc/hvsi.c
+@@ -1038,7 +1038,7 @@ static const struct tty_operations hvsi_ops = {
+
+ static int __init hvsi_init(void)
+ {
+- int i;
++ int i, ret;
+
+ hvsi_driver = alloc_tty_driver(hvsi_count);
+ if (!hvsi_driver)
+@@ -1069,12 +1069,25 @@ static int __init hvsi_init(void)
+ }
+ hvsi_wait = wait_for_state; /* irqs active now */
+
+- if (tty_register_driver(hvsi_driver))
+- panic("Couldn't register hvsi console driver\n");
++ ret = tty_register_driver(hvsi_driver);
++ if (ret) {
++ pr_err("Couldn't register hvsi console driver\n");
++ goto err_free_irq;
++ }
+
+ printk(KERN_DEBUG "HVSI: registered %i devices\n", hvsi_count);
+
+ return 0;
++err_free_irq:
++ hvsi_wait = poll_for_state;
++ for (i = 0; i < hvsi_count; i++) {
++ struct hvsi_struct *hp = &hvsi_ports[i];
++
++ free_irq(hp->virq, hp);
++ }
++ tty_driver_kref_put(hvsi_driver);
++
++ return ret;
+ }
+ device_initcall(hvsi_init);
+
+--
+2.30.2
+
--- /dev/null
+From 56465e9b341c09427821621d151d5cf276fd644d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 22:51:31 +0000
+Subject: hwmon: (pmbus/ibm-cffps) Fix write bits for LED control
+
+From: Brandon Wyman <bjwyman@gmail.com>
+
+[ Upstream commit 76b72736f574ec38b3e94603ea5f74b1853f26b0 ]
+
+When doing a PMBus write for the LED control on the IBM Common Form
+Factor Power Supplies (ibm-cffps), the DAh command requires that bit 7
+be low and bit 6 be high in order to indicate that you are truly
+attempting to do a write.
+
+Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
+Link: https://lore.kernel.org/r/20210806225131.1808759-1-bjwyman@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ibm-cffps.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
+index 5668d8305b78..df712ce4b164 100644
+--- a/drivers/hwmon/pmbus/ibm-cffps.c
++++ b/drivers/hwmon/pmbus/ibm-cffps.c
+@@ -50,9 +50,9 @@
+ #define CFFPS_MFR_VAUX_FAULT BIT(6)
+ #define CFFPS_MFR_CURRENT_SHARE_WARNING BIT(7)
+
+-#define CFFPS_LED_BLINK BIT(0)
+-#define CFFPS_LED_ON BIT(1)
+-#define CFFPS_LED_OFF BIT(2)
++#define CFFPS_LED_BLINK (BIT(0) | BIT(6))
++#define CFFPS_LED_ON (BIT(1) | BIT(6))
++#define CFFPS_LED_OFF (BIT(2) | BIT(6))
+ #define CFFPS_BLINK_RATE_MS 250
+
+ enum {
+--
+2.30.2
+
--- /dev/null
+From e3286c4d241784606c569d963a154c451d80ef98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 13:38:56 +0100
+Subject: iavf: do not override the adapter state in the watchdog task
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 22c8fd71d3a5e6fe584ccc2c1e8760e5baefd5aa ]
+
+The iavf watchdog task overrides adapter->state to __IAVF_RESETTING
+when it detects a pending reset. Then schedules iavf_reset_task() which
+takes care of the reset.
+
+The reset task is capable of handling the reset without changing
+adapter->state. In fact we lose the state information when the watchdog
+task prematurely changes the adapter state. This may lead to a crash if
+instead of the reset task the iavf_remove() function gets called before
+the reset task.
+In that case (if we were in state __IAVF_RUNNING previously) the
+iavf_remove() function triggers iavf_close() which fails to close the
+device because of the incorrect state information.
+
+This may result in a crash due to pending interrupts.
+kernel BUG at drivers/pci/msi.c:357!
+[...]
+Call Trace:
+ [<ffffffffbddf24dd>] pci_disable_msix+0x3d/0x50
+ [<ffffffffc08d2a63>] iavf_reset_interrupt_capability+0x23/0x40 [iavf]
+ [<ffffffffc08d312a>] iavf_remove+0x10a/0x350 [iavf]
+ [<ffffffffbddd3359>] pci_device_remove+0x39/0xc0
+ [<ffffffffbdeb492f>] __device_release_driver+0x7f/0xf0
+ [<ffffffffbdeb49c3>] device_release_driver+0x23/0x30
+ [<ffffffffbddcabb4>] pci_stop_bus_device+0x84/0xa0
+ [<ffffffffbddcacc2>] pci_stop_and_remove_bus_device+0x12/0x20
+ [<ffffffffbddf361f>] pci_iov_remove_virtfn+0xaf/0x160
+ [<ffffffffbddf3bcc>] sriov_disable+0x3c/0xf0
+ [<ffffffffbddf3ca3>] pci_disable_sriov+0x23/0x30
+ [<ffffffffc0667365>] i40e_free_vfs+0x265/0x2d0 [i40e]
+ [<ffffffffc0667624>] i40e_pci_sriov_configure+0x144/0x1f0 [i40e]
+ [<ffffffffbddd5307>] sriov_numvfs_store+0x177/0x1d0
+Code: 00 00 e8 3c 25 e3 ff 49 c7 86 88 08 00 00 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7b 28 e8 0d 44
+RIP [<ffffffffbbbf1068>] free_msi_irqs+0x188/0x190
+
+The solution is to not touch the adapter->state in iavf_watchdog_task()
+and let the reset task handle the state transition.
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 606a01ce4073..0d0f16617dde 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1984,7 +1984,6 @@ static void iavf_watchdog_task(struct work_struct *work)
+ /* check for hw reset */
+ reg_val = rd32(hw, IAVF_VF_ARQLEN1) & IAVF_VF_ARQLEN1_ARQENABLE_MASK;
+ if (!reg_val) {
+- adapter->state = __IAVF_RESETTING;
+ adapter->flags |= IAVF_FLAG_RESET_PENDING;
+ adapter->aq_required = 0;
+ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+--
+2.30.2
+
--- /dev/null
+From e238cabab5427840fb0fd1c9f0fc07dd3e69e13c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 11:01:41 +0100
+Subject: iavf: fix locking of critical sections
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 226d528512cfac890a1619aea4301f3dd314fe60 ]
+
+To avoid races between iavf_init_task(), iavf_reset_task(),
+iavf_watchdog_task(), iavf_adminq_task() as well as the shutdown and
+remove functions more locking is required.
+The current protection by __IAVF_IN_CRITICAL_TASK is needed in
+additional places.
+
+- The reset task performs state transitions, therefore needs locking.
+- The adminq task acts on replies from the PF in
+ iavf_virtchnl_completion() which may alter the states.
+- The init task is not only run during probe but also if a VF gets stuck
+ to reinitialize it.
+- The shutdown function performs a state transition.
+- The remove function performs a state transition and also free's
+ resources.
+
+iavf_lock_timeout() is introduced to avoid waiting infinitely
+and cause a deadlock. Rather unlock and print a warning.
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 57 ++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 0d0f16617dde..e5e6a5b11e6d 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -131,6 +131,30 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw,
+ return 0;
+ }
+
++/**
++ * iavf_lock_timeout - try to set bit but give up after timeout
++ * @adapter: board private structure
++ * @bit: bit to set
++ * @msecs: timeout in msecs
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int iavf_lock_timeout(struct iavf_adapter *adapter,
++ enum iavf_critical_section_t bit,
++ unsigned int msecs)
++{
++ unsigned int wait, delay = 10;
++
++ for (wait = 0; wait < msecs; wait += delay) {
++ if (!test_and_set_bit(bit, &adapter->crit_section))
++ return 0;
++
++ msleep(delay);
++ }
++
++ return -1;
++}
++
+ /**
+ * iavf_schedule_reset - Set the flags and schedule a reset event
+ * @adapter: board private structure
+@@ -2097,6 +2121,10 @@ static void iavf_reset_task(struct work_struct *work)
+ if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
+ return;
+
++ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200)) {
++ schedule_work(&adapter->reset_task);
++ return;
++ }
+ while (test_and_set_bit(__IAVF_IN_CLIENT_TASK,
+ &adapter->crit_section))
+ usleep_range(500, 1000);
+@@ -2311,6 +2339,8 @@ static void iavf_adminq_task(struct work_struct *work)
+ if (!event.msg_buf)
+ goto out;
+
++ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200))
++ goto freedom;
+ do {
+ ret = iavf_clean_arq_element(hw, &event, &pending);
+ v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
+@@ -2324,6 +2354,7 @@ static void iavf_adminq_task(struct work_struct *work)
+ if (pending != 0)
+ memset(event.msg_buf, 0, IAVF_MAX_AQ_BUF_SIZE);
+ } while (pending);
++ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
+
+ if ((adapter->flags &
+ (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
+@@ -3628,6 +3659,10 @@ static void iavf_init_task(struct work_struct *work)
+ init_task.work);
+ struct iavf_hw *hw = &adapter->hw;
+
++ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) {
++ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
++ return;
++ }
+ switch (adapter->state) {
+ case __IAVF_STARTUP:
+ if (iavf_startup(adapter) < 0)
+@@ -3640,14 +3675,14 @@ static void iavf_init_task(struct work_struct *work)
+ case __IAVF_INIT_GET_RESOURCES:
+ if (iavf_init_get_resources(adapter) < 0)
+ goto init_failed;
+- return;
++ goto out;
+ default:
+ goto init_failed;
+ }
+
+ queue_delayed_work(iavf_wq, &adapter->init_task,
+ msecs_to_jiffies(30));
+- return;
++ goto out;
+ init_failed:
+ if (++adapter->aq_wait_count > IAVF_AQ_MAX_ERR) {
+ dev_err(&adapter->pdev->dev,
+@@ -3656,9 +3691,11 @@ static void iavf_init_task(struct work_struct *work)
+ iavf_shutdown_adminq(hw);
+ adapter->state = __IAVF_STARTUP;
+ queue_delayed_work(iavf_wq, &adapter->init_task, HZ * 5);
+- return;
++ goto out;
+ }
+ queue_delayed_work(iavf_wq, &adapter->init_task, HZ);
++out:
++ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
+ }
+
+ /**
+@@ -3675,9 +3712,12 @@ static void iavf_shutdown(struct pci_dev *pdev)
+ if (netif_running(netdev))
+ iavf_close(netdev);
+
++ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
++ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
+ /* Prevent the watchdog from running. */
+ adapter->state = __IAVF_REMOVE;
+ adapter->aq_required = 0;
++ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
+
+ #ifdef CONFIG_PM
+ pci_save_state(pdev);
+@@ -3911,10 +3951,6 @@ static void iavf_remove(struct pci_dev *pdev)
+ err);
+ }
+
+- /* Shut down all the garbage mashers on the detention level */
+- adapter->state = __IAVF_REMOVE;
+- adapter->aq_required = 0;
+- adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
+ iavf_request_reset(adapter);
+ msleep(50);
+ /* If the FW isn't responding, kick it once, but only once. */
+@@ -3922,6 +3958,13 @@ static void iavf_remove(struct pci_dev *pdev)
+ iavf_request_reset(adapter);
+ msleep(50);
+ }
++ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
++ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
++
++ /* Shut down all the garbage mashers on the detention level */
++ adapter->state = __IAVF_REMOVE;
++ adapter->aq_required = 0;
++ adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
+ iavf_free_all_tx_resources(adapter);
+ iavf_free_all_rx_resources(adapter);
+ iavf_misc_irq_disable(adapter);
+--
+2.30.2
+
--- /dev/null
+From 49aed9af63502f519c3c30b89b859cef6d0f4b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 10:22:24 +0200
+Subject: iavf: use mutexes for locking of critical sections
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 5ac49f3c2702f269d31cc37eb9308bc557953c4d ]
+
+As follow-up to the discussion with Jakub Kicinski about iavf locking
+being insufficient [1] convert iavf to use mutexes instead of bitops.
+The locking logic is kept as is, just a drop-in replacement of
+enum iavf_critical_section_t with separate mutexes.
+The only difference is that the mutexes will be destroyed before the
+module is unloaded.
+
+[1] https://lwn.net/ml/netdev/20210316150210.00007249%40intel.com/
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Marek Szlosek <marek.szlosek@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf.h | 9 +-
+ .../net/ethernet/intel/iavf/iavf_ethtool.c | 10 +-
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 100 +++++++++---------
+ 3 files changed, 56 insertions(+), 63 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h
+index 90793b36126e..68c80f04113c 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf.h
++++ b/drivers/net/ethernet/intel/iavf/iavf.h
+@@ -186,12 +186,6 @@ enum iavf_state_t {
+ __IAVF_RUNNING, /* opened, working */
+ };
+
+-enum iavf_critical_section_t {
+- __IAVF_IN_CRITICAL_TASK, /* cannot be interrupted */
+- __IAVF_IN_CLIENT_TASK,
+- __IAVF_IN_REMOVE_TASK, /* device being removed */
+-};
+-
+ #define IAVF_CLOUD_FIELD_OMAC 0x01
+ #define IAVF_CLOUD_FIELD_IMAC 0x02
+ #define IAVF_CLOUD_FIELD_IVLAN 0x04
+@@ -236,6 +230,9 @@ struct iavf_adapter {
+ struct iavf_q_vector *q_vectors;
+ struct list_head vlan_filter_list;
+ struct list_head mac_filter_list;
++ struct mutex crit_lock;
++ struct mutex client_lock;
++ struct mutex remove_lock;
+ /* Lock to protect accesses to MAC and VLAN lists */
+ spinlock_t mac_vlan_list_lock;
+ char misc_vector_name[IFNAMSIZ + 9];
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+index af43fbd8cb75..edbeb27213f8 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+@@ -1352,8 +1352,7 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx
+ if (!fltr)
+ return -ENOMEM;
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section)) {
++ while (!mutex_trylock(&adapter->crit_lock)) {
+ if (--count == 0) {
+ kfree(fltr);
+ return -EINVAL;
+@@ -1378,7 +1377,7 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx
+ if (err && fltr)
+ kfree(fltr);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ return err;
+ }
+
+@@ -1563,8 +1562,7 @@ iavf_set_adv_rss_hash_opt(struct iavf_adapter *adapter,
+ return -EINVAL;
+ }
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section)) {
++ while (!mutex_trylock(&adapter->crit_lock)) {
+ if (--count == 0) {
+ kfree(rss_new);
+ return -EINVAL;
+@@ -1600,7 +1598,7 @@ iavf_set_adv_rss_hash_opt(struct iavf_adapter *adapter,
+ if (!err)
+ mod_delayed_work(iavf_wq, &adapter->watchdog_task, 0);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ if (!rss_new_add)
+ kfree(rss_new);
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index e5e6a5b11e6d..23762a7ef740 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -132,21 +132,18 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw,
+ }
+
+ /**
+- * iavf_lock_timeout - try to set bit but give up after timeout
+- * @adapter: board private structure
+- * @bit: bit to set
++ * iavf_lock_timeout - try to lock mutex but give up after timeout
++ * @lock: mutex that should be locked
+ * @msecs: timeout in msecs
+ *
+ * Returns 0 on success, negative on failure
+ **/
+-static int iavf_lock_timeout(struct iavf_adapter *adapter,
+- enum iavf_critical_section_t bit,
+- unsigned int msecs)
++static int iavf_lock_timeout(struct mutex *lock, unsigned int msecs)
+ {
+ unsigned int wait, delay = 10;
+
+ for (wait = 0; wait < msecs; wait += delay) {
+- if (!test_and_set_bit(bit, &adapter->crit_section))
++ if (mutex_trylock(lock))
+ return 0;
+
+ msleep(delay);
+@@ -1940,7 +1937,7 @@ static void iavf_watchdog_task(struct work_struct *work)
+ struct iavf_hw *hw = &adapter->hw;
+ u32 reg_val;
+
+- if (test_and_set_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section))
++ if (!mutex_trylock(&adapter->crit_lock))
+ goto restart_watchdog;
+
+ if (adapter->flags & IAVF_FLAG_PF_COMMS_FAILED)
+@@ -1958,8 +1955,7 @@ static void iavf_watchdog_task(struct work_struct *work)
+ adapter->state = __IAVF_STARTUP;
+ adapter->flags &= ~IAVF_FLAG_PF_COMMS_FAILED;
+ queue_delayed_work(iavf_wq, &adapter->init_task, 10);
+- clear_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ /* Don't reschedule the watchdog, since we've restarted
+ * the init task. When init_task contacts the PF and
+ * gets everything set up again, it'll restart the
+@@ -1969,14 +1965,13 @@ static void iavf_watchdog_task(struct work_struct *work)
+ }
+ adapter->aq_required = 0;
+ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+- clear_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ queue_delayed_work(iavf_wq,
+ &adapter->watchdog_task,
+ msecs_to_jiffies(10));
+ goto watchdog_done;
+ case __IAVF_RESETTING:
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ queue_delayed_work(iavf_wq, &adapter->watchdog_task, HZ * 2);
+ return;
+ case __IAVF_DOWN:
+@@ -1999,7 +1994,7 @@ static void iavf_watchdog_task(struct work_struct *work)
+ }
+ break;
+ case __IAVF_REMOVE:
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ return;
+ default:
+ goto restart_watchdog;
+@@ -2021,7 +2016,7 @@ static void iavf_watchdog_task(struct work_struct *work)
+ if (adapter->state == __IAVF_RUNNING ||
+ adapter->state == __IAVF_COMM_FAILED)
+ iavf_detect_recover_hung(&adapter->vsi);
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ restart_watchdog:
+ if (adapter->aq_required)
+ queue_delayed_work(iavf_wq, &adapter->watchdog_task,
+@@ -2085,7 +2080,7 @@ static void iavf_disable_vf(struct iavf_adapter *adapter)
+ memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE);
+ iavf_shutdown_adminq(&adapter->hw);
+ adapter->netdev->flags &= ~IFF_UP;
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ adapter->flags &= ~IAVF_FLAG_RESET_PENDING;
+ adapter->state = __IAVF_DOWN;
+ wake_up(&adapter->down_waitqueue);
+@@ -2118,15 +2113,14 @@ static void iavf_reset_task(struct work_struct *work)
+ /* When device is being removed it doesn't make sense to run the reset
+ * task, just return in such a case.
+ */
+- if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
++ if (mutex_is_locked(&adapter->remove_lock))
+ return;
+
+- if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200)) {
++ if (iavf_lock_timeout(&adapter->crit_lock, 200)) {
+ schedule_work(&adapter->reset_task);
+ return;
+ }
+- while (test_and_set_bit(__IAVF_IN_CLIENT_TASK,
+- &adapter->crit_section))
++ while (!mutex_trylock(&adapter->client_lock))
+ usleep_range(500, 1000);
+ if (CLIENT_ENABLED(adapter)) {
+ adapter->flags &= ~(IAVF_FLAG_CLIENT_NEEDS_OPEN |
+@@ -2178,7 +2172,7 @@ static void iavf_reset_task(struct work_struct *work)
+ dev_err(&adapter->pdev->dev, "Reset never finished (%x)\n",
+ reg_val);
+ iavf_disable_vf(adapter);
+- clear_bit(__IAVF_IN_CLIENT_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->client_lock);
+ return; /* Do not attempt to reinit. It's dead, Jim. */
+ }
+
+@@ -2305,13 +2299,13 @@ static void iavf_reset_task(struct work_struct *work)
+ adapter->state = __IAVF_DOWN;
+ wake_up(&adapter->down_waitqueue);
+ }
+- clear_bit(__IAVF_IN_CLIENT_TASK, &adapter->crit_section);
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->client_lock);
++ mutex_unlock(&adapter->crit_lock);
+
+ return;
+ reset_err:
+- clear_bit(__IAVF_IN_CLIENT_TASK, &adapter->crit_section);
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->client_lock);
++ mutex_unlock(&adapter->crit_lock);
+ dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n");
+ iavf_close(netdev);
+ }
+@@ -2339,7 +2333,7 @@ static void iavf_adminq_task(struct work_struct *work)
+ if (!event.msg_buf)
+ goto out;
+
+- if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200))
++ if (iavf_lock_timeout(&adapter->crit_lock, 200))
+ goto freedom;
+ do {
+ ret = iavf_clean_arq_element(hw, &event, &pending);
+@@ -2354,7 +2348,7 @@ static void iavf_adminq_task(struct work_struct *work)
+ if (pending != 0)
+ memset(event.msg_buf, 0, IAVF_MAX_AQ_BUF_SIZE);
+ } while (pending);
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ if ((adapter->flags &
+ (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
+@@ -2421,7 +2415,7 @@ static void iavf_client_task(struct work_struct *work)
+ * later.
+ */
+
+- if (test_and_set_bit(__IAVF_IN_CLIENT_TASK, &adapter->crit_section))
++ if (!mutex_trylock(&adapter->client_lock))
+ return;
+
+ if (adapter->flags & IAVF_FLAG_SERVICE_CLIENT_REQUESTED) {
+@@ -2444,7 +2438,7 @@ static void iavf_client_task(struct work_struct *work)
+ adapter->flags &= ~IAVF_FLAG_CLIENT_NEEDS_OPEN;
+ }
+ out:
+- clear_bit(__IAVF_IN_CLIENT_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->client_lock);
+ }
+
+ /**
+@@ -3047,8 +3041,7 @@ static int iavf_configure_clsflower(struct iavf_adapter *adapter,
+ if (!filter)
+ return -ENOMEM;
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section)) {
++ while (!mutex_trylock(&adapter->crit_lock)) {
+ if (--count == 0)
+ goto err;
+ udelay(1);
+@@ -3079,7 +3072,7 @@ static int iavf_configure_clsflower(struct iavf_adapter *adapter,
+ if (err)
+ kfree(filter);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ return err;
+ }
+
+@@ -3226,8 +3219,7 @@ static int iavf_open(struct net_device *netdev)
+ return -EIO;
+ }
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
++ while (!mutex_trylock(&adapter->crit_lock))
+ usleep_range(500, 1000);
+
+ if (adapter->state != __IAVF_DOWN) {
+@@ -3262,7 +3254,7 @@ static int iavf_open(struct net_device *netdev)
+
+ iavf_irq_enable(adapter, true);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ return 0;
+
+@@ -3274,7 +3266,7 @@ static int iavf_open(struct net_device *netdev)
+ err_setup_tx:
+ iavf_free_all_tx_resources(adapter);
+ err_unlock:
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ return err;
+ }
+@@ -3298,8 +3290,7 @@ static int iavf_close(struct net_device *netdev)
+ if (adapter->state <= __IAVF_DOWN_PENDING)
+ return 0;
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
++ while (!mutex_trylock(&adapter->crit_lock))
+ usleep_range(500, 1000);
+
+ set_bit(__IAVF_VSI_DOWN, adapter->vsi.state);
+@@ -3310,7 +3301,7 @@ static int iavf_close(struct net_device *netdev)
+ adapter->state = __IAVF_DOWN_PENDING;
+ iavf_free_traffic_irqs(adapter);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ /* We explicitly don't free resources here because the hardware is
+ * still active and can DMA into memory. Resources are cleared in
+@@ -3659,8 +3650,8 @@ static void iavf_init_task(struct work_struct *work)
+ init_task.work);
+ struct iavf_hw *hw = &adapter->hw;
+
+- if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) {
+- dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
++ if (iavf_lock_timeout(&adapter->crit_lock, 5000)) {
++ dev_warn(&adapter->pdev->dev, "failed to acquire crit_lock in %s\n", __FUNCTION__);
+ return;
+ }
+ switch (adapter->state) {
+@@ -3695,7 +3686,7 @@ static void iavf_init_task(struct work_struct *work)
+ }
+ queue_delayed_work(iavf_wq, &adapter->init_task, HZ);
+ out:
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+ }
+
+ /**
+@@ -3712,12 +3703,12 @@ static void iavf_shutdown(struct pci_dev *pdev)
+ if (netif_running(netdev))
+ iavf_close(netdev);
+
+- if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
+- dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
++ if (iavf_lock_timeout(&adapter->crit_lock, 5000))
++ dev_warn(&adapter->pdev->dev, "failed to acquire crit_lock in %s\n", __FUNCTION__);
+ /* Prevent the watchdog from running. */
+ adapter->state = __IAVF_REMOVE;
+ adapter->aq_required = 0;
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ #ifdef CONFIG_PM
+ pci_save_state(pdev);
+@@ -3811,6 +3802,9 @@ static int iavf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* set up the locks for the AQ, do this only once in probe
+ * and destroy them only once in remove
+ */
++ mutex_init(&adapter->crit_lock);
++ mutex_init(&adapter->client_lock);
++ mutex_init(&adapter->remove_lock);
+ mutex_init(&hw->aq.asq_mutex);
+ mutex_init(&hw->aq.arq_mutex);
+
+@@ -3862,8 +3856,7 @@ static int __maybe_unused iavf_suspend(struct device *dev_d)
+
+ netif_device_detach(netdev);
+
+- while (test_and_set_bit(__IAVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
++ while (!mutex_trylock(&adapter->crit_lock))
+ usleep_range(500, 1000);
+
+ if (netif_running(netdev)) {
+@@ -3874,7 +3867,7 @@ static int __maybe_unused iavf_suspend(struct device *dev_d)
+ iavf_free_misc_irq(adapter);
+ iavf_reset_interrupt_capability(adapter);
+
+- clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ mutex_unlock(&adapter->crit_lock);
+
+ return 0;
+ }
+@@ -3936,7 +3929,7 @@ static void iavf_remove(struct pci_dev *pdev)
+ struct iavf_hw *hw = &adapter->hw;
+ int err;
+ /* Indicate we are in remove and not to run reset_task */
+- set_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section);
++ mutex_lock(&adapter->remove_lock);
+ cancel_delayed_work_sync(&adapter->init_task);
+ cancel_work_sync(&adapter->reset_task);
+ cancel_delayed_work_sync(&adapter->client_task);
+@@ -3958,8 +3951,8 @@ static void iavf_remove(struct pci_dev *pdev)
+ iavf_request_reset(adapter);
+ msleep(50);
+ }
+- if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
+- dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
++ if (iavf_lock_timeout(&adapter->crit_lock, 5000))
++ dev_warn(&adapter->pdev->dev, "failed to acquire crit_lock in %s\n", __FUNCTION__);
+
+ /* Shut down all the garbage mashers on the detention level */
+ adapter->state = __IAVF_REMOVE;
+@@ -3984,6 +3977,11 @@ static void iavf_remove(struct pci_dev *pdev)
+ /* destroy the locks only once, here */
+ mutex_destroy(&hw->aq.arq_mutex);
+ mutex_destroy(&hw->aq.asq_mutex);
++ mutex_destroy(&adapter->client_lock);
++ mutex_unlock(&adapter->crit_lock);
++ mutex_destroy(&adapter->crit_lock);
++ mutex_unlock(&adapter->remove_lock);
++ mutex_destroy(&adapter->remove_lock);
+
+ iounmap(hw->hw_addr);
+ pci_release_regions(pdev);
+--
+2.30.2
+
--- /dev/null
+From 920183750e04af1742030980e8833a47ddc5c37c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 12:04:45 -0400
+Subject: IB/hfi1: Adjust pkey entry in index 0
+
+From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+
+[ Upstream commit 62004871e1fa7f9a60797595c03477af5b5ec36f ]
+
+It is possible for the primary IPoIB network device associated with any
+RDMA device to fail to join certain multicast groups preventing IPv6
+neighbor discovery and possibly other network ULPs from working
+correctly. The IPv4 broadcast group is not affected as the IPoIB network
+device handles joining that multicast group directly.
+
+This is because the primary IPoIB network device uses the pkey at ndex 0
+in the associated RDMA device's pkey table. Anytime the pkey value of
+index 0 changes, the primary IPoIB network device automatically modifies
+it's broadcast address (i.e. /sys/class/net/[ib0]/broadcast), since the
+broadcast address includes the pkey value, and then bounces carrier. This
+includes initial pkey assignment, such as when the pkey at index 0
+transitions from the opa default of invalid (0x0000) to some value such as
+the OPA default pkey for Virtual Fabric 0: 0x8001 or when the fabric
+manager is restarted with a configuration change causing the pkey at index
+0 to change. Many network ULPs are not sensitive to the carrier bounce and
+are not expecting the broadcast address to change including the linux IPv6
+stack. This problem does not affect IPoIB child network devices as their
+pkey value is constant for all time.
+
+To mitigate this issue, change the default pkey in at index 0 to 0x8001 to
+cover the predominant case and avoid issues as ipoib comes up and the FM
+sweeps.
+
+At some point, ipoib multicast support should automatically fix
+non-broadcast addresses as it does with the primary broadcast address.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210715160445.142451.47651.stgit@awfm-01.cornelisnetworks.com
+Suggested-by: Josh Collier <josh.d.collier@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/init.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
+index 0986aa065418..34106e5be679 100644
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -650,12 +650,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
+
+ ppd->pkeys[default_pkey_idx] = DEFAULT_P_KEY;
+ ppd->part_enforce |= HFI1_PART_ENFORCE_IN;
+-
+- if (loopback) {
+- dd_dev_err(dd, "Faking data partition 0x8001 in idx %u\n",
+- !default_pkey_idx);
+- ppd->pkeys[!default_pkey_idx] = 0x8001;
+- }
++ ppd->pkeys[0] = 0x8001;
+
+ INIT_WORK(&ppd->link_vc_work, handle_verify_cap);
+ INIT_WORK(&ppd->link_up_work, handle_link_up);
+--
+2.30.2
+
--- /dev/null
+From bf1bee37977957f5e4be5857ab2505a61ae375b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jun 2021 15:19:39 +0300
+Subject: igc: Check if num of q_vectors is smaller than max before array
+ access
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 373e2829e7c2e1e606503cdb5c97749f512a4be9 ]
+
+Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed
+beyond its size. It was fixed by using a local variable num_q_vectors
+as a limit for loop index, and ensure that num_q_vectors is not bigger
+than MAX_Q_VECTORS.
+
+Suggested-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index ed2d66bc2d6c..f62982c4d933 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -4817,6 +4817,7 @@ static irqreturn_t igc_msix_ring(int irq, void *data)
+ */
+ static int igc_request_msix(struct igc_adapter *adapter)
+ {
++ unsigned int num_q_vectors = adapter->num_q_vectors;
+ int i = 0, err = 0, vector = 0, free_vector = 0;
+ struct net_device *netdev = adapter->netdev;
+
+@@ -4825,7 +4826,13 @@ static int igc_request_msix(struct igc_adapter *adapter)
+ if (err)
+ goto err_out;
+
+- for (i = 0; i < adapter->num_q_vectors; i++) {
++ if (num_q_vectors > MAX_Q_VECTORS) {
++ num_q_vectors = MAX_Q_VECTORS;
++ dev_warn(&adapter->pdev->dev,
++ "The number of queue vectors (%d) is higher than max allowed (%d)\n",
++ adapter->num_q_vectors, MAX_Q_VECTORS);
++ }
++ for (i = 0; i < num_q_vectors; i++) {
+ struct igc_q_vector *q_vector = adapter->q_vector[i];
+
+ vector++;
+--
+2.30.2
+
--- /dev/null
+From a87654049118d8f24117e0434d3d9782fbd74966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jun 2021 17:32:37 +0100
+Subject: iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 97683c851f9cdbd3ea55697cbe2dcb6af4287bbd ]
+
+The naming of the regulator is problematic. VCC is usually a supply
+voltage whereas these devices have a separate VREF pin.
+
+Secondly, the regulator core might have provided a stub regulator if
+a real regulator wasn't provided. That would in turn have failed to
+provide a voltage when queried. So reality was that there was no way
+to use the internal reference.
+
+In order to avoid breaking any dts out in the wild, make sure to fallback
+to the original vcc naming if vref is not available.
+
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20210627163244.1090296-9-jic23@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/ad5624r_spi.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
+index 9bde86982912..530529feebb5 100644
+--- a/drivers/iio/dac/ad5624r_spi.c
++++ b/drivers/iio/dac/ad5624r_spi.c
+@@ -229,7 +229,7 @@ static int ad5624r_probe(struct spi_device *spi)
+ if (!indio_dev)
+ return -ENOMEM;
+ st = iio_priv(indio_dev);
+- st->reg = devm_regulator_get(&spi->dev, "vcc");
++ st->reg = devm_regulator_get_optional(&spi->dev, "vref");
+ if (!IS_ERR(st->reg)) {
+ ret = regulator_enable(st->reg);
+ if (ret)
+@@ -240,6 +240,22 @@ static int ad5624r_probe(struct spi_device *spi)
+ goto error_disable_reg;
+
+ voltage_uv = ret;
++ } else {
++ if (PTR_ERR(st->reg) != -ENODEV)
++ return PTR_ERR(st->reg);
++ /* Backwards compatibility. This naming is not correct */
++ st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
++ if (!IS_ERR(st->reg)) {
++ ret = regulator_enable(st->reg);
++ if (ret)
++ return ret;
++
++ ret = regulator_get_voltage(st->reg);
++ if (ret < 0)
++ goto error_disable_reg;
++
++ voltage_uv = ret;
++ }
+ }
+
+ spi_set_drvdata(spi, indio_dev);
+--
+2.30.2
+
--- /dev/null
+From 140bbef57113ae67aea10307f03bb925df8589d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 18:32:55 -0700
+Subject: iomap: pass writeback errors to the mapping
+
+From: Darrick J. Wong <djwong@kernel.org>
+
+[ Upstream commit b69eea82d37d9ee7cfb3bf05103549dd4ed5ffc3 ]
+
+Modern-day mapping_set_error has the ability to squash the usual
+negative error code into something appropriate for long-term storage in
+a struct address_space -- ENOSPC becomes AS_ENOSPC, and everything else
+becomes EIO. iomap squashes /everything/ to EIO, just as XFS did before
+that, but this doesn't make sense.
+
+Fix this by making it so that we can pass ENOSPC to userspace when
+writeback fails due to space problems.
+
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap/buffered-io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
+index 87ccb3438bec..b06138c6190b 100644
+--- a/fs/iomap/buffered-io.c
++++ b/fs/iomap/buffered-io.c
+@@ -1016,7 +1016,7 @@ iomap_finish_page_writeback(struct inode *inode, struct page *page,
+
+ if (error) {
+ SetPageError(page);
+- mapping_set_error(inode->i_mapping, -EIO);
++ mapping_set_error(inode->i_mapping, error);
+ }
+
+ WARN_ON_ONCE(i_blocks_per_page(inode, page) > 1 && !iop);
+--
+2.30.2
+
--- /dev/null
+From 5e04b3c010a2c157030f66f57812e37417f10f6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 21:48:44 +0800
+Subject: iommu/vt-d: Update the virtual command related registers
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 4d99efb229e63928c6b03a756a2e38cd4777fbe8 ]
+
+The VT-d spec Revision 3.3 updated the virtual command registers, virtual
+command opcode B register, virtual command response register and virtual
+command capability register (Section 10.4.43, 10.4.44, 10.4.45, 10.4.46).
+This updates the virtual command interface implementation in the Intel
+IOMMU driver accordingly.
+
+Fixes: 24f27d32ab6b7 ("iommu/vt-d: Enlightened PASID allocation")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Sanjay Kumar <sanjay.k.kumar@intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20210713042649.3547403-1-baolu.lu@linux.intel.com
+Link: https://lore.kernel.org/r/20210818134852.1847070-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.h | 10 +++++-----
+ include/linux/intel-iommu.h | 6 +++---
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
+index c11bc8b833b8..d5552e2c160d 100644
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -28,12 +28,12 @@
+ #define VCMD_CMD_ALLOC 0x1
+ #define VCMD_CMD_FREE 0x2
+ #define VCMD_VRSP_IP 0x1
+-#define VCMD_VRSP_SC(e) (((e) >> 1) & 0x3)
++#define VCMD_VRSP_SC(e) (((e) & 0xff) >> 1)
+ #define VCMD_VRSP_SC_SUCCESS 0
+-#define VCMD_VRSP_SC_NO_PASID_AVAIL 2
+-#define VCMD_VRSP_SC_INVALID_PASID 2
+-#define VCMD_VRSP_RESULT_PASID(e) (((e) >> 8) & 0xfffff)
+-#define VCMD_CMD_OPERAND(e) ((e) << 8)
++#define VCMD_VRSP_SC_NO_PASID_AVAIL 16
++#define VCMD_VRSP_SC_INVALID_PASID 16
++#define VCMD_VRSP_RESULT_PASID(e) (((e) >> 16) & 0xfffff)
++#define VCMD_CMD_OPERAND(e) ((e) << 16)
+ /*
+ * Domain ID reserved for pasid entries programmed for first-level
+ * only and pass-through transfer modes.
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index d0fa0b31994d..05a65eb155f7 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -124,9 +124,9 @@
+ #define DMAR_MTRR_PHYSMASK8_REG 0x208
+ #define DMAR_MTRR_PHYSBASE9_REG 0x210
+ #define DMAR_MTRR_PHYSMASK9_REG 0x218
+-#define DMAR_VCCAP_REG 0xe00 /* Virtual command capability register */
+-#define DMAR_VCMD_REG 0xe10 /* Virtual command register */
+-#define DMAR_VCRSP_REG 0xe20 /* Virtual command response register */
++#define DMAR_VCCAP_REG 0xe30 /* Virtual command capability register */
++#define DMAR_VCMD_REG 0xe00 /* Virtual command register */
++#define DMAR_VCRSP_REG 0xe10 /* Virtual command response register */
+
+ #define DMAR_IQER_REG_IQEI(reg) FIELD_GET(GENMASK_ULL(3, 0), reg)
+ #define DMAR_IQER_REG_ITESID(reg) FIELD_GET(GENMASK_ULL(47, 32), reg)
+--
+2.30.2
+
--- /dev/null
+From 75aab4827a2d407658fa931b64b0d62db8751cf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 14:52:51 -0500
+Subject: ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit 6321c7acb82872ef6576c520b0e178eaad3a25c0 ]
+
+Fix the following out-of-bounds warning:
+
+ In function 'ip_copy_addrs',
+ inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2:
+net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds]
+ 449 | memcpy(&iph->saddr, &fl4->saddr,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 450 | sizeof(fl4->saddr) + sizeof(fl4->daddr));
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The problem is that the original code is trying to copy data into a
+couple of struct members adjacent to each other in a single call to
+memcpy(). This causes a legitimate compiler warning because memcpy()
+overruns the length of &iph->saddr and &fl4->saddr. As these are just
+a couple of struct members, fix this by using direct assignments,
+instead of memcpy().
+
+This helps with the ongoing efforts to globally enable -Warray-bounds
+and get us closer to being able to tighten the FORTIFY_SOURCE routines
+on memcpy().
+
+Link: https://github.com/KSPP/linux/issues/109
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 8d8a8da3ae7e..a202dcec0dc2 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -446,8 +446,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
+ {
+ BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) !=
+ offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr));
+- memcpy(&iph->saddr, &fl4->saddr,
+- sizeof(fl4->saddr) + sizeof(fl4->daddr));
++
++ iph->saddr = fl4->saddr;
++ iph->daddr = fl4->daddr;
+ }
+
+ /* Note: skb->sk can be different from sk, in case of tunnels */
+--
+2.30.2
+
--- /dev/null
+From f02e7f0207617b5e43f895e9e538c010197c89e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 14:21:54 +0300
+Subject: iwlwifi: fw: correctly limit to monitor dump
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit e6344c060209ef4e970cac18adeac1676a2a73cd ]
+
+In commit 79f033f6f229 ("iwlwifi: dbg: don't limit dump decisions
+to all or monitor") we changed the code to pass around a bitmap,
+but in the monitor_only case, one place accidentally used the bit
+number, not the bit mask, resulting in CSR and FW_INFO getting
+dumped instead of monitor data. Fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210805141826.774fd8729a33.Ic985a787071d1c0b127ef0ba8367da896ee11f57@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index df7c55e06f54..a13fe01e487b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -2321,7 +2321,7 @@ static void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt,
+ return;
+
+ if (dump_data->monitor_only)
+- dump_mask &= IWL_FW_ERROR_DUMP_FW_MONITOR;
++ dump_mask &= BIT(IWL_FW_ERROR_DUMP_FW_MONITOR);
+
+ fw_error_dump.trans_ptr = iwl_trans_dump_data(fwrt->trans, dump_mask);
+ file_len = le32_to_cpu(dump_file->file_len);
+--
+2.30.2
+
--- /dev/null
+From d3af6a2e80541fa5e5d16c20c71a51681471761a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 17:28:27 +0300
+Subject: iwlwifi: mvm: avoid static queue number aliasing
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit c6ce1c74ef2923b8ffd85f7f8b486f804f343b39 ]
+
+When TVQM is enabled (iwl_mvm_has_new_tx_api() is true), then
+queue numbers are just sequentially assigned 0, 1, 2, ...
+Prior to TVQM, in DQA, there were some statically allocated
+queue numbers:
+ * IWL_MVM_DQA_AUX_QUEUE == 1,
+ * both IWL_MVM_DQA_INJECT_MONITOR_QUEUE and
+ IWL_MVM_DQA_P2P_DEVICE_QUEUE == 2, and
+ * IWL_MVM_DQA_AP_PROBE_RESP_QUEUE == 9.
+
+Now, these values are assigned to the members mvm->aux_queue,
+mvm->snif_queue, mvm->probe_queue and mvm->p2p_dev_queue by
+default. Normally, this doesn't really matter, and if TVQM is
+in fact available we override them to the real values after
+allocating a queue for use there.
+
+However, this allocation doesn't always happen. For example,
+for mvm->p2p_dev_queue (== 2) it only happens when the P2P
+Device interface is started, if any. If it's not started, the
+value in mvm->p2p_dev_queue remains 2. This wouldn't really
+matter all that much if it weren't for iwl_mvm_is_static_queue()
+which checks a queue number against one of those four static
+numbers.
+
+Now, if no P2P Device or monitor interface is added then queue
+2 may be dynamically allocated, yet alias mvm->p2p_dev_queue or
+mvm->snif_queue, and thus iwl_mvm_is_static_queue() erroneously
+returns true for it. If it then gets full, all interface queues
+are stopped, instead of just backpressuring against the one TXQ
+that's really the only affected one.
+
+This clearly can lead to issues, as everything is stopped even
+if just a single TXQ filled its corresponding HW queue, if it
+happens to have an appropriate number (2 or 9, AUX is always
+reassigned.) Due to a mac80211 bug, this also led to a situation
+in which the queues remained stopped across a deauthentication
+and then attempts to connect to a new AP started failing, but
+that's fixed separately.
+
+Fix all of this by simply initializing the queue numbers to
+the invalid value until they're used, if TVQM is enabled, and
+also setting them back to that value when the queues are later
+freed again.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210802172232.2e47e623f9e2.I9b0830dafbb68ef35b7b8f0f46160abec02ac7d0@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 24 +++++++++++++---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 30 ++++++++++++--------
+ 2 files changed, 38 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 20e8d343a950..b637cf9d85fd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -792,10 +792,26 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+
+ mvm->fw_restart = iwlwifi_mod_params.fw_restart ? -1 : 0;
+
+- mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
+- mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
+- mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
+- mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
++ if (iwl_mvm_has_new_tx_api(mvm)) {
++ /*
++ * If we have the new TX/queue allocation API initialize them
++ * all to invalid numbers. We'll rewrite the ones that we need
++ * later, but that doesn't happen for all of them all of the
++ * time (e.g. P2P Device is optional), and if a dynamic queue
++ * ends up getting number 2 (IWL_MVM_DQA_P2P_DEVICE_QUEUE) then
++ * iwl_mvm_is_static_queue() erroneously returns true, and we
++ * might have things getting stuck.
++ */
++ mvm->aux_queue = IWL_MVM_INVALID_QUEUE;
++ mvm->snif_queue = IWL_MVM_INVALID_QUEUE;
++ mvm->probe_queue = IWL_MVM_INVALID_QUEUE;
++ mvm->p2p_dev_queue = IWL_MVM_INVALID_QUEUE;
++ } else {
++ mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
++ mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
++ mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
++ mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
++ }
+
+ mvm->sf_state = SF_UNINIT;
+ if (iwl_mvm_has_unified_ucode(mvm))
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 9c45a64c5009..252b81b1dc8c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -316,8 +316,9 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
+ }
+
+ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- int queue, u8 tid, u8 flags)
++ u16 *queueptr, u8 tid, u8 flags)
+ {
++ int queue = *queueptr;
+ struct iwl_scd_txq_cfg_cmd cmd = {
+ .scd_queue = queue,
+ .action = SCD_CFG_DISABLE_QUEUE,
+@@ -326,6 +327,7 @@ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+
+ if (iwl_mvm_has_new_tx_api(mvm)) {
+ iwl_trans_txq_free(mvm->trans, queue);
++ *queueptr = IWL_MVM_INVALID_QUEUE;
+
+ return 0;
+ }
+@@ -487,6 +489,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue,
+ u8 sta_id, tid;
+ unsigned long disable_agg_tids = 0;
+ bool same_sta;
++ u16 queue_tmp = queue;
+ int ret;
+
+ lockdep_assert_held(&mvm->mutex);
+@@ -509,7 +512,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue,
+ iwl_mvm_invalidate_sta_queue(mvm, queue,
+ disable_agg_tids, false);
+
+- ret = iwl_mvm_disable_txq(mvm, old_sta, queue, tid, 0);
++ ret = iwl_mvm_disable_txq(mvm, old_sta, &queue_tmp, tid, 0);
+ if (ret) {
+ IWL_ERR(mvm,
+ "Failed to free inactive queue %d (ret=%d)\n",
+@@ -1184,6 +1187,7 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm,
+ unsigned int wdg_timeout =
+ iwl_mvm_get_wd_timeout(mvm, mvmsta->vif, false, false);
+ int queue = -1;
++ u16 queue_tmp;
+ unsigned long disable_agg_tids = 0;
+ enum iwl_mvm_agg_state queue_state;
+ bool shared_queue = false, inc_ssn;
+@@ -1332,7 +1336,8 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm,
+ return 0;
+
+ out_err:
+- iwl_mvm_disable_txq(mvm, sta, queue, tid, 0);
++ queue_tmp = queue;
++ iwl_mvm_disable_txq(mvm, sta, &queue_tmp, tid, 0);
+
+ return ret;
+ }
+@@ -1779,7 +1784,7 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm,
+ if (mvm_sta->tid_data[i].txq_id == IWL_MVM_INVALID_QUEUE)
+ continue;
+
+- iwl_mvm_disable_txq(mvm, sta, mvm_sta->tid_data[i].txq_id, i,
++ iwl_mvm_disable_txq(mvm, sta, &mvm_sta->tid_data[i].txq_id, i,
+ 0);
+ mvm_sta->tid_data[i].txq_id = IWL_MVM_INVALID_QUEUE;
+ }
+@@ -1987,7 +1992,7 @@ static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx,
+ ret = iwl_mvm_add_int_sta_common(mvm, sta, addr, macidx, maccolor);
+ if (ret) {
+ if (!iwl_mvm_has_new_tx_api(mvm))
+- iwl_mvm_disable_txq(mvm, NULL, *queue,
++ iwl_mvm_disable_txq(mvm, NULL, queue,
+ IWL_MAX_TID_COUNT, 0);
+ return ret;
+ }
+@@ -2060,7 +2065,7 @@ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ if (WARN_ON_ONCE(mvm->snif_sta.sta_id == IWL_MVM_INVALID_STA))
+ return -EINVAL;
+
+- iwl_mvm_disable_txq(mvm, NULL, mvm->snif_queue, IWL_MAX_TID_COUNT, 0);
++ iwl_mvm_disable_txq(mvm, NULL, &mvm->snif_queue, IWL_MAX_TID_COUNT, 0);
+ ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id);
+ if (ret)
+ IWL_WARN(mvm, "Failed sending remove station\n");
+@@ -2077,7 +2082,7 @@ int iwl_mvm_rm_aux_sta(struct iwl_mvm *mvm)
+ if (WARN_ON_ONCE(mvm->aux_sta.sta_id == IWL_MVM_INVALID_STA))
+ return -EINVAL;
+
+- iwl_mvm_disable_txq(mvm, NULL, mvm->aux_queue, IWL_MAX_TID_COUNT, 0);
++ iwl_mvm_disable_txq(mvm, NULL, &mvm->aux_queue, IWL_MAX_TID_COUNT, 0);
+ ret = iwl_mvm_rm_sta_common(mvm, mvm->aux_sta.sta_id);
+ if (ret)
+ IWL_WARN(mvm, "Failed sending remove station\n");
+@@ -2173,7 +2178,7 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
+ struct ieee80211_vif *vif)
+ {
+ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+- int queue;
++ u16 *queueptr, queue;
+
+ lockdep_assert_held(&mvm->mutex);
+
+@@ -2182,10 +2187,10 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
+ switch (vif->type) {
+ case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_ADHOC:
+- queue = mvm->probe_queue;
++ queueptr = &mvm->probe_queue;
+ break;
+ case NL80211_IFTYPE_P2P_DEVICE:
+- queue = mvm->p2p_dev_queue;
++ queueptr = &mvm->p2p_dev_queue;
+ break;
+ default:
+ WARN(1, "Can't free bcast queue on vif type %d\n",
+@@ -2193,7 +2198,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
+ return;
+ }
+
+- iwl_mvm_disable_txq(mvm, NULL, queue, IWL_MAX_TID_COUNT, 0);
++ queue = *queueptr;
++ iwl_mvm_disable_txq(mvm, NULL, queueptr, IWL_MAX_TID_COUNT, 0);
+ if (iwl_mvm_has_new_tx_api(mvm))
+ return;
+
+@@ -2428,7 +2434,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+
+ iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true);
+
+- iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
++ iwl_mvm_disable_txq(mvm, NULL, &mvmvif->cab_queue, 0, 0);
+
+ ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From ecf0940dfc74a7436edddb95471a57fc0c4549b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 17:09:42 +0300
+Subject: iwlwifi: mvm: Do not use full SSIDs in 6GHz scan
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit deedf9b97cd4ef45da476c9bdd2a5f3276053956 ]
+
+The scan request processing populated the direct SSIDs
+in the FW scan request command also for 6GHz scan, which is not
+needed and might result in unexpected behavior.
+
+Fix the code to add the direct SSIDs only in case the scan
+is not a 6GHz scan.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210802170640.f465937c7bbf.Ic11a1659ddda850c3ec1b1afbe9e2b9577ac1800@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+index 0368b7101222..4899d8f90bab 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -2368,14 +2368,17 @@ static int iwl_mvm_scan_umac_v14(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ if (ret)
+ return ret;
+
+- iwl_mvm_scan_umac_fill_probe_p_v4(params, &scan_p->probe_params,
+- &bitmap_ssid);
+ if (!params->scan_6ghz) {
++ iwl_mvm_scan_umac_fill_probe_p_v4(params, &scan_p->probe_params,
++ &bitmap_ssid);
+ iwl_mvm_scan_umac_fill_ch_p_v6(mvm, params, vif,
+- &scan_p->channel_params, bitmap_ssid);
++ &scan_p->channel_params, bitmap_ssid);
+
+ return 0;
++ } else {
++ pb->preq = params->preq;
+ }
++
+ cp->flags = iwl_mvm_scan_umac_chan_flags_v2(mvm, params, vif);
+ cp->n_aps_override[0] = IWL_SCAN_ADWELL_N_APS_GO_FRIENDLY;
+ cp->n_aps_override[1] = IWL_SCAN_ADWELL_N_APS_SOCIAL_CHS;
+--
+2.30.2
+
--- /dev/null
+From 97ceb4a4f3506988bd14025d845c17925928b1b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 18:40:34 +0300
+Subject: iwlwifi: mvm: don't schedule the roc_done_wk if it is already running
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit a76b57311b1a247e31b055872d021c38707dc3a8 ]
+
+When P2P roc is removed, the IWL_MVM_STATUS_NEED_FLUSH_P2P bit is set
+to indicate to iwl_mvm_roc_done_wk() that the removed roc is a P2P
+one, so it will flush the broadcast station and not the aux station.
+
+However, since setting this bit and scheduling the worker is done
+in roc ended flow as well as in case the roc is removed, there is
+a race where the worker has already started running (but did not
+test this bit yet) and then it is scheduled again. In this case,
+the first run of the worker will clear this bit, and thus the second
+run will find it already cleared and will try to flush and remove
+the aux station by mistake.
+
+Fix it by scheduling the worker only if this bit is not yet set. In
+case this bit is already set, the worker is either running or
+scheduled, so there is no need to re-schedule it.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210819183728.8c147659b331.If5924375e9bfd46214ab8ab81cb9d0f5c82fbcbc@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/intel/iwlwifi/mvm/time-event.c | 31 ++++++++++++-------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index d3307a11fcac..24b658a3098a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -246,6 +246,18 @@ static void iwl_mvm_te_check_trigger(struct iwl_mvm *mvm,
+ }
+ }
+
++static void iwl_mvm_p2p_roc_finished(struct iwl_mvm *mvm)
++{
++ /*
++ * If the IWL_MVM_STATUS_NEED_FLUSH_P2P is already set, then the
++ * roc_done_wk is already scheduled or running, so don't schedule it
++ * again to avoid a race where the roc_done_wk clears this bit after
++ * it is set here, affecting the next run of the roc_done_wk.
++ */
++ if (!test_and_set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status))
++ iwl_mvm_roc_finished(mvm);
++}
++
+ /*
+ * Handles a FW notification for an event that is known to the driver.
+ *
+@@ -297,8 +309,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
+ switch (te_data->vif->type) {
+ case NL80211_IFTYPE_P2P_DEVICE:
+ ieee80211_remain_on_channel_expired(mvm->hw);
+- set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+- iwl_mvm_roc_finished(mvm);
++ iwl_mvm_p2p_roc_finished(mvm);
+ break;
+ case NL80211_IFTYPE_STATION:
+ /*
+@@ -674,8 +685,7 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
+ /* Session protection is still ongoing. Cancel it */
+ iwl_mvm_cancel_session_protection(mvm, mvmvif, id);
+ if (iftype == NL80211_IFTYPE_P2P_DEVICE) {
+- set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+- iwl_mvm_roc_finished(mvm);
++ iwl_mvm_p2p_roc_finished(mvm);
+ }
+ }
+ return false;
+@@ -842,8 +852,7 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
+ /* End TE, notify mac80211 */
+ mvmvif->time_event_data.id = SESSION_PROTECT_CONF_MAX_ID;
+ ieee80211_remain_on_channel_expired(mvm->hw);
+- set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+- iwl_mvm_roc_finished(mvm);
++ iwl_mvm_p2p_roc_finished(mvm);
+ } else if (le32_to_cpu(notif->start)) {
+ if (WARN_ON(mvmvif->time_event_data.id !=
+ le32_to_cpu(notif->conf_id)))
+@@ -1004,14 +1013,13 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ iwl_mvm_cancel_session_protection(mvm, mvmvif,
+ mvmvif->time_event_data.id);
+- set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
++ iwl_mvm_p2p_roc_finished(mvm);
+ } else {
+ iwl_mvm_remove_aux_roc_te(mvm, mvmvif,
+ &mvmvif->time_event_data);
++ iwl_mvm_roc_finished(mvm);
+ }
+
+- iwl_mvm_roc_finished(mvm);
+-
+ return;
+ }
+
+@@ -1025,12 +1033,11 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+
+ if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
+- set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
++ iwl_mvm_p2p_roc_finished(mvm);
+ } else {
+ iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
++ iwl_mvm_roc_finished(mvm);
+ }
+-
+- iwl_mvm_roc_finished(mvm);
+ }
+
+ void iwl_mvm_remove_csa_period(struct iwl_mvm *mvm,
+--
+2.30.2
+
--- /dev/null
+From 918bb58706b5ba1c874e8e93cf575f79161bca2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 17:28:24 +0300
+Subject: iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 0f5d44ac6e55551798dd3da0ff847c8df5990822 ]
+
+If beacon_inject_active is true, we will return without freeing
+beacon. Fid that by freeing it before returning.
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+[reworded the commit message]
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210802172232.d16206ca60fc.I9984a9b442c84814c307cee3213044e24d26f38a@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index fd5e08961651..7f0c82189808 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1005,8 +1005,10 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
+ return -ENOMEM;
+
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+- if (mvm->beacon_inject_active)
++ if (mvm->beacon_inject_active) {
++ dev_kfree_skb(beacon);
+ return -EBUSY;
++ }
+ #endif
+
+ ret = iwl_mvm_mac_ctxt_send_beacon(mvm, vif, beacon);
+--
+2.30.2
+
--- /dev/null
+From 33bc9b9a89b7f1dd2414aecdf800626d7c780b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:19:31 +0300
+Subject: iwlwifi: mvm: fix access to BSS elements
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6c608cd6962ebdf84fd3de6d42f88ed64d2f4e1b ]
+
+BSS elements are protected using RCU, so we need to use
+RCU properly to access them, fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210805130823.fd8b5791ab44.Iba26800a6301078d3782fb249c476dd8ac2bf3c6@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 70ebecb73c24..79f44435972e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -2987,16 +2987,20 @@ static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
+ void *_data)
+ {
+ struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
++ const struct cfg80211_bss_ies *ies;
+ const struct element *elem;
+
+- elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
+- bss->ies->len);
++ rcu_read_lock();
++ ies = rcu_dereference(bss->ies);
++ elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
++ ies->len);
+
+ if (!elem || elem->datalen < 10 ||
+ !(elem->data[10] &
+ WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
+ data->tolerated = false;
+ }
++ rcu_read_unlock();
+ }
+
+ static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
+--
+2.30.2
+
--- /dev/null
+From c916c11b93caf4f7d4edf899a99baede7cefe0bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 22:47:42 +0300
+Subject: iwlwifi: mvm: Fix scan channel flags settings
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 090f1be3abf3069ef856b29761f181808bf55917 ]
+
+The iwl_mvm_scan_ch_n_aps_flag() is called with a variable
+before the value of the variable is set. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210826224715.f6f188980a5e.Ie7331a8b94004d308f6cbde44e519155a5be91dd@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+index 4899d8f90bab..2d600a8b20ed 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -1648,7 +1648,7 @@ iwl_mvm_umac_scan_cfg_channels_v6(struct iwl_mvm *mvm,
+ struct iwl_scan_channel_cfg_umac *cfg = &cp->channel_config[i];
+ u32 n_aps_flag =
+ iwl_mvm_scan_ch_n_aps_flag(vif_type,
+- cfg->v2.channel_num);
++ channels[i]->hw_value);
+
+ cfg->flags = cpu_to_le32(flags | n_aps_flag);
+ cfg->v2.channel_num = channels[i]->hw_value;
+--
+2.30.2
+
--- /dev/null
+From 95f942f7ad49cfda333bd21d2bc7d1a4a5513de6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 21:58:54 +0300
+Subject: iwlwifi: mvm: Fix umac scan request probe parameters
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 35fc5feca7b24b97e828e6e6a4243b4b9b0131f8 ]
+
+Both 'iwl_scan_probe_params_v3' and 'iwl_scan_probe_params_v4'
+wrongly addressed the 'bssid_array' field which should supposed
+to be any array of BSSIDs each of size ETH_ALEN and not the
+opposite. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210802215208.04146f24794f.I90726440ddff75013e9fecbe9fa1a05c69e3f17b@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+index b2605aefc290..8b200379f7c2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
+ /*
+- * Copyright (C) 2012-2014, 2018-2020 Intel Corporation
++ * Copyright (C) 2012-2014, 2018-2021 Intel Corporation
+ * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
+ * Copyright (C) 2016-2017 Intel Deutschland GmbH
+ */
+@@ -874,7 +874,7 @@ struct iwl_scan_probe_params_v3 {
+ u8 reserved;
+ struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX];
+ __le32 short_ssid[SCAN_SHORT_SSID_MAX_SIZE];
+- u8 bssid_array[ETH_ALEN][SCAN_BSSID_MAX_SIZE];
++ u8 bssid_array[SCAN_BSSID_MAX_SIZE][ETH_ALEN];
+ } __packed; /* SCAN_PROBE_PARAMS_API_S_VER_3 */
+
+ /**
+@@ -894,7 +894,7 @@ struct iwl_scan_probe_params_v4 {
+ __le16 reserved;
+ struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX];
+ __le32 short_ssid[SCAN_SHORT_SSID_MAX_SIZE];
+- u8 bssid_array[ETH_ALEN][SCAN_BSSID_MAX_SIZE];
++ u8 bssid_array[SCAN_BSSID_MAX_SIZE][ETH_ALEN];
+ } __packed; /* SCAN_PROBE_PARAMS_API_S_VER_4 */
+
+ #define SCAN_MAX_NUM_CHANS_V3 67
+--
+2.30.2
+
--- /dev/null
+From 5ff71467609c269df5a67fd64c35df184ff0e34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 17:09:38 +0300
+Subject: iwlwifi: pcie: free RBs during configure
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6ac5720086c8b176794eb74c5cc09f8b79017f38 ]
+
+When switching op-modes, or more generally when reconfiguring,
+we might switch the RB size. In _iwl_pcie_rx_init() we have a
+comment saying we must free all RBs since we might switch the
+size, but this is actually too late: the switch has been done
+and we'll free the buffers with the wrong size.
+
+Fix this by always freeing the buffers, if any, at the start
+of configure, instead of only after the size may have changed.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210802170640.42d7c93279c4.I07f74e65aab0e3d965a81206fcb289dc92d74878@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 ++++-
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 4f6f4b2720f0..ff7ca3c57f34 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -487,6 +487,9 @@ void iwl_pcie_free_rbs_pool(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ int i;
+
++ if (!trans_pcie->rx_pool)
++ return;
++
+ for (i = 0; i < RX_POOL_SIZE(trans_pcie->num_rx_bufs); i++) {
+ if (!trans_pcie->rx_pool[i].page)
+ continue;
+@@ -1062,7 +1065,7 @@ static int _iwl_pcie_rx_init(struct iwl_trans *trans)
+ INIT_LIST_HEAD(&rba->rbd_empty);
+ spin_unlock_bh(&rba->lock);
+
+- /* free all first - we might be reconfigured for a different size */
++ /* free all first - we overwrite everything here */
+ iwl_pcie_free_rbs_pool(trans);
+
+ for (i = 0; i < RX_QUEUE_SIZE; i++)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index bee6b4574226..65cc25cbb9ec 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1866,6 +1866,9 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
++ /* free all first - we might be reconfigured for a different size */
++ iwl_pcie_free_rbs_pool(trans);
++
+ trans->txqs.cmd.q_id = trans_cfg->cmd_queue;
+ trans->txqs.cmd.fifo = trans_cfg->cmd_fifo;
+ trans->txqs.cmd.wdg_timeout = trans_cfg->cmd_q_wdg_timeout;
+--
+2.30.2
+
--- /dev/null
+From 8af03692c73097e9aa472b0261cd5340c306a46e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 09:01:14 +0900
+Subject: kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 52d83df682c82055961531853c066f4f16e234ea ]
+
+When CONFIG_TRIM_UNUSED_KSYMS is enabled, I see some warnings like this:
+
+ nm: arch/x86/entry/vdso/vdso32/note.o: no symbols
+
+$NM (both GNU nm and llvm-nm) warns when no symbol is found in the
+object. Suppress the stderr.
+
+Fangrui Song mentioned binutils>=2.37 `nm -q` can be used to suppress
+"no symbols" [1], and llvm-nm>=13.0.0 supports -q as well.
+
+We cannot use it for now, but note it as a TODO.
+
+[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=27408
+
+Fixes: bbda5ec671d3 ("kbuild: simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gen_ksymdeps.sh | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gen_ksymdeps.sh b/scripts/gen_ksymdeps.sh
+index 1324986e1362..725e8c9c1b53 100755
+--- a/scripts/gen_ksymdeps.sh
++++ b/scripts/gen_ksymdeps.sh
+@@ -4,7 +4,13 @@
+ set -e
+
+ # List of exported symbols
+-ksyms=$($NM $1 | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z)
++#
++# If the object has no symbol, $NM warns 'no symbols'.
++# Suppress the stderr.
++# TODO:
++# Use -q instead of 2>/dev/null when we upgrade the minimum version of
++# binutils to 2.37, llvm to 13.0.0.
++ksyms=$($NM $1 2>/dev/null | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z)
+
+ if [ -z "$ksyms" ]; then
+ exit 0
+--
+2.30.2
+
--- /dev/null
+From 1fbd261b512959c650a3b75feedc88ad3529a528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 18:29:02 +0100
+Subject: kselftest/arm64: mte: Fix misleading output when skipping tests
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 83e5dcbece4ea67ec3ad94b897e2844184802fd7 ]
+
+When skipping the tests due to a lack of system support for MTE we
+currently print a message saying FAIL which makes it look like the test
+failed even though the test did actually report KSFT_SKIP, creating some
+confusion. Change the error message to say SKIP instead so things are
+clearer.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210819172902.56211-1-broonie@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/mte/mte_common_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/mte/mte_common_util.c b/tools/testing/selftests/arm64/mte/mte_common_util.c
+index f50ac31920d1..0328a1e08f65 100644
+--- a/tools/testing/selftests/arm64/mte/mte_common_util.c
++++ b/tools/testing/selftests/arm64/mte/mte_common_util.c
+@@ -298,7 +298,7 @@ int mte_default_setup(void)
+ int ret;
+
+ if (!(hwcaps2 & HWCAP2_MTE)) {
+- ksft_print_msg("FAIL: MTE features unavailable\n");
++ ksft_print_msg("SKIP: MTE features unavailable\n");
+ return KSFT_SKIP;
+ }
+ /* Get current mte mode */
+--
+2.30.2
+
--- /dev/null
+From caca850d63f15f142d05db2fb6806abcf3ed4a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 17:57:23 +0100
+Subject: kselftest/arm64: pac: Fix skipping of tests on systems without PAC
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 0c69bd2ca6ee20064dde7853cd749284e053a874 ]
+
+The PAC tests check to see if the system supports the relevant PAC features
+but instead of skipping the tests if they can't be executed they fail the
+tests which makes things look like they're not working when they are.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210819165723.43903-1-broonie@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/pac.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/pac.c b/tools/testing/selftests/arm64/pauth/pac.c
+index 592fe538506e..b743daa772f5 100644
+--- a/tools/testing/selftests/arm64/pauth/pac.c
++++ b/tools/testing/selftests/arm64/pauth/pac.c
+@@ -25,13 +25,15 @@
+ do { \
+ unsigned long hwcaps = getauxval(AT_HWCAP); \
+ /* data key instructions are not in NOP space. This prevents a SIGILL */ \
+- ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled"); \
++ if (!(hwcaps & HWCAP_PACA)) \
++ SKIP(return, "PAUTH not enabled"); \
+ } while (0)
+ #define ASSERT_GENERIC_PAUTH_ENABLED() \
+ do { \
+ unsigned long hwcaps = getauxval(AT_HWCAP); \
+ /* generic key instructions are not in NOP space. This prevents a SIGILL */ \
+- ASSERT_NE(0, hwcaps & HWCAP_PACG) TH_LOG("Generic PAUTH not enabled"); \
++ if (!(hwcaps & HWCAP_PACG)) \
++ SKIP(return, "Generic PAUTH not enabled"); \
+ } while (0)
+
+ void sign_specific(struct signatures *sign, size_t val)
+@@ -256,7 +258,7 @@ TEST(single_thread_different_keys)
+ unsigned long hwcaps = getauxval(AT_HWCAP);
+
+ /* generic and data key instructions are not in NOP space. This prevents a SIGILL */
+- ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled");
++ ASSERT_PAUTH_ENABLED();
+ if (!(hwcaps & HWCAP_PACG)) {
+ TH_LOG("WARNING: Generic PAUTH not enabled. Skipping generic key checks");
+ nkeys = NKEYS - 1;
+@@ -299,7 +301,7 @@ TEST(exec_changed_keys)
+ unsigned long hwcaps = getauxval(AT_HWCAP);
+
+ /* generic and data key instructions are not in NOP space. This prevents a SIGILL */
+- ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled");
++ ASSERT_PAUTH_ENABLED();
+ if (!(hwcaps & HWCAP_PACG)) {
+ TH_LOG("WARNING: Generic PAUTH not enabled. Skipping generic key checks");
+ nkeys = NKEYS - 1;
+--
+2.30.2
+
--- /dev/null
+From b0c9726c8581590b4084747e560c52dad5241578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 18:26:14 -0300
+Subject: KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
+
+From: Fabiano Rosas <farosas@linux.ibm.com>
+
+[ Upstream commit 5d7d6dac8fe99ed59eee2300e4a03370f94d5222 ]
+
+The __kvmhv_copy_tofrom_guest_radix function was introduced along with
+nested HV guest support. It uses the platform's Radix MMU quadrants to
+provide a nested hypervisor with fast access to its nested guests
+memory (H_COPY_TOFROM_GUEST hypercall). It has also since been added
+as a fast path for the kvmppc_ld/st routines which are used during
+instruction emulation.
+
+The commit def0bfdbd603 ("powerpc: use probe_user_read() and
+probe_user_write()") changed the low level copy function from
+raw_copy_from_user to probe_user_read, which adds a check to
+access_ok. In powerpc that is:
+
+ static inline bool __access_ok(unsigned long addr, unsigned long size)
+ {
+ return addr < TASK_SIZE_MAX && size <= TASK_SIZE_MAX - addr;
+ }
+
+and TASK_SIZE_MAX is 0x0010000000000000UL for 64-bit, which means that
+setting the two MSBs of the effective address (which correspond to the
+quadrant) now cause access_ok to reject the access.
+
+This was not caught earlier because the most common code path via
+kvmppc_ld/st contains a fallback (kvm_read_guest) that is likely to
+succeed for L1 guests. For nested guests there is no fallback.
+
+Another issue is that probe_user_read (now __copy_from_user_nofault)
+does not return the number of bytes not copied in case of failure, so
+the destination memory is not being cleared anymore in
+kvmhv_copy_from_guest_radix:
+
+ ret = kvmhv_copy_tofrom_guest_radix(vcpu, eaddr, to, NULL, n);
+ if (ret > 0) <-- always false!
+ memset(to + (n - ret), 0, ret);
+
+This patch fixes both issues by skipping access_ok and open-coding the
+low level __copy_to/from_user_inatomic.
+
+Fixes: def0bfdbd603 ("powerpc: use probe_user_read() and probe_user_write()")
+Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210805212616.2641017-2-farosas@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+index b5905ae4377c..44eb7b1ef289 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+@@ -65,10 +65,12 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid,
+ }
+ isync();
+
++ pagefault_disable();
+ if (is_load)
+- ret = copy_from_user_nofault(to, (const void __user *)from, n);
++ ret = __copy_from_user_inatomic(to, (const void __user *)from, n);
+ else
+- ret = copy_to_user_nofault((void __user *)to, from, n);
++ ret = __copy_to_user_inatomic((void __user *)to, from, n);
++ pagefault_enable();
+
+ /* switch the pid first to avoid running host with unallocated pid */
+ if (quadrant == 1 && pid != old_pid)
+--
+2.30.2
+
--- /dev/null
+From bf6c21bd3a01b3af17d7bfa8ffd9aa90d1fc3130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 02:00:43 +1000
+Subject: KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest
+ SPRs are live
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 1782663897945a5cf28e564ba5eed730098e9aa4 ]
+
+After the L1 saves its PMU SPRs but before loading the L2's PMU SPRs,
+switch the pmcregs_in_use field in the L1 lppaca to the value advertised
+by the L2 in its VPA. On the way out of the L2, set it back after saving
+the L2 PMU registers (if they were in-use).
+
+This transfers the PMU liveness indication between the L1 and L2 at the
+points where the registers are not live.
+
+This fixes the nested HV bug for which a workaround was added to the L0
+HV by commit 63279eeb7f93a ("KVM: PPC: Book3S HV: Always save guest pmu
+for guest capable of nesting"), which explains the problem in detail.
+That workaround is no longer required for guests that include this bug
+fix.
+
+Fixes: 360cae313702 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Fabiano Rosas <farosas@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210811160134.904987-10-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/pmc.h | 7 +++++++
+ arch/powerpc/kvm/book3s_hv.c | 20 ++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/pmc.h b/arch/powerpc/include/asm/pmc.h
+index c6bbe9778d3c..3c09109e708e 100644
+--- a/arch/powerpc/include/asm/pmc.h
++++ b/arch/powerpc/include/asm/pmc.h
+@@ -34,6 +34,13 @@ static inline void ppc_set_pmu_inuse(int inuse)
+ #endif
+ }
+
++#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
++static inline int ppc_get_pmu_inuse(void)
++{
++ return get_paca()->pmcregs_in_use;
++}
++#endif
++
+ extern void power4_enable_pmcs(void);
+
+ #else /* CONFIG_PPC64 */
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 085fb8ecbf68..af822f09785f 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -59,6 +59,7 @@
+ #include <asm/kvm_book3s.h>
+ #include <asm/mmu_context.h>
+ #include <asm/lppaca.h>
++#include <asm/pmc.h>
+ #include <asm/processor.h>
+ #include <asm/cputhreads.h>
+ #include <asm/page.h>
+@@ -3852,6 +3853,18 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
+ cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST))
+ kvmppc_restore_tm_hv(vcpu, vcpu->arch.shregs.msr, true);
+
++#ifdef CONFIG_PPC_PSERIES
++ if (kvmhv_on_pseries()) {
++ barrier();
++ if (vcpu->arch.vpa.pinned_addr) {
++ struct lppaca *lp = vcpu->arch.vpa.pinned_addr;
++ get_lppaca()->pmcregs_in_use = lp->pmcregs_in_use;
++ } else {
++ get_lppaca()->pmcregs_in_use = 1;
++ }
++ barrier();
++ }
++#endif
+ kvmhv_load_guest_pmu(vcpu);
+
+ msr_check_and_set(MSR_FP | MSR_VEC | MSR_VSX);
+@@ -3986,6 +3999,13 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
+ save_pmu |= nesting_enabled(vcpu->kvm);
+
+ kvmhv_save_guest_pmu(vcpu, save_pmu);
++#ifdef CONFIG_PPC_PSERIES
++ if (kvmhv_on_pseries()) {
++ barrier();
++ get_lppaca()->pmcregs_in_use = ppc_get_pmu_inuse();
++ barrier();
++ }
++#endif
+
+ vc->entry_exit_map = 0x101;
+ vc->in_guest = 0;
+--
+2.30.2
+
--- /dev/null
+From ee5efaf98da23aaaeb948bb38ee993c61457682f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:07:06 +1000
+Subject: KVM: PPC: Fix clearing never mapped TCEs in realmode
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 1d78dfde33a02da1d816279c2e3452978b7abd39 ]
+
+Since commit e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on
+demand too"), pages for TCE tables for KVM guests are allocated only
+when needed. This allows skipping any update when clearing TCEs. This
+works mostly fine as TCE updates are handled when the MMU is enabled.
+The realmode handlers fail with H_TOO_HARD when pages are not yet
+allocated, except when clearing a TCE in which case KVM prints a warning
+and proceeds to dereference a NULL pointer, which crashes the host OS.
+
+This has not been caught so far as the change in commit e1a1ef84cd07 is
+reasonably new, and POWER9 runs mostly radix which does not use realmode
+handlers. With hash, the default TCE table is memset() by QEMU when the
+machine is reset which triggers page faults and the KVM TCE device's
+kvm_spapr_tce_fault() handles those with MMU on. And the huge DMA
+windows are not cleared by VMs which instead successfully create a DMA
+window big enough to map the VM memory 1:1 and then VMs just map
+everything without clearing.
+
+This started crashing now as commit 381ceda88c4c ("powerpc/pseries/iommu:
+Make use of DDW for indirect mapping") added a mode when a dymanic DMA
+window not big enough to map the VM memory 1:1 but it is used anyway,
+and the VM now is the first (i.e. not QEMU) to clear a just created
+table. Note that upstream QEMU needs to be modified to trigger the VM to
+trigger the host OS crash.
+
+This replaces WARN_ON_ONCE_RM() with a check and return, and adds
+another warning if TCE is not being cleared.
+
+Fixes: e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210827040706.517652-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_vio_hv.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
+index dc6591548f0c..636c6ae0939b 100644
+--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
+@@ -173,10 +173,13 @@ static void kvmppc_rm_tce_put(struct kvmppc_spapr_tce_table *stt,
+ idx -= stt->offset;
+ page = stt->pages[idx / TCES_PER_PAGE];
+ /*
+- * page must not be NULL in real mode,
+- * kvmppc_rm_ioba_validate() must have taken care of this.
++ * kvmppc_rm_ioba_validate() allows pages not be allocated if TCE is
++ * being cleared, otherwise it returns H_TOO_HARD and we skip this.
+ */
+- WARN_ON_ONCE_RM(!page);
++ if (!page) {
++ WARN_ON_ONCE_RM(tce != 0);
++ return;
++ }
+ tbl = kvmppc_page_address(page);
+
+ tbl[idx % TCES_PER_PAGE] = tce;
+--
+2.30.2
+
--- /dev/null
+From 7a6fe346546d6de5303056413e826973745d9215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 17:20:01 +0200
+Subject: libbpf: Fix race when pinning maps in parallel
+
+From: Martynas Pumputis <m@lambda.lt>
+
+[ Upstream commit 043c5bb3c4f43670ab4fea0b847373ab42d25f3e ]
+
+When loading in parallel multiple programs which use the same to-be
+pinned map, it is possible that two instances of the loader will call
+bpf_object__create_maps() at the same time. If the map doesn't exist
+when both instances call bpf_object__reuse_map(), then one of the
+instances will fail with EEXIST when calling bpf_map__pin().
+
+Fix the race by retrying reusing a map if bpf_map__pin() returns
+EEXIST. The fix is similar to the one in iproute2: e4c4685fd6e4 ("bpf:
+Fix race condition with map pinning").
+
+Before retrying the pinning, we don't do any special cleaning of an
+internal map state. The closer code inspection revealed that it's not
+required:
+
+ - bpf_object__create_map(): map->inner_map is destroyed after a
+ successful call, map->fd is closed if pinning fails.
+ - bpf_object__populate_internal_map(): created map elements is
+ destroyed upon close(map->fd).
+ - init_map_slots(): slots are freed after their initialization.
+
+Signed-off-by: Martynas Pumputis <m@lambda.lt>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210726152001.34845-1-m@lambda.lt
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 95ca17a3bd82..d27e017ebfbe 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4656,10 +4656,13 @@ bpf_object__create_maps(struct bpf_object *obj)
+ char *cp, errmsg[STRERR_BUFSIZE];
+ unsigned int i, j;
+ int err;
++ bool retried;
+
+ for (i = 0; i < obj->nr_maps; i++) {
+ map = &obj->maps[i];
+
++ retried = false;
++retry:
+ if (map->pin_path) {
+ err = bpf_object__reuse_map(map);
+ if (err) {
+@@ -4667,6 +4670,12 @@ bpf_object__create_maps(struct bpf_object *obj)
+ map->name);
+ goto err_out;
+ }
++ if (retried && map->fd < 0) {
++ pr_warn("map '%s': cannot find pinned map\n",
++ map->name);
++ err = -ENOENT;
++ goto err_out;
++ }
+ }
+
+ if (map->fd >= 0) {
+@@ -4700,9 +4709,13 @@ bpf_object__create_maps(struct bpf_object *obj)
+ if (map->pin_path && !map->pinned) {
+ err = bpf_map__pin(map, NULL);
+ if (err) {
++ zclose(map->fd);
++ if (!retried && err == -EEXIST) {
++ retried = true;
++ goto retry;
++ }
+ pr_warn("map '%s': failed to auto-pin at '%s': %d\n",
+ map->name, map->pin_path, err);
+- zclose(map->fd);
+ goto err_out;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 91a3a35aeddfe9d8e93c13dfeb4c19b0197e676a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 14:55:51 +0200
+Subject: libbpf: Fix reuse of pinned map on older kernel
+
+From: Martynas Pumputis <m@lambda.lt>
+
+[ Upstream commit 97eb31384af943d6b97eb5947262cee4ef25cb87 ]
+
+When loading a BPF program with a pinned map, the loader checks whether
+the pinned map can be reused, i.e. their properties match. To derive
+such of the pinned map, the loader invokes BPF_OBJ_GET_INFO_BY_FD and
+then does the comparison.
+
+Unfortunately, on < 4.12 kernels the BPF_OBJ_GET_INFO_BY_FD is not
+available, so loading the program fails with the following error:
+
+ libbpf: failed to get map info for map FD 5: Invalid argument
+ libbpf: couldn't reuse pinned map at
+ '/sys/fs/bpf/tc/globals/cilium_call_policy': parameter
+ mismatch"
+ libbpf: map 'cilium_call_policy': error reusing pinned map
+ libbpf: map 'cilium_call_policy': failed to create:
+ Invalid argument(-22)
+ libbpf: failed to load object 'bpf_overlay.o'
+
+To fix this, fallback to derivation of the map properties via
+/proc/$PID/fdinfo/$MAP_FD if BPF_OBJ_GET_INFO_BY_FD fails with EINVAL,
+which can be used as an indicator that the kernel doesn't support
+the latter.
+
+Signed-off-by: Martynas Pumputis <m@lambda.lt>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20210712125552.58705-1-m@lambda.lt
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 48 +++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 45 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 2234d5c33177..95ca17a3bd82 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -3894,6 +3894,42 @@ static int bpf_map_find_btf_info(struct bpf_object *obj, struct bpf_map *map)
+ return 0;
+ }
+
++static int bpf_get_map_info_from_fdinfo(int fd, struct bpf_map_info *info)
++{
++ char file[PATH_MAX], buff[4096];
++ FILE *fp;
++ __u32 val;
++ int err;
++
++ snprintf(file, sizeof(file), "/proc/%d/fdinfo/%d", getpid(), fd);
++ memset(info, 0, sizeof(*info));
++
++ fp = fopen(file, "r");
++ if (!fp) {
++ err = -errno;
++ pr_warn("failed to open %s: %d. No procfs support?\n", file,
++ err);
++ return err;
++ }
++
++ while (fgets(buff, sizeof(buff), fp)) {
++ if (sscanf(buff, "map_type:\t%u", &val) == 1)
++ info->type = val;
++ else if (sscanf(buff, "key_size:\t%u", &val) == 1)
++ info->key_size = val;
++ else if (sscanf(buff, "value_size:\t%u", &val) == 1)
++ info->value_size = val;
++ else if (sscanf(buff, "max_entries:\t%u", &val) == 1)
++ info->max_entries = val;
++ else if (sscanf(buff, "map_flags:\t%i", &val) == 1)
++ info->map_flags = val;
++ }
++
++ fclose(fp);
++
++ return 0;
++}
++
+ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ {
+ struct bpf_map_info info = {};
+@@ -3902,6 +3938,8 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ char *new_name;
+
+ err = bpf_obj_get_info_by_fd(fd, &info, &len);
++ if (err && errno == EINVAL)
++ err = bpf_get_map_info_from_fdinfo(fd, &info);
+ if (err)
+ return libbpf_err(err);
+
+@@ -4381,12 +4419,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ struct bpf_map_info map_info = {};
+ char msg[STRERR_BUFSIZE];
+ __u32 map_info_len;
++ int err;
+
+ map_info_len = sizeof(map_info);
+
+- if (bpf_obj_get_info_by_fd(map_fd, &map_info, &map_info_len)) {
+- pr_warn("failed to get map info for map FD %d: %s\n",
+- map_fd, libbpf_strerror_r(errno, msg, sizeof(msg)));
++ err = bpf_obj_get_info_by_fd(map_fd, &map_info, &map_info_len);
++ if (err && errno == EINVAL)
++ err = bpf_get_map_info_from_fdinfo(map_fd, &map_info);
++ if (err) {
++ pr_warn("failed to get map info for map FD %d: %s\n", map_fd,
++ libbpf_strerror_r(errno, msg, sizeof(msg)));
+ return false;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9399a24bcd37a3cf260983fb2fcfa47c5e571771 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 17:01:59 -0400
+Subject: lockd: lockd server-side shouldn't set fl_ops
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 7de875b231edb807387a81cde288aa9e1015ef9e ]
+
+Locks have two sets of op arrays, fl_lmops for the lock manager (lockd
+or nfsd), fl_ops for the filesystem. The server-side lockd code has
+been setting its own fl_ops, which leads to confusion (and crashes) in
+the reexport case, where the filesystem expects to be the only one
+setting fl_ops.
+
+And there's no reason for it that I can see-the lm_get/put_owner ops do
+the same job.
+
+Reported-by: Daire Byrne <daire@dneg.com>
+Tested-by: Daire Byrne <daire@dneg.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/svclock.c | 30 ++++++++++++------------------
+ 1 file changed, 12 insertions(+), 18 deletions(-)
+
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index 498cb70c2c0d..273a81971ed5 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -395,28 +395,10 @@ nlmsvc_release_lockowner(struct nlm_lock *lock)
+ nlmsvc_put_lockowner(lock->fl.fl_owner);
+ }
+
+-static void nlmsvc_locks_copy_lock(struct file_lock *new, struct file_lock *fl)
+-{
+- struct nlm_lockowner *nlm_lo = (struct nlm_lockowner *)fl->fl_owner;
+- new->fl_owner = nlmsvc_get_lockowner(nlm_lo);
+-}
+-
+-static void nlmsvc_locks_release_private(struct file_lock *fl)
+-{
+- nlmsvc_put_lockowner((struct nlm_lockowner *)fl->fl_owner);
+-}
+-
+-static const struct file_lock_operations nlmsvc_lock_ops = {
+- .fl_copy_lock = nlmsvc_locks_copy_lock,
+- .fl_release_private = nlmsvc_locks_release_private,
+-};
+-
+ void nlmsvc_locks_init_private(struct file_lock *fl, struct nlm_host *host,
+ pid_t pid)
+ {
+ fl->fl_owner = nlmsvc_find_lockowner(host, pid);
+- if (fl->fl_owner != NULL)
+- fl->fl_ops = &nlmsvc_lock_ops;
+ }
+
+ /*
+@@ -788,9 +770,21 @@ nlmsvc_notify_blocked(struct file_lock *fl)
+ printk(KERN_WARNING "lockd: notification for unknown block!\n");
+ }
+
++static fl_owner_t nlmsvc_get_owner(fl_owner_t owner)
++{
++ return nlmsvc_get_lockowner(owner);
++}
++
++static void nlmsvc_put_owner(fl_owner_t owner)
++{
++ nlmsvc_put_lockowner(owner);
++}
++
+ const struct lock_manager_operations nlmsvc_lock_operations = {
+ .lm_notify = nlmsvc_notify_blocked,
+ .lm_grant = nlmsvc_grant_deferred,
++ .lm_get_owner = nlmsvc_get_owner,
++ .lm_put_owner = nlmsvc_put_owner,
+ };
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 974d640a5099aea4838ff15d942e5ac6649740c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 23:27:38 +0200
+Subject: locking/rtmutex: Set proper wait context for lockdep
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit b41cda03765580caf7723b8c1b672d191c71013f ]
+
+RT mutexes belong to the LD_WAIT_SLEEP class. Make them so.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20210815211302.031014562@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rtmutex.h | 19 ++++++++++++-------
+ kernel/locking/rtmutex.c | 2 +-
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
+index d1672de9ca89..87b325aec508 100644
+--- a/include/linux/rtmutex.h
++++ b/include/linux/rtmutex.h
+@@ -52,17 +52,22 @@ do { \
+ } while (0)
+
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-#define __DEP_MAP_RT_MUTEX_INITIALIZER(mutexname) \
+- , .dep_map = { .name = #mutexname }
++#define __DEP_MAP_RT_MUTEX_INITIALIZER(mutexname) \
++ .dep_map = { \
++ .name = #mutexname, \
++ .wait_type_inner = LD_WAIT_SLEEP, \
++ }
+ #else
+ #define __DEP_MAP_RT_MUTEX_INITIALIZER(mutexname)
+ #endif
+
+-#define __RT_MUTEX_INITIALIZER(mutexname) \
+- { .wait_lock = __RAW_SPIN_LOCK_UNLOCKED(mutexname.wait_lock) \
+- , .waiters = RB_ROOT_CACHED \
+- , .owner = NULL \
+- __DEP_MAP_RT_MUTEX_INITIALIZER(mutexname)}
++#define __RT_MUTEX_INITIALIZER(mutexname) \
++{ \
++ .wait_lock = __RAW_SPIN_LOCK_UNLOCKED(mutexname.wait_lock), \
++ .waiters = RB_ROOT_CACHED, \
++ .owner = NULL, \
++ __DEP_MAP_RT_MUTEX_INITIALIZER(mutexname) \
++}
+
+ #define DEFINE_RT_MUTEX(mutexname) \
+ struct rt_mutex mutexname = __RT_MUTEX_INITIALIZER(mutexname)
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index ad0db322ed3b..1a7e3f838077 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1556,7 +1556,7 @@ void __sched __rt_mutex_init(struct rt_mutex *lock, const char *name,
+ struct lock_class_key *key)
+ {
+ debug_check_no_locks_freed((void *)lock, sizeof(*lock));
+- lockdep_init_map(&lock->dep_map, name, key, 0);
++ lockdep_init_map_wait(&lock->dep_map, name, key, 0, LD_WAIT_SLEEP);
+
+ __rt_mutex_basic_init(lock);
+ }
+--
+2.30.2
+
--- /dev/null
+From 402139956c18411d2bd4b740da21e8956f549574 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 18:01:31 +1000
+Subject: m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit db87db65c1059f3be04506d122f8ec9b2fa3b05e ]
+
+> Hi Arnd,
+>
+> First bad commit (maybe != root cause):
+>
+> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
+> head: 2f73937c9aa561e2082839bc1a8efaac75d6e244
+> commit: 47fd22f2b84765a2f7e3f150282497b902624547 [4771/5318] cs89x0: rework driver configuration
+> config: m68k-randconfig-c003-20210804 (attached as .config)
+> compiler: m68k-linux-gcc (GCC) 10.3.0
+> reproduce (this is a W=1 build):
+> wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
+> chmod +x ~/bin/make.cross
+> # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=47fd22f2b84765a2f7e3f150282497b902624547
+> git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
+> git fetch --no-tags linux-next master
+> git checkout 47fd22f2b84765a2f7e3f150282497b902624547
+> # save the attached .config to linux build tree
+> COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-10.3.0 make.cross ARCH=m68k
+>
+> If you fix the issue, kindly add following tag as appropriate
+> Reported-by: kernel test robot <lkp@intel.com>
+>
+> All errors (new ones prefixed by >>):
+>
+> In file included from include/linux/kernel.h:19,
+> from include/linux/list.h:9,
+> from include/linux/module.h:12,
+> from drivers/net/ethernet/cirrus/cs89x0.c:51:
+> drivers/net/ethernet/cirrus/cs89x0.c: In function 'net_open':
+> drivers/net/ethernet/cirrus/cs89x0.c:897:20: error: implicit declaration of function 'isa_virt_to_bus'; did you mean 'virt_to_bus'? [-Werror=implicit-function-declaration]
+> 897 | (unsigned long)isa_virt_to_bus(lp->dma_buff));
+> | ^~~~~~~~~~~~~~~
+> include/linux/printk.h:141:17: note: in definition of macro 'no_printk'
+> 141 | printk(fmt, ##__VA_ARGS__); \
+> | ^~~~~~~~~~~
+> drivers/net/ethernet/cirrus/cs89x0.c:86:3: note: in expansion of macro 'pr_debug'
+> 86 | pr_##level(fmt, ##__VA_ARGS__); \
+> | ^~~
+> drivers/net/ethernet/cirrus/cs89x0.c:894:3: note: in expansion of macro 'cs89_dbg'
+> 894 | cs89_dbg(1, debug, "%s: dma %lx %lx\n",
+> | ^~~~~~~~
+> >> drivers/net/ethernet/cirrus/cs89x0.c:914:3: error: implicit declaration of function 'disable_dma'; did you mean 'disable_irq'? [-Werror=implicit-function-declaration]
+
+As far as I can tell, this is a bug with the m68kmmu architecture, not
+with my driver:
+The CONFIG_ISA_DMA_API option is provided for coldfire, which implements it,
+but dragonball also sets the option as a side-effect, without actually
+implementing
+the interfaces. The patch below should fix it.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/Kconfig.bus | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/m68k/Kconfig.bus b/arch/m68k/Kconfig.bus
+index f1be832e2b74..d1e93a39cd3b 100644
+--- a/arch/m68k/Kconfig.bus
++++ b/arch/m68k/Kconfig.bus
+@@ -63,7 +63,7 @@ source "drivers/zorro/Kconfig"
+
+ endif
+
+-if !MMU
++if COLDFIRE
+
+ config ISA_DMA_API
+ def_bool !M5272
+--
+2.30.2
+
--- /dev/null
+From 4a8b88b52bd3fc2e893e47f1175b68c808384028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 14:32:46 +0200
+Subject: mac80211: Fix monitor MTU limit so that A-MSDUs get through
+
+From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+
+[ Upstream commit 79f5962baea74ce1cd4e5949598944bff854b166 ]
+
+The maximum MTU was set to 2304, which is the maximum MSDU size. While
+this is valid for normal WLAN interfaces, it is too low for monitor
+interfaces. A monitor interface may receive and inject MPDU frames, and
+the maximum MPDU frame size is larger than 2304. The MPDU may also
+contain an A-MSDU frame, in which case the size may be much larger than
+the MTU limit. Since the maximum size of an A-MSDU depends on the PHY
+mode of the transmitting STA, it is not possible to set an exact MTU
+limit for a monitor interface. Now the maximum MTU for a monitor
+interface is unrestricted.
+
+Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Link: https://lore.kernel.org/r/20210628123246.2070558-1-johan.almbladh@anyfinetworks.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/iface.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 1e5e9fc45523..cd96cd337aa8 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2001,9 +2001,16 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
+
+ netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
+
+- /* MTU range: 256 - 2304 */
++ /* MTU range is normally 256 - 2304, where the upper limit is
++ * the maximum MSDU size. Monitor interfaces send and receive
++ * MPDU and A-MSDU frames which may be much larger so we do
++ * not impose an upper limit in that case.
++ */
+ ndev->min_mtu = 256;
+- ndev->max_mtu = local->hw.max_mtu;
++ if (type == NL80211_IFTYPE_MONITOR)
++ ndev->max_mtu = 0;
++ else
++ ndev->max_mtu = local->hw.max_mtu;
+
+ ret = cfg80211_register_netdevice(ndev);
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From d8bcd8a9e1ba55337c3f6dd4421ff38bb55a4567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 10:18:43 +0200
+Subject: media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 672fe1cf145ab9978c62eb827d6a16aa6b63994b ]
+
+When hmm_pool_register() fails, a pairing PM usage counter
+increment is needed to keep the counter balanced. It's the
+same for the following error paths.
+
+Link: https://lore.kernel.org/linux-media/20210408081850.24278-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+index 948769ca6539..af0d83eaa68c 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+@@ -1815,6 +1815,7 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+ hmm_cleanup();
+ hmm_pool_unregister(HMM_POOL_TYPE_RESERVED);
+ hmm_pool_fail:
++ pm_runtime_get_noresume(&pdev->dev);
+ destroy_workqueue(isp->wdt_work_queue);
+ wdt_work_queue_fail:
+ atomisp_acc_cleanup(isp);
+--
+2.30.2
+
--- /dev/null
+From d34c0e3c0419e2bdea1d9cf3924bde433f9435b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 09:23:29 +0200
+Subject: media: atomisp: pci: fix error return code in atomisp_pci_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit d14e272958bdfdc40dcafb827d24ba6fdafa9d52 ]
+
+If init_atomisp_wdts() fails, atomisp_pci_probe() need return
+error code.
+
+Link: https://lore.kernel.org/linux-media/20210617072329.1233662-1-yangyingliang@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+index af0d83eaa68c..1e324f1f656e 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+@@ -1763,7 +1763,8 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+ if (err < 0)
+ goto register_entities_fail;
+ /* init atomisp wdts */
+- if (init_atomisp_wdts(isp) != 0)
++ err = init_atomisp_wdts(isp);
++ if (err != 0)
+ goto wdt_work_queue_fail;
+
+ /* save the iunit context only once after all the values are init'ed. */
+--
+2.30.2
+
--- /dev/null
+From 2246cf57bcd0fb9743f87e7a27b20eceb79b2eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 13:28:57 +0200
+Subject: media: dib8000: rewrite the init prbs logic
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 8db11aebdb8f93f46a8513c22c9bd52fa23263aa ]
+
+The logic at dib8000_get_init_prbs() has a few issues:
+
+1. the tables used there has an extra unused value at the beginning;
+2. the dprintk() message doesn't write the right value when
+ transmission mode is not 8K;
+3. the array overflow validation is done by the callers.
+
+Rewrite the code to fix such issues.
+
+This should also shut up those smatch warnings:
+
+ drivers/media/dvb-frontends/dib8000.c:2125 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14
+ drivers/media/dvb-frontends/dib8000.c:2129 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_2k' 14 <= 14
+ drivers/media/dvb-frontends/dib8000.c:2131 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_4k' 14 <= 14
+ drivers/media/dvb-frontends/dib8000.c:2134 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib8000.c | 58 +++++++++++++++++++--------
+ 1 file changed, 41 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
+index 082796534b0a..bb02354a48b8 100644
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -2107,32 +2107,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *an
+ dib8000_write_word(state, 117 + mode, ana_fe[mode]);
+ }
+
+-static const u16 lut_prbs_2k[14] = {
+- 0, 0x423, 0x009, 0x5C7, 0x7A6, 0x3D8, 0x527, 0x7FF, 0x79B, 0x3D6, 0x3A2, 0x53B, 0x2F4, 0x213
++static const u16 lut_prbs_2k[13] = {
++ 0x423, 0x009, 0x5C7,
++ 0x7A6, 0x3D8, 0x527,
++ 0x7FF, 0x79B, 0x3D6,
++ 0x3A2, 0x53B, 0x2F4,
++ 0x213
+ };
+-static const u16 lut_prbs_4k[14] = {
+- 0, 0x208, 0x0C3, 0x7B9, 0x423, 0x5C7, 0x3D8, 0x7FF, 0x3D6, 0x53B, 0x213, 0x029, 0x0D0, 0x48E
++
++static const u16 lut_prbs_4k[13] = {
++ 0x208, 0x0C3, 0x7B9,
++ 0x423, 0x5C7, 0x3D8,
++ 0x7FF, 0x3D6, 0x53B,
++ 0x213, 0x029, 0x0D0,
++ 0x48E
+ };
+-static const u16 lut_prbs_8k[14] = {
+- 0, 0x740, 0x069, 0x7DD, 0x208, 0x7B9, 0x5C7, 0x7FF, 0x53B, 0x029, 0x48E, 0x4C4, 0x367, 0x684
++
++static const u16 lut_prbs_8k[13] = {
++ 0x740, 0x069, 0x7DD,
++ 0x208, 0x7B9, 0x5C7,
++ 0x7FF, 0x53B, 0x029,
++ 0x48E, 0x4C4, 0x367,
++ 0x684
+ };
+
+ static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
+ {
+ int sub_channel_prbs_group = 0;
++ int prbs_group;
+
+- sub_channel_prbs_group = (subchannel / 3) + 1;
+- dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
++ sub_channel_prbs_group = subchannel / 3;
++ if (sub_channel_prbs_group >= ARRAY_SIZE(lut_prbs_2k))
++ return 0;
+
+ switch (state->fe[0]->dtv_property_cache.transmission_mode) {
+ case TRANSMISSION_MODE_2K:
+- return lut_prbs_2k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_2k[sub_channel_prbs_group];
++ break;
+ case TRANSMISSION_MODE_4K:
+- return lut_prbs_4k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_4k[sub_channel_prbs_group];
++ break;
+ default:
+ case TRANSMISSION_MODE_8K:
+- return lut_prbs_8k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_8k[sub_channel_prbs_group];
+ }
++
++ dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n",
++ sub_channel_prbs_group, subchannel, prbs_group);
++
++ return prbs_group;
+ }
+
+ static void dib8000_set_13seg_channel(struct dib8000_state *state)
+@@ -2409,10 +2432,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq
+ /* TSB or ISDBT ? apply it now */
+ if (c->isdbt_sb_mode) {
+ dib8000_set_sb_channel(state);
+- if (c->isdbt_sb_subchannel < 14)
+- init_prbs = dib8000_get_init_prbs(state, c->isdbt_sb_subchannel);
+- else
+- init_prbs = 0;
++ init_prbs = dib8000_get_init_prbs(state,
++ c->isdbt_sb_subchannel);
+ } else {
+ dib8000_set_13seg_channel(state);
+ init_prbs = 0xfff;
+@@ -3004,6 +3025,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
+
+ unsigned long *timeout = &state->timeout;
+ unsigned long now = jiffies;
++ u16 init_prbs;
+ #ifdef DIB8000_AGC_FREEZE
+ u16 agc1, agc2;
+ #endif
+@@ -3302,8 +3324,10 @@ static int dib8000_tune(struct dvb_frontend *fe)
+ break;
+
+ case CT_DEMOD_STEP_11: /* 41 : init prbs autosearch */
+- if (state->subchannel <= 41) {
+- dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
++ init_prbs = dib8000_get_init_prbs(state, state->subchannel);
++
++ if (init_prbs) {
++ dib8000_set_subchannel_prbs(state, init_prbs);
+ *tune_state = CT_DEMOD_STEP_9;
+ } else {
+ *tune_state = CT_DEMOD_STOP;
+--
+2.30.2
+
--- /dev/null
+From 146ee4157aba2b7dfacd757f9012d1af17707598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 22:52:33 +0200
+Subject: media: hantro: vp8: Move noisy WARN_ON to vpu_debug
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 6ad61a7847da09b6261824accb539d05bcdfef65 ]
+
+When the VP8 decoders can't find a reference frame,
+the driver falls back to the current output frame.
+
+This will probably produce some undesirable results,
+leading to frame corruption, but shouldn't cause
+noisy warnings.
+
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Acked-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Tested-by: Alex Bee <knaerzche@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/hantro/hantro_g1_vp8_dec.c | 13 ++++++++++---
+ .../staging/media/hantro/rockchip_vpu2_hw_vp8_dec.c | 13 ++++++++++---
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/hantro/hantro_g1_vp8_dec.c b/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
+index 96622a7f8279..2afd5996d75f 100644
+--- a/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
++++ b/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
+@@ -376,12 +376,17 @@ static void cfg_ref(struct hantro_ctx *ctx,
+ vb2_dst = hantro_get_dst_buf(ctx);
+
+ ref = hantro_get_ref(ctx, hdr->last_frame_ts);
+- if (!ref)
++ if (!ref) {
++ vpu_debug(0, "failed to find last frame ts=%llu\n",
++ hdr->last_frame_ts);
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
++ }
+ vdpu_write_relaxed(vpu, ref, G1_REG_ADDR_REF(0));
+
+ ref = hantro_get_ref(ctx, hdr->golden_frame_ts);
+- WARN_ON(!ref && hdr->golden_frame_ts);
++ if (!ref && hdr->golden_frame_ts)
++ vpu_debug(0, "failed to find golden frame ts=%llu\n",
++ hdr->golden_frame_ts);
+ if (!ref)
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+ if (hdr->flags & V4L2_VP8_FRAME_FLAG_SIGN_BIAS_GOLDEN)
+@@ -389,7 +394,9 @@ static void cfg_ref(struct hantro_ctx *ctx,
+ vdpu_write_relaxed(vpu, ref, G1_REG_ADDR_REF(4));
+
+ ref = hantro_get_ref(ctx, hdr->alt_frame_ts);
+- WARN_ON(!ref && hdr->alt_frame_ts);
++ if (!ref && hdr->alt_frame_ts)
++ vpu_debug(0, "failed to find alt frame ts=%llu\n",
++ hdr->alt_frame_ts);
+ if (!ref)
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+ if (hdr->flags & V4L2_VP8_FRAME_FLAG_SIGN_BIAS_ALT)
+diff --git a/drivers/staging/media/hantro/rockchip_vpu2_hw_vp8_dec.c b/drivers/staging/media/hantro/rockchip_vpu2_hw_vp8_dec.c
+index 951b55f58a61..704607511b57 100644
+--- a/drivers/staging/media/hantro/rockchip_vpu2_hw_vp8_dec.c
++++ b/drivers/staging/media/hantro/rockchip_vpu2_hw_vp8_dec.c
+@@ -453,12 +453,17 @@ static void cfg_ref(struct hantro_ctx *ctx,
+ vb2_dst = hantro_get_dst_buf(ctx);
+
+ ref = hantro_get_ref(ctx, hdr->last_frame_ts);
+- if (!ref)
++ if (!ref) {
++ vpu_debug(0, "failed to find last frame ts=%llu\n",
++ hdr->last_frame_ts);
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
++ }
+ vdpu_write_relaxed(vpu, ref, VDPU_REG_VP8_ADDR_REF0);
+
+ ref = hantro_get_ref(ctx, hdr->golden_frame_ts);
+- WARN_ON(!ref && hdr->golden_frame_ts);
++ if (!ref && hdr->golden_frame_ts)
++ vpu_debug(0, "failed to find golden frame ts=%llu\n",
++ hdr->golden_frame_ts);
+ if (!ref)
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+ if (hdr->flags & V4L2_VP8_FRAME_FLAG_SIGN_BIAS_GOLDEN)
+@@ -466,7 +471,9 @@ static void cfg_ref(struct hantro_ctx *ctx,
+ vdpu_write_relaxed(vpu, ref, VDPU_REG_VP8_ADDR_REF2_5(2));
+
+ ref = hantro_get_ref(ctx, hdr->alt_frame_ts);
+- WARN_ON(!ref && hdr->alt_frame_ts);
++ if (!ref && hdr->alt_frame_ts)
++ vpu_debug(0, "failed to find alt frame ts=%llu\n",
++ hdr->alt_frame_ts);
+ if (!ref)
+ ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+ if (hdr->flags & V4L2_VP8_FRAME_FLAG_SIGN_BIAS_ALT)
+--
+2.30.2
+
--- /dev/null
+From 8989cc88e1ea02ef054fdce5a056d80ab53cd080 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 01:44:40 +0200
+Subject: media: imx: imx7-media-csi: Fix buffer return upon stream start
+ failure
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 0ada1697ed4256b38225319c9896661142a3572d ]
+
+When the stream fails to start, the first two buffers in the queue have
+been moved to the active_vb2_buf array and are returned to vb2 by
+imx7_csi_dma_unsetup_vb2_buf(). The function is called with the buffer
+state set to VB2_BUF_STATE_ERROR unconditionally, which is correct when
+stopping the stream, but not when the start operation fails. In that
+case, the state should be set to VB2_BUF_STATE_QUEUED. Fix it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx7-media-csi.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
+index 894c4de31790..2882964b8513 100644
+--- a/drivers/staging/media/imx/imx7-media-csi.c
++++ b/drivers/staging/media/imx/imx7-media-csi.c
+@@ -361,6 +361,7 @@ static void imx7_csi_dma_unsetup_vb2_buf(struct imx7_csi *csi,
+
+ vb->timestamp = ktime_get_ns();
+ vb2_buffer_done(vb, return_status);
++ csi->active_vb2_buf[i] = NULL;
+ }
+ }
+ }
+@@ -386,9 +387,10 @@ static int imx7_csi_dma_setup(struct imx7_csi *csi)
+ return 0;
+ }
+
+-static void imx7_csi_dma_cleanup(struct imx7_csi *csi)
++static void imx7_csi_dma_cleanup(struct imx7_csi *csi,
++ enum vb2_buffer_state return_status)
+ {
+- imx7_csi_dma_unsetup_vb2_buf(csi, VB2_BUF_STATE_ERROR);
++ imx7_csi_dma_unsetup_vb2_buf(csi, return_status);
+ imx_media_free_dma_buf(csi->dev, &csi->underrun_buf);
+ }
+
+@@ -537,9 +539,10 @@ static int imx7_csi_init(struct imx7_csi *csi)
+ return 0;
+ }
+
+-static void imx7_csi_deinit(struct imx7_csi *csi)
++static void imx7_csi_deinit(struct imx7_csi *csi,
++ enum vb2_buffer_state return_status)
+ {
+- imx7_csi_dma_cleanup(csi);
++ imx7_csi_dma_cleanup(csi, return_status);
+ imx7_csi_init_default(csi);
+ imx7_csi_dmareq_rff_disable(csi);
+ clk_disable_unprepare(csi->mclk);
+@@ -702,7 +705,7 @@ static int imx7_csi_s_stream(struct v4l2_subdev *sd, int enable)
+
+ ret = v4l2_subdev_call(csi->src_sd, video, s_stream, 1);
+ if (ret < 0) {
+- imx7_csi_deinit(csi);
++ imx7_csi_deinit(csi, VB2_BUF_STATE_QUEUED);
+ goto out_unlock;
+ }
+
+@@ -712,7 +715,7 @@ static int imx7_csi_s_stream(struct v4l2_subdev *sd, int enable)
+
+ v4l2_subdev_call(csi->src_sd, video, s_stream, 0);
+
+- imx7_csi_deinit(csi);
++ imx7_csi_deinit(csi, VB2_BUF_STATE_ERROR);
+ }
+
+ csi->is_streaming = !!enable;
+--
+2.30.2
+
--- /dev/null
+From 768d7d8245ca0ac00a0897ef308485011de04d6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 13:22:33 +0200
+Subject: media: imx258: Limit the max analogue gain to 480
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Umang Jain <umang.jain@ideasonboard.com>
+
+[ Upstream commit f809665ee75fff3f4ea8907f406a66d380aeb184 ]
+
+The range for analog gain mentioned in the datasheet is [0, 480].
+The real gain formula mentioned in the datasheet is:
+
+ Gain = 512 / (512 – X)
+
+Hence, values larger than 511 clearly makes no sense. The gain
+register field is also documented to be of 9-bits in the datasheet.
+
+Certainly, it is enough to infer that, the kernel driver currently
+advertises an arbitrary analog gain max. Fix it by rectifying the
+value as per the data sheet i.e. 480.
+
+Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx258.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c
+index 4e695096e5d0..81cdf37216ca 100644
+--- a/drivers/media/i2c/imx258.c
++++ b/drivers/media/i2c/imx258.c
+@@ -47,7 +47,7 @@
+ /* Analog gain control */
+ #define IMX258_REG_ANALOG_GAIN 0x0204
+ #define IMX258_ANA_GAIN_MIN 0
+-#define IMX258_ANA_GAIN_MAX 0x1fff
++#define IMX258_ANA_GAIN_MAX 480
+ #define IMX258_ANA_GAIN_STEP 1
+ #define IMX258_ANA_GAIN_DEFAULT 0x0
+
+--
+2.30.2
+
--- /dev/null
+From 27d930ea0626c5282e7d29318712507b4dc48f05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 13:22:32 +0200
+Subject: media: imx258: Rectify mismatch of VTS value
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 51f93add3669f1b1f540de1cf397815afbd4c756 ]
+
+The frame_length_lines (0x0340) registers are hard-coded as follows:
+
+- 4208x3118
+ frame_length_lines = 0x0c50
+
+- 2104x1560
+ frame_length_lines = 0x0638
+
+- 1048x780
+ frame_length_lines = 0x034c
+
+The driver exposes the V4L2_CID_VBLANK control in read-only mode and
+sets its value to vts_def - height, where vts_def is a mode-dependent
+value coming from the supported_modes array. It is set using one of
+the following macros defined in the driver:
+
+ #define IMX258_VTS_30FPS 0x0c98
+ #define IMX258_VTS_30FPS_2K 0x0638
+ #define IMX258_VTS_30FPS_VGA 0x034c
+
+There's a clear mismatch in the value for the full resolution mode i.e.
+IMX258_VTS_30FPS. Fix it by rectifying the macro with the value set for
+the frame_length_lines register as stated above.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx258.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c
+index 7ab9e5f9f267..4e695096e5d0 100644
+--- a/drivers/media/i2c/imx258.c
++++ b/drivers/media/i2c/imx258.c
+@@ -23,7 +23,7 @@
+ #define IMX258_CHIP_ID 0x0258
+
+ /* V_TIMING internal */
+-#define IMX258_VTS_30FPS 0x0c98
++#define IMX258_VTS_30FPS 0x0c50
+ #define IMX258_VTS_30FPS_2K 0x0638
+ #define IMX258_VTS_30FPS_VGA 0x034c
+ #define IMX258_VTS_MAX 0xffff
+--
+2.30.2
+
--- /dev/null
+From 963d86256a7f29624e9eca162a6a59451394d943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jul 2021 14:04:32 +0200
+Subject: media: platform: stm32: unprepare clocks at handling errors in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 055d2db28ec2fa3ab5c527c5604f1b32b89fa13a ]
+
+stm32_cec_probe() did not unprepare clocks on error handling paths. The
+patch fixes that.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/stm32/stm32-cec.c | 26 ++++++++++++++------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/cec/platform/stm32/stm32-cec.c b/drivers/media/cec/platform/stm32/stm32-cec.c
+index ea4b1ebfca99..0ffd89712536 100644
+--- a/drivers/media/cec/platform/stm32/stm32-cec.c
++++ b/drivers/media/cec/platform/stm32/stm32-cec.c
+@@ -305,14 +305,16 @@ static int stm32_cec_probe(struct platform_device *pdev)
+
+ cec->clk_hdmi_cec = devm_clk_get(&pdev->dev, "hdmi-cec");
+ if (IS_ERR(cec->clk_hdmi_cec) &&
+- PTR_ERR(cec->clk_hdmi_cec) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ PTR_ERR(cec->clk_hdmi_cec) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err_unprepare_cec_clk;
++ }
+
+ if (!IS_ERR(cec->clk_hdmi_cec)) {
+ ret = clk_prepare(cec->clk_hdmi_cec);
+ if (ret) {
+ dev_err(&pdev->dev, "Can't prepare hdmi-cec clock\n");
+- return ret;
++ goto err_unprepare_cec_clk;
+ }
+ }
+
+@@ -324,19 +326,27 @@ static int stm32_cec_probe(struct platform_device *pdev)
+ CEC_NAME, caps, CEC_MAX_LOG_ADDRS);
+ ret = PTR_ERR_OR_ZERO(cec->adap);
+ if (ret)
+- return ret;
++ goto err_unprepare_hdmi_cec_clk;
+
+ ret = cec_register_adapter(cec->adap, &pdev->dev);
+- if (ret) {
+- cec_delete_adapter(cec->adap);
+- return ret;
+- }
++ if (ret)
++ goto err_delete_adapter;
+
+ cec_hw_init(cec);
+
+ platform_set_drvdata(pdev, cec);
+
+ return 0;
++
++err_delete_adapter:
++ cec_delete_adapter(cec->adap);
++
++err_unprepare_hdmi_cec_clk:
++ clk_unprepare(cec->clk_hdmi_cec);
++
++err_unprepare_cec_clk:
++ clk_unprepare(cec->clk_cec);
++ return ret;
+ }
+
+ static int stm32_cec_remove(struct platform_device *pdev)
+--
+2.30.2
+
--- /dev/null
+From 9667619b39d260d91b66b8c1e74232231d940ecc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 12:46:28 +0200
+Subject: media: TDA1997x: fix tda1997x_query_dv_timings() return value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Hałasa <khalasa@piap.pl>
+
+[ Upstream commit 7dee1030871a48d4f3c5a74227a4b4188463479a ]
+
+Correctly propagate the tda1997x_detect_std error value.
+
+Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tda1997x.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
+index 3a191e257fad..ef726faee2a4 100644
+--- a/drivers/media/i2c/tda1997x.c
++++ b/drivers/media/i2c/tda1997x.c
+@@ -1695,14 +1695,15 @@ static int tda1997x_query_dv_timings(struct v4l2_subdev *sd,
+ struct v4l2_dv_timings *timings)
+ {
+ struct tda1997x_state *state = to_state(sd);
++ int ret;
+
+ v4l_dbg(1, debug, state->client, "%s\n", __func__);
+ memset(timings, 0, sizeof(struct v4l2_dv_timings));
+ mutex_lock(&state->lock);
+- tda1997x_detect_std(state, timings);
++ ret = tda1997x_detect_std(state, timings);
+ mutex_unlock(&state->lock);
+
+- return 0;
++ return ret;
+ }
+
+ static const struct v4l2_subdev_video_ops tda1997x_video_ops = {
+--
+2.30.2
+
--- /dev/null
+From f440848d2f542ac53c7a055a46a1ebdc81b43028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 16:44:32 +0200
+Subject: media: tegra-cec: Handle errors of clk_prepare_enable()
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 38367073c796a37a61549b1f66a71b3adb03802d ]
+
+tegra_cec_probe() and tegra_cec_resume() ignored possible errors of
+clk_prepare_enable(). The patch fixes this.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/tegra/tegra_cec.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/cec/platform/tegra/tegra_cec.c b/drivers/media/cec/platform/tegra/tegra_cec.c
+index 1ac0c70a5981..5e907395ca2e 100644
+--- a/drivers/media/cec/platform/tegra/tegra_cec.c
++++ b/drivers/media/cec/platform/tegra/tegra_cec.c
+@@ -366,7 +366,11 @@ static int tegra_cec_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+
+- clk_prepare_enable(cec->clk);
++ ret = clk_prepare_enable(cec->clk);
++ if (ret) {
++ dev_err(&pdev->dev, "Unable to prepare clock for CEC\n");
++ return ret;
++ }
+
+ /* set context info. */
+ cec->dev = &pdev->dev;
+@@ -446,9 +450,7 @@ static int tegra_cec_resume(struct platform_device *pdev)
+
+ dev_notice(&pdev->dev, "Resuming\n");
+
+- clk_prepare_enable(cec->clk);
+-
+- return 0;
++ return clk_prepare_enable(cec->clk);
+ }
+ #endif
+
+--
+2.30.2
+
--- /dev/null
+From 486875dc38e1d8b090216402be7b6f34b3909a13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jun 2021 13:23:12 +0200
+Subject: media: ti-vpe: cal: fix error handling in cal_camerarx_create
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 918d6d120a60c2640263396308eeb2b6afeb0cd6 ]
+
+cal_camerarx_create() doesn't handle error returned from
+cal_camerarx_sd_init_cfg(). Fix this.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/cal-camerarx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/ti-vpe/cal-camerarx.c b/drivers/media/platform/ti-vpe/cal-camerarx.c
+index 124a4e2bdefe..e2e384a887ac 100644
+--- a/drivers/media/platform/ti-vpe/cal-camerarx.c
++++ b/drivers/media/platform/ti-vpe/cal-camerarx.c
+@@ -845,7 +845,9 @@ struct cal_camerarx *cal_camerarx_create(struct cal_dev *cal,
+ if (ret)
+ goto error;
+
+- cal_camerarx_sd_init_cfg(sd, NULL);
++ ret = cal_camerarx_sd_init_cfg(sd, NULL);
++ if (ret)
++ goto error;
+
+ ret = v4l2_device_register_subdev(&cal->v4l2_dev, sd);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 2760d5a03275fb4f3103fc811ca952d068e9a1a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jun 2021 13:23:41 +0200
+Subject: media: ti-vpe: cal: fix queuing of the initial buffer
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 892c37f8a3d673b945e951a8754695c119a2b1b0 ]
+
+When starting streaming the driver currently programs the buffer
+address to the CAL base-address register and assigns the buffer pointer
+to ctx->dma.pending. This is not correct, as the buffer is not
+"pending", but active, and causes the first buffer to be needlessly
+written twice.
+
+Fix this by assigning the buffer pointer to ctx->dma.active.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/cal-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/ti-vpe/cal-video.c b/drivers/media/platform/ti-vpe/cal-video.c
+index 15fb5360cf13..552619cb81a8 100644
+--- a/drivers/media/platform/ti-vpe/cal-video.c
++++ b/drivers/media/platform/ti-vpe/cal-video.c
+@@ -694,7 +694,7 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
+
+ spin_lock_irq(&ctx->dma.lock);
+ buf = list_first_entry(&ctx->dma.queue, struct cal_buffer, list);
+- ctx->dma.pending = buf;
++ ctx->dma.active = buf;
+ list_del(&buf->list);
+ spin_unlock_irq(&ctx->dma.lock);
+
+--
+2.30.2
+
--- /dev/null
+From e839b77308c0afc891fd0305590ac9ff23cb8592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 10:22:59 +0200
+Subject: media: v4l2-dv-timings.c: fix wrong condition in two for-loops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 4108b3e6db31acc4c68133290bbcc87d4db905c9 ]
+
+These for-loops should test against v4l2_dv_timings_presets[i].bt.width,
+not if i < v4l2_dv_timings_presets[i].bt.width. Luckily nothing ever broke,
+since the smallest width is still a lot higher than the total number of
+presets, but it is wrong.
+
+The last item in the presets array is all 0, so the for-loop must stop
+when it reaches that sentinel.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Krzysztof Hałasa <khalasa@piap.pl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index 230d65a64217..af48705c704f 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -196,7 +196,7 @@ bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings *t,
+ if (!v4l2_valid_dv_timings(t, cap, fnc, fnc_handle))
+ return false;
+
+- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
++ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
+ if (v4l2_valid_dv_timings(v4l2_dv_timings_presets + i, cap,
+ fnc, fnc_handle) &&
+ v4l2_match_dv_timings(t, v4l2_dv_timings_presets + i,
+@@ -218,7 +218,7 @@ bool v4l2_find_dv_timings_cea861_vic(struct v4l2_dv_timings *t, u8 vic)
+ {
+ unsigned int i;
+
+- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
++ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
+ const struct v4l2_bt_timings *bt =
+ &v4l2_dv_timings_presets[i].bt;
+
+--
+2.30.2
+
--- /dev/null
+From 70a7d8504972e62f0cdd417ee3096da5644f5e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 09:19:51 +0200
+Subject: MIPS: Malta: fix alignment of the devicetree buffer
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit bea6a94a279bcbe6b2cde348782b28baf12255a5 ]
+
+Starting with following patch MIPS Malta is not able to boot:
+| commit 79edff12060fe7772af08607eff50c0e2486c5ba
+| Author: Rob Herring <robh@kernel.org>
+| scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9
+
+The reason is the alignment test added to the fdt_ro_probe_(). To fix
+this issue, we need to make sure that fdt_buf is aligned.
+
+Since the dtc patch was designed to uncover potential issue, I handle
+initial MIPS Malta patch as initial bug.
+
+Fixes: e81a8c7dabac ("MIPS: Malta: Setup RAM regions via DT")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mti-malta/malta-dtshim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c
+index 0ddf03df6268..f451268f6c38 100644
+--- a/arch/mips/mti-malta/malta-dtshim.c
++++ b/arch/mips/mti-malta/malta-dtshim.c
+@@ -22,7 +22,7 @@
+ #define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8
+ #define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8)
+
+-static unsigned char fdt_buf[16 << 10] __initdata;
++static unsigned char fdt_buf[16 << 10] __initdata __aligned(8);
+
+ /* determined physical memory size, not overridden by command line args */
+ extern unsigned long physical_memsize;
+--
+2.30.2
+
--- /dev/null
+From be1164c39fbba9fe1613806c4f81130682cfa950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 09:22:14 +0200
+Subject: misc/pvpanic-pci: Allow automatic loading
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 28b6a003bcdfa1fc4603b9185b247ecca7af9bef ]
+
+The virtual machine monitor (QEMU) exposes the pvpanic-pci
+device to the guest. On guest side the module exists but
+currently isn't loaded automatically. So the driver fails
+to be probed and does not its job of handling guest panic
+events.
+
+Instead of requiring manual modprobe, let's include a device
+database using the MODULE_DEVICE_TABLE macro and let the
+module auto-load when the guest gets exposed with such a
+pvpanic-pci device.
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Link: https://lore.kernel.org/r/20210629072214.901004-1-eric.auger@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pvpanic/pvpanic-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/pvpanic/pvpanic-pci.c b/drivers/misc/pvpanic/pvpanic-pci.c
+index a43c401017ae..741116b3d995 100644
+--- a/drivers/misc/pvpanic/pvpanic-pci.c
++++ b/drivers/misc/pvpanic/pvpanic-pci.c
+@@ -108,4 +108,6 @@ static struct pci_driver pvpanic_pci_driver = {
+ },
+ };
+
++MODULE_DEVICE_TABLE(pci, pvpanic_pci_id_tbl);
++
+ module_pci_driver(pvpanic_pci_driver);
+--
+2.30.2
+
--- /dev/null
+From 75d76e5be135e7bf90a7bb8dd6101e55d94e933c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 13:34:23 +0300
+Subject: misc: sram: Only map reserved areas in Tegra SYSRAM
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit fec29bf04994b478a43a7e60e6dd5ac1f7cb53ae ]
+
+On Tegra186 and later, a portion of the SYSRAM may be reserved for use
+by TZ. Non-TZ memory accesses to this portion, including speculative
+accesses, trigger SErrors that bring down the system. This does also
+happen in practice occasionally (due to speculative accesses).
+
+To fix the issue, add a flag to the SRAM driver to only map the
+device tree-specified reserved areas depending on a flag set
+based on the compatibility string. This would not affect non-Tegra
+systems that rely on the entire thing being memory mapped.
+
+If 64K pages are being used, we cannot exactly map the 4K regions
+that are placed in SYSRAM - ioremap code instead aligns to closest
+64K pages. However, since in practice the non-accessible memory area
+is 64K aligned, these mappings do not overlap with the non-accessible
+memory area and things work out.
+
+Reviewed-by: Mian Yousaf Kaukab <ykaukab@suse.de>
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Link: https://lore.kernel.org/r/20210715103423.1811101-1-mperttunen@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/sram.c | 103 +++++++++++++++++++++++++++++++-------------
+ drivers/misc/sram.h | 9 ++++
+ 2 files changed, 82 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
+index 93638ae2753a..4c26b19f5154 100644
+--- a/drivers/misc/sram.c
++++ b/drivers/misc/sram.c
+@@ -97,7 +97,24 @@ static int sram_add_partition(struct sram_dev *sram, struct sram_reserve *block,
+ struct sram_partition *part = &sram->partition[sram->partitions];
+
+ mutex_init(&part->lock);
+- part->base = sram->virt_base + block->start;
++
++ if (sram->config && sram->config->map_only_reserved) {
++ void __iomem *virt_base;
++
++ if (sram->no_memory_wc)
++ virt_base = devm_ioremap_resource(sram->dev, &block->res);
++ else
++ virt_base = devm_ioremap_resource_wc(sram->dev, &block->res);
++
++ if (IS_ERR(virt_base)) {
++ dev_err(sram->dev, "could not map SRAM at %pr\n", &block->res);
++ return PTR_ERR(virt_base);
++ }
++
++ part->base = virt_base;
++ } else {
++ part->base = sram->virt_base + block->start;
++ }
+
+ if (block->pool) {
+ ret = sram_add_pool(sram, block, start, part);
+@@ -198,6 +215,7 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
+
+ block->start = child_res.start - res->start;
+ block->size = resource_size(&child_res);
++ block->res = child_res;
+ list_add_tail(&block->list, &reserve_list);
+
+ if (of_find_property(child, "export", NULL))
+@@ -295,15 +313,17 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
+ */
+ cur_size = block->start - cur_start;
+
+- dev_dbg(sram->dev, "adding chunk 0x%lx-0x%lx\n",
+- cur_start, cur_start + cur_size);
++ if (sram->pool) {
++ dev_dbg(sram->dev, "adding chunk 0x%lx-0x%lx\n",
++ cur_start, cur_start + cur_size);
+
+- ret = gen_pool_add_virt(sram->pool,
+- (unsigned long)sram->virt_base + cur_start,
+- res->start + cur_start, cur_size, -1);
+- if (ret < 0) {
+- sram_free_partitions(sram);
+- goto err_chunks;
++ ret = gen_pool_add_virt(sram->pool,
++ (unsigned long)sram->virt_base + cur_start,
++ res->start + cur_start, cur_size, -1);
++ if (ret < 0) {
++ sram_free_partitions(sram);
++ goto err_chunks;
++ }
+ }
+
+ /* next allocation after this reserved block */
+@@ -331,40 +351,63 @@ static int atmel_securam_wait(void)
+ 10000, 500000);
+ }
+
++static const struct sram_config atmel_securam_config = {
++ .init = atmel_securam_wait,
++};
++
++/*
++ * SYSRAM contains areas that are not accessible by the
++ * kernel, such as the first 256K that is reserved for TZ.
++ * Accesses to those areas (including speculative accesses)
++ * trigger SErrors. As such we must map only the areas of
++ * SYSRAM specified in the device tree.
++ */
++static const struct sram_config tegra_sysram_config = {
++ .map_only_reserved = true,
++};
++
+ static const struct of_device_id sram_dt_ids[] = {
+ { .compatible = "mmio-sram" },
+- { .compatible = "atmel,sama5d2-securam", .data = atmel_securam_wait },
++ { .compatible = "atmel,sama5d2-securam", .data = &atmel_securam_config },
++ { .compatible = "nvidia,tegra186-sysram", .data = &tegra_sysram_config },
++ { .compatible = "nvidia,tegra194-sysram", .data = &tegra_sysram_config },
+ {}
+ };
+
+ static int sram_probe(struct platform_device *pdev)
+ {
++ const struct sram_config *config;
+ struct sram_dev *sram;
+ int ret;
+ struct resource *res;
+- int (*init_func)(void);
++
++ config = of_device_get_match_data(&pdev->dev);
+
+ sram = devm_kzalloc(&pdev->dev, sizeof(*sram), GFP_KERNEL);
+ if (!sram)
+ return -ENOMEM;
+
+ sram->dev = &pdev->dev;
++ sram->no_memory_wc = of_property_read_bool(pdev->dev.of_node, "no-memory-wc");
++ sram->config = config;
++
++ if (!config || !config->map_only_reserved) {
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (sram->no_memory_wc)
++ sram->virt_base = devm_ioremap_resource(&pdev->dev, res);
++ else
++ sram->virt_base = devm_ioremap_resource_wc(&pdev->dev, res);
++ if (IS_ERR(sram->virt_base)) {
++ dev_err(&pdev->dev, "could not map SRAM registers\n");
++ return PTR_ERR(sram->virt_base);
++ }
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- if (of_property_read_bool(pdev->dev.of_node, "no-memory-wc"))
+- sram->virt_base = devm_ioremap_resource(&pdev->dev, res);
+- else
+- sram->virt_base = devm_ioremap_resource_wc(&pdev->dev, res);
+- if (IS_ERR(sram->virt_base)) {
+- dev_err(&pdev->dev, "could not map SRAM registers\n");
+- return PTR_ERR(sram->virt_base);
++ sram->pool = devm_gen_pool_create(sram->dev, ilog2(SRAM_GRANULARITY),
++ NUMA_NO_NODE, NULL);
++ if (IS_ERR(sram->pool))
++ return PTR_ERR(sram->pool);
+ }
+
+- sram->pool = devm_gen_pool_create(sram->dev, ilog2(SRAM_GRANULARITY),
+- NUMA_NO_NODE, NULL);
+- if (IS_ERR(sram->pool))
+- return PTR_ERR(sram->pool);
+-
+ sram->clk = devm_clk_get(sram->dev, NULL);
+ if (IS_ERR(sram->clk))
+ sram->clk = NULL;
+@@ -378,15 +421,15 @@ static int sram_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, sram);
+
+- init_func = of_device_get_match_data(&pdev->dev);
+- if (init_func) {
+- ret = init_func();
++ if (config && config->init) {
++ ret = config->init();
+ if (ret)
+ goto err_free_partitions;
+ }
+
+- dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
+- gen_pool_size(sram->pool) / 1024, sram->virt_base);
++ if (sram->pool)
++ dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
++ gen_pool_size(sram->pool) / 1024, sram->virt_base);
+
+ return 0;
+
+@@ -405,7 +448,7 @@ static int sram_remove(struct platform_device *pdev)
+
+ sram_free_partitions(sram);
+
+- if (gen_pool_avail(sram->pool) < gen_pool_size(sram->pool))
++ if (sram->pool && gen_pool_avail(sram->pool) < gen_pool_size(sram->pool))
+ dev_err(sram->dev, "removed while SRAM allocated\n");
+
+ if (sram->clk)
+diff --git a/drivers/misc/sram.h b/drivers/misc/sram.h
+index 9c1d21ff7347..d2058d8c8f1d 100644
+--- a/drivers/misc/sram.h
++++ b/drivers/misc/sram.h
+@@ -5,6 +5,11 @@
+ #ifndef __SRAM_H
+ #define __SRAM_H
+
++struct sram_config {
++ int (*init)(void);
++ bool map_only_reserved;
++};
++
+ struct sram_partition {
+ void __iomem *base;
+
+@@ -15,8 +20,11 @@ struct sram_partition {
+ };
+
+ struct sram_dev {
++ const struct sram_config *config;
++
+ struct device *dev;
+ void __iomem *virt_base;
++ bool no_memory_wc;
+
+ struct gen_pool *pool;
+ struct clk *clk;
+@@ -29,6 +37,7 @@ struct sram_reserve {
+ struct list_head list;
+ u32 start;
+ u32 size;
++ struct resource res;
+ bool export;
+ bool pool;
+ bool protect_exec;
+--
+2.30.2
+
--- /dev/null
+From 4e46175058121dbe6884ca2bbb8137a85e28370d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 15:42:27 +0200
+Subject: mmc: core: Avoid hogging the CPU while polling for busy in the I/O
+ err path
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 972d5084831dc9ae30f1a4b66cb4a19fb7ba6f09 ]
+
+When mmc_blk_fix_state() sends a CMD12 to try to move the card into the
+transfer state, it calls card_busy_detect() to poll for the card's state
+with CMD13. This is done without any delays in between the commands being
+sent.
+
+Rather than fixing card_busy_detect() in this regards, let's instead
+convert into using the common mmc_poll_for_busy(), which also helps us to
+avoid open-coding.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Link: https://lore.kernel.org/r/20210702134229.357717-2-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ drivers/mmc/core/mmc_ops.c | 4 +++-
+ drivers/mmc/core/mmc_ops.h | 1 +
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index ce8aed562929..170343411f53 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1636,7 +1636,7 @@ static int mmc_blk_fix_state(struct mmc_card *card, struct request *req)
+
+ mmc_blk_send_stop(card, timeout);
+
+- err = card_busy_detect(card, timeout, NULL);
++ err = mmc_poll_for_busy(card, timeout, false, MMC_BUSY_IO);
+
+ mmc_retune_release(card->host);
+
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 973756ed4016..e2c431c0ce5d 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -435,7 +435,7 @@ static int mmc_busy_cb(void *cb_data, bool *busy)
+ u32 status = 0;
+ int err;
+
+- if (host->ops->card_busy) {
++ if (data->busy_cmd != MMC_BUSY_IO && host->ops->card_busy) {
+ *busy = host->ops->card_busy(host);
+ return 0;
+ }
+@@ -457,6 +457,7 @@ static int mmc_busy_cb(void *cb_data, bool *busy)
+ break;
+ case MMC_BUSY_HPI:
+ case MMC_BUSY_EXTR_SINGLE:
++ case MMC_BUSY_IO:
+ break;
+ default:
+ err = -EINVAL;
+@@ -521,6 +522,7 @@ int mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms,
+
+ return __mmc_poll_for_busy(card, timeout_ms, &mmc_busy_cb, &cb_data);
+ }
++EXPORT_SYMBOL_GPL(mmc_poll_for_busy);
+
+ bool mmc_prepare_busy_cmd(struct mmc_host *host, struct mmc_command *cmd,
+ unsigned int timeout_ms)
+diff --git a/drivers/mmc/core/mmc_ops.h b/drivers/mmc/core/mmc_ops.h
+index 41ab4f573a31..ae25ffc2e870 100644
+--- a/drivers/mmc/core/mmc_ops.h
++++ b/drivers/mmc/core/mmc_ops.h
+@@ -15,6 +15,7 @@ enum mmc_busy_cmd {
+ MMC_BUSY_ERASE,
+ MMC_BUSY_HPI,
+ MMC_BUSY_EXTR_SINGLE,
++ MMC_BUSY_IO,
+ };
+
+ struct mmc_host;
+--
+2.30.2
+
--- /dev/null
+From 14fe4c4b721a2a899b50e3a79ee7257522fa8476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 15:42:29 +0200
+Subject: mmc: core: Avoid hogging the CPU while polling for busy after I/O
+ writes
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 6966e6094c6d594044ef1b740dd827e05881331c ]
+
+When mmc_blk_card_busy() calls card_busy_detect() to poll for the card's
+state with CMD13, this is done without any delays in between the commands
+being sent.
+
+Rather than fixing card_busy_detect() in this regards, let's instead
+convert into using the common __mmc_poll_for_busy(), which also helps us to
+avoid open-coding.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Link: https://lore.kernel.org/r/20210702134229.357717-4-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 69 ++++++++++++++++----------------------
+ drivers/mmc/core/mmc_ops.c | 1 +
+ 2 files changed, 30 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index c30d0ab15539..a9ad9f5fa949 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -98,6 +98,11 @@ static int max_devices;
+ static DEFINE_IDA(mmc_blk_ida);
+ static DEFINE_IDA(mmc_rpmb_ida);
+
++struct mmc_blk_busy_data {
++ struct mmc_card *card;
++ u32 status;
++};
++
+ /*
+ * There is one mmc_blk_data per slot.
+ */
+@@ -417,42 +422,6 @@ static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr,
+ return 0;
+ }
+
+-static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms,
+- u32 *resp_errs)
+-{
+- unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
+- int err = 0;
+- u32 status;
+-
+- do {
+- bool done = time_after(jiffies, timeout);
+-
+- err = __mmc_send_status(card, &status, 5);
+- if (err) {
+- dev_err(mmc_dev(card->host),
+- "error %d requesting status\n", err);
+- return err;
+- }
+-
+- /* Accumulate any response error bits seen */
+- if (resp_errs)
+- *resp_errs |= status;
+-
+- /*
+- * Timeout if the device never becomes ready for data and never
+- * leaves the program state.
+- */
+- if (done) {
+- dev_err(mmc_dev(card->host),
+- "Card stuck in wrong state! %s status: %#x\n",
+- __func__, status);
+- return -ETIMEDOUT;
+- }
+- } while (!mmc_ready_for_data(status));
+-
+- return err;
+-}
+-
+ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct mmc_blk_ioc_data *idata)
+ {
+@@ -1852,28 +1821,48 @@ static inline bool mmc_blk_rq_error(struct mmc_blk_request *brq)
+ brq->data.error || brq->cmd.resp[0] & CMD_ERRORS;
+ }
+
++static int mmc_blk_busy_cb(void *cb_data, bool *busy)
++{
++ struct mmc_blk_busy_data *data = cb_data;
++ u32 status = 0;
++ int err;
++
++ err = mmc_send_status(data->card, &status);
++ if (err)
++ return err;
++
++ /* Accumulate response error bits. */
++ data->status |= status;
++
++ *busy = !mmc_ready_for_data(status);
++ return 0;
++}
++
+ static int mmc_blk_card_busy(struct mmc_card *card, struct request *req)
+ {
+ struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
+- u32 status = 0;
++ struct mmc_blk_busy_data cb_data;
+ int err;
+
+ if (mmc_host_is_spi(card->host) || rq_data_dir(req) == READ)
+ return 0;
+
+- err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, &status);
++ cb_data.card = card;
++ cb_data.status = 0;
++ err = __mmc_poll_for_busy(card, MMC_BLK_TIMEOUT_MS, &mmc_blk_busy_cb,
++ &cb_data);
+
+ /*
+ * Do not assume data transferred correctly if there are any error bits
+ * set.
+ */
+- if (status & mmc_blk_stop_err_bits(&mqrq->brq)) {
++ if (cb_data.status & mmc_blk_stop_err_bits(&mqrq->brq)) {
+ mqrq->brq.data.bytes_xfered = 0;
+ err = err ? err : -EIO;
+ }
+
+ /* Copy the exception bit so it will be seen later on */
+- if (mmc_card_mmc(card) && status & R1_EXCEPTION_EVENT)
++ if (mmc_card_mmc(card) && cb_data.status & R1_EXCEPTION_EVENT)
+ mqrq->brq.cmd.resp[0] |= R1_EXCEPTION_EVENT;
+
+ return err;
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index e2c431c0ce5d..90d213a2203f 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -510,6 +510,7 @@ int __mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms,
+
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(__mmc_poll_for_busy);
+
+ int mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms,
+ bool retry_crc_err, enum mmc_busy_cmd busy_cmd)
+--
+2.30.2
+
--- /dev/null
+From 09a6a5ce36280f4c68d7c82f63afff1eb14c99dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 15:42:28 +0200
+Subject: mmc: core: Avoid hogging the CPU while polling for busy for mmc
+ ioctls
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 468108155b0f89cc08189cc33f9bacfe9da8a125 ]
+
+When __mmc_blk_ioctl_cmd() calls card_busy_detect() to verify that the
+card's states moves back into transfer state, the polling with CMD13 is
+done without any delays in between the commands being sent.
+
+Rather than fixing card_busy_detect() in this regards, let's instead
+convert into using the common mmc_poll_for_busy(), which also helps us to
+avoid open-coding.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Link: https://lore.kernel.org/r/20210702134229.357717-3-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 170343411f53..c30d0ab15539 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -605,7 +605,8 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ * Ensure RPMB/R1B command has completed by polling CMD13
+ * "Send Status".
+ */
+- err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, NULL);
++ err = mmc_poll_for_busy(card, MMC_BLK_TIMEOUT_MS, false,
++ MMC_BUSY_IO);
+ }
+
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 991a0f11c77a31c61d5017eaf6f0ab8df5051310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 00:47:26 +0530
+Subject: mmc: core: Return correct emmc response in case of ioctl error
+
+From: Nishad Kamdar <nishadkamdar@gmail.com>
+
+[ Upstream commit e72a55f2e5ddcfb3dce0701caf925ce435b87682 ]
+
+When a read/write command is sent via ioctl to the kernel,
+and the command fails, the actual error response of the emmc
+is not sent to the user.
+
+IOCTL read/write tests are carried out using commands
+17 (Single BLock Read), 24 (Single Block Write),
+18 (Multi Block Read), 25 (Multi Block Write)
+
+The tests are carried out on a 64Gb emmc device. All of these
+tests try to access an "out of range" sector address (0x09B2FFFF).
+
+It is seen that without the patch the response received by the user
+is not OUT_OF_RANGE error (R1 response 31st bit is not set) as per
+JEDEC specification. After applying the patch proper response is seen.
+This is because the function returns without copying the response to
+the user in case of failure. This patch fixes the issue.
+
+Hence, this memcpy is required whether we get an error response or not.
+Therefor it is moved up from the current position up to immediately
+after we have called mmc_wait_for_req().
+
+The test code and the output of only the CMD17 is included in the
+commit to limit the message length.
+
+CMD17 (Test Code Snippet):
+==========================
+ printf("Forming CMD%d\n", opt_idx);
+ /* single block read */
+ cmd.blksz = 512;
+ cmd.blocks = 1;
+ cmd.write_flag = 0;
+ cmd.opcode = 17;
+ //cmd.arg = atoi(argv[3]);
+ cmd.arg = 0x09B2FFFF;
+ /* Expecting response R1B */
+ cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
+
+ memset(data, 0, sizeof(__u8) * 512);
+ mmc_ioc_cmd_set_data(cmd, data);
+
+ printf("Sending CMD%d: ARG[0x%08x]\n", opt_idx, cmd.arg);
+ if(ioctl(fd, MMC_IOC_CMD, &cmd))
+ perror("Error");
+
+ printf("\nResponse: %08x\n", cmd.response[0]);
+
+CMD17 (Output without patch):
+=============================
+test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17
+Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4
+Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 0x09B2FFF]
+Forming CMD17
+Sending CMD17: ARG[0x09b2ffff]
+Error: Connection timed out
+
+Response: 00000000
+(Incorrect response)
+
+CMD17 (Output with patch):
+==========================
+test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17
+[sudo] password for test:
+Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4
+Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 09B2FFFF]
+Forming CMD17
+Sending CMD17: ARG[0x09b2ffff]
+Error: Connection timed out
+
+Response: 80000900
+(Correct OUT_OF_ERROR response as per JEDEC specification)
+
+Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Link: https://lore.kernel.org/r/20210824191726.8296-1-nishadkamdar@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index a9ad9f5fa949..c3ecec3f6ddc 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -518,6 +518,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ return mmc_sanitize(card, idata->ic.cmd_timeout_ms);
+
+ mmc_wait_for_req(card->host, &mrq);
++ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
+
+ if (cmd.error) {
+ dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
+@@ -567,8 +568,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ if (idata->ic.postsleep_min_us)
+ usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
+
+- memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
+-
+ if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
+ /*
+ * Ensure RPMB/R1B command has completed by polling CMD13
+--
+2.30.2
+
--- /dev/null
+From 98cb845cacce8137c2f7c150a7d808a43c09e3b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Aug 2021 04:46:14 -0700
+Subject: mmc: rtsx_pci: Fix long reads when clock is prescaled
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit 3ac5e45291f3f0d699a721357380d4593bc2dcb3 ]
+
+For unexplained reasons, the prescaler register for this device needs to
+be cleared (set to 1) while performing a data read or else the command
+will hang. This does not appear to affect the real clock rate sent out
+on the bus, so I assume it's purely to work around a hardware bug.
+
+During normal operation, the prescaler is already set to 1, so nothing
+needs to be done. However, in "initial mode" (which is used for sub-MHz
+clock speeds, like the core sets while enumerating cards), it's set to
+128 and so we need to reset it during data reads. We currently fail to
+do this for long reads.
+
+This has no functional affect on the driver's operation currently
+written, as the MMC core always sets a clock above 1MHz before
+attempting any long reads. However, the core could conceivably set any
+clock speed at any time and the driver should still work, so I think
+this fix is worthwhile.
+
+I personally encountered this issue while performing data recovery on an
+external chip. My connections had poor signal integrity, so I modified
+the core code to reduce the clock speed. Without this change, I saw the
+card enumerate but was unable to actually read any data.
+
+Writes don't seem to work in the situation described above even with
+this change (and even if the workaround is extended to encompass data
+write commands). I was not able to find a way to get them working.
+
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Link: https://lore.kernel.org/r/2fef280d8409ab0100c26c6ac7050227defd098d.1627818365.git.tommyhebb@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 36 ++++++++++++++++++++-----------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index 4ca937415734..58cfaffa3c2d 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -542,9 +542,22 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host,
+ return 0;
+ }
+
++static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
++{
++ rtsx_pci_write_register(host->pcr, SD_CFG1,
++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128);
++}
++
++static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host)
++{
++ rtsx_pci_write_register(host->pcr, SD_CFG1,
++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0);
++}
++
+ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
+ {
+ struct mmc_data *data = mrq->data;
++ int err;
+
+ if (host->sg_count < 0) {
+ data->error = host->sg_count;
+@@ -553,22 +566,19 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
+ return data->error;
+ }
+
+- if (data->flags & MMC_DATA_READ)
+- return sd_read_long_data(host, mrq);
++ if (data->flags & MMC_DATA_READ) {
++ if (host->initial_mode)
++ sd_disable_initial_mode(host);
+
+- return sd_write_long_data(host, mrq);
+-}
++ err = sd_read_long_data(host, mrq);
+
+-static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
+-{
+- rtsx_pci_write_register(host->pcr, SD_CFG1,
+- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128);
+-}
++ if (host->initial_mode)
++ sd_enable_initial_mode(host);
+
+-static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host)
+-{
+- rtsx_pci_write_register(host->pcr, SD_CFG1,
+- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0);
++ return err;
++ }
++
++ return sd_write_long_data(host, mrq);
+ }
+
+ static void sd_normal_rw(struct realtek_pci_sdmmc *host,
+--
+2.30.2
+
--- /dev/null
+From 940dcf58703abaa6f3bb80a44bafc131b68f1667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 16:13:54 +0530
+Subject: mmc: sdhci-of-arasan: Check return value of non-void funtions
+
+From: Manish Narani <manish.narani@xilinx.com>
+
+[ Upstream commit 66bad6ed2204fdb78a0a8fb89d824397106a5471 ]
+
+At a couple of places, the return values of the non-void functions were
+not getting checked. This was reported by the coverity tool. Modify the
+code to check the return values of the same.
+
+Addresses-Coverity: ("check_return")
+Signed-off-by: Manish Narani <manish.narani@xilinx.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/1623753837-21035-5-git-send-email-manish.narani@xilinx.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-arasan.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index 03c80c9bb7e3..b6902447d779 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -273,7 +273,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
+ * through low speeds without power cycling.
+ */
+ sdhci_set_clock(host, host->max_clk);
+- phy_power_on(sdhci_arasan->phy);
++ if (phy_power_on(sdhci_arasan->phy)) {
++ pr_err("%s: Cannot power on phy.\n",
++ mmc_hostname(host->mmc));
++ return;
++ }
++
+ sdhci_arasan->is_phy_on = true;
+
+ /*
+@@ -323,7 +328,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
+ msleep(20);
+
+ if (ctrl_phy) {
+- phy_power_on(sdhci_arasan->phy);
++ if (phy_power_on(sdhci_arasan->phy)) {
++ pr_err("%s: Cannot power on phy.\n",
++ mmc_hostname(host->mmc));
++ return;
++ }
++
+ sdhci_arasan->is_phy_on = true;
+ }
+ }
+@@ -479,7 +489,9 @@ static int sdhci_arasan_suspend(struct device *dev)
+ ret = phy_power_off(sdhci_arasan->phy);
+ if (ret) {
+ dev_err(dev, "Cannot power off phy.\n");
+- sdhci_resume_host(host);
++ if (sdhci_resume_host(host))
++ dev_err(dev, "Cannot resume host.\n");
++
+ return ret;
+ }
+ sdhci_arasan->is_phy_on = false;
+--
+2.30.2
+
--- /dev/null
+From 9df53719700aeb9f6810a7b73c183c1b5b518b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 16:13:51 +0530
+Subject: mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP
+
+From: Manish Narani <manish.narani@xilinx.com>
+
+[ Upstream commit c0b4e411a9b09748466ee06d2ae6772effa64dfb ]
+
+SD standard speed timing was met only at 19MHz and not 25 MHz, that's
+why changing driver to 19MHz. The reason for this is when a level shifter
+is used on the board, timing was met for standard speed only at 19MHz.
+Since this level shifter is commonly required for high speed modes,
+the driver is modified to use standard speed of 19Mhz.
+
+Signed-off-by: Manish Narani <manish.narani@xilinx.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/1623753837-21035-2-git-send-email-manish.narani@xilinx.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-arasan.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index 0e7c07ed9690..03c80c9bb7e3 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -159,6 +159,12 @@ struct sdhci_arasan_data {
+ /* Controller immediately reports SDHCI_CLOCK_INT_STABLE after enabling the
+ * internal clock even when the clock isn't stable */
+ #define SDHCI_ARASAN_QUIRK_CLOCK_UNSTABLE BIT(1)
++/*
++ * Some of the Arasan variations might not have timing requirements
++ * met at 25MHz for Default Speed mode, those controllers work at
++ * 19MHz instead
++ */
++#define SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN BIT(2)
+ };
+
+ struct sdhci_arasan_of_data {
+@@ -290,6 +296,16 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
+ sdhci_arasan->is_phy_on = false;
+ }
+
++ if (sdhci_arasan->quirks & SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN) {
++ /*
++ * Some of the Arasan variations might not have timing
++ * requirements met at 25MHz for Default Speed mode,
++ * those controllers work at 19MHz instead.
++ */
++ if (clock == DEFAULT_SPEED_MAX_DTR)
++ clock = (DEFAULT_SPEED_MAX_DTR * 19) / 25;
++ }
++
+ /* Set the Input and Output Clock Phase Delays */
+ if (clk_data->set_clk_delays)
+ clk_data->set_clk_delays(host);
+@@ -1608,6 +1624,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
+ if (of_device_is_compatible(np, "xlnx,zynqmp-8.9a")) {
+ host->mmc_host_ops.execute_tuning =
+ arasan_zynqmp_execute_tuning;
++
++ sdhci_arasan->quirks |= SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN;
+ }
+
+ arasan_dt_parse_clk_phases(dev, &sdhci_arasan->clk_data);
+--
+2.30.2
+
--- /dev/null
+From 99d791f8045ffb28cae14eed5944d77d2fcfbcb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 12:13:40 -0700
+Subject: net: ethernet: stmmac: Do not use unreachable() in
+ ipq806x_gmac_probe()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 4367355dd90942a71641c98c40c74589c9bddf90 ]
+
+When compiling with clang in certain configurations, an objtool warning
+appears:
+
+drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.o: warning: objtool:
+ipq806x_gmac_probe() falls through to next function phy_modes()
+
+This happens because the unreachable annotation in the third switch
+statement is not eliminated. The compiler should know that the first
+default case would prevent the second and third from being reached as
+the comment notes but sanitizer options can make it harder for the
+compiler to reason this out.
+
+Help the compiler out by eliminating the unreachable() annotation and
+unifying the default case error handling so that there is no objtool
+warning, the meaning of the code stays the same, and there is less
+duplication.
+
+Reported-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 28dd0ed85a82..f7dc8458cde8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -289,10 +289,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL;
+ break;
+ default:
+- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
+- phy_modes(gmac->phy_mode));
+- err = -EINVAL;
+- goto err_remove_config_dt;
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
+
+@@ -309,10 +306,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id);
+ break;
+ default:
+- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
+- phy_modes(gmac->phy_mode));
+- err = -EINVAL;
+- goto err_remove_config_dt;
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
+
+@@ -329,8 +323,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id);
+ break;
+ default:
+- /* We don't get here; the switch above will have errored out */
+- unreachable();
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
+
+@@ -361,6 +354,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_unsupported_phy:
++ dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
++ phy_modes(gmac->phy_mode));
++ err = -EINVAL;
++
+ err_remove_config_dt:
+ stmmac_remove_config_dt(pdev, plat_dat);
+
+--
+2.30.2
+
--- /dev/null
+From 307855ca5c6e6a1da9a1bdcb726d4fac9b062be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 18:28:01 +0800
+Subject: net: fix NULL pointer reference in cipso_v4_doi_free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: 王贇 <yun.wang@linux.alibaba.com>
+
+[ Upstream commit e842cb60e8ac1d8a15b01e0dd4dad453807a597d ]
+
+In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
+failed, we sometime observe panic:
+
+ BUG: kernel NULL pointer dereference, address:
+ ...
+ RIP: 0010:cipso_v4_doi_free+0x3a/0x80
+ ...
+ Call Trace:
+ netlbl_cipsov4_add_std+0xf4/0x8c0
+ netlbl_cipsov4_add+0x13f/0x1b0
+ genl_family_rcv_msg_doit.isra.15+0x132/0x170
+ genl_rcv_msg+0x125/0x240
+
+This is because in cipso_v4_doi_free() there is no check
+on 'doi_def->map.std' when doi_def->type got value 1, which
+is possibe, since netlbl_cipsov4_add_std() haven't initialize
+it before alloc 'doi_def->map.std'.
+
+This patch just add the check to prevent panic happen in similar
+cases.
+
+Reported-by: Abaci <abaci@linux.alibaba.com>
+Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlabel/netlabel_cipso_v4.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
+index 000bb3da4f77..894e6b8f1a86 100644
+--- a/net/netlabel/netlabel_cipso_v4.c
++++ b/net/netlabel/netlabel_cipso_v4.c
+@@ -144,8 +144,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ return -ENOMEM;
+ doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
+ if (doi_def->map.std == NULL) {
+- ret_val = -ENOMEM;
+- goto add_std_failure;
++ kfree(doi_def);
++ return -ENOMEM;
+ }
+ doi_def->type = CIPSO_V4_MAP_TRANS;
+
+--
+2.30.2
+
--- /dev/null
+From 5850a53e1a395fde8c3be82d1c12dba6fa2d39c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:05:18 +0300
+Subject: net: Fix offloading indirect devices dependency on qdisc order
+ creation
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 74fc4f828769cca1c3be89ea92cb88feaa27ef52 ]
+
+Currently, when creating an ingress qdisc on an indirect device before
+the driver registered for callbacks, the driver will not have a chance
+to register its filter configuration callbacks.
+
+To fix that, modify the code such that it keeps track of all the ingress
+qdiscs that call flow_indr_dev_setup_offload(). When a driver calls
+flow_indr_dev_register(), go through the list of tracked ingress qdiscs
+and call the driver callback entry point so as to give it a chance to
+register its callback.
+
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/flow_offload.h | 1 +
+ net/core/flow_offload.c | 89 ++++++++++++++++++++++++++-
+ net/netfilter/nf_flow_table_offload.c | 1 +
+ net/netfilter/nf_tables_offload.c | 1 +
+ net/sched/cls_api.c | 1 +
+ 5 files changed, 92 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
+index 1b9d75aedb22..3961461d9c8b 100644
+--- a/include/net/flow_offload.h
++++ b/include/net/flow_offload.h
+@@ -451,6 +451,7 @@ struct flow_block_offload {
+ struct list_head *driver_block_list;
+ struct netlink_ext_ack *extack;
+ struct Qdisc *sch;
++ struct list_head *cb_list_head;
+ };
+
+ enum tc_setup_type;
+diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c
+index 715b67f6c62f..e3f0d5906811 100644
+--- a/net/core/flow_offload.c
++++ b/net/core/flow_offload.c
+@@ -321,6 +321,7 @@ EXPORT_SYMBOL(flow_block_cb_setup_simple);
+ static DEFINE_MUTEX(flow_indr_block_lock);
+ static LIST_HEAD(flow_block_indr_list);
+ static LIST_HEAD(flow_block_indr_dev_list);
++static LIST_HEAD(flow_indir_dev_list);
+
+ struct flow_indr_dev {
+ struct list_head list;
+@@ -346,6 +347,33 @@ static struct flow_indr_dev *flow_indr_dev_alloc(flow_indr_block_bind_cb_t *cb,
+ return indr_dev;
+ }
+
++struct flow_indir_dev_info {
++ void *data;
++ struct net_device *dev;
++ struct Qdisc *sch;
++ enum tc_setup_type type;
++ void (*cleanup)(struct flow_block_cb *block_cb);
++ struct list_head list;
++ enum flow_block_command command;
++ enum flow_block_binder_type binder_type;
++ struct list_head *cb_list;
++};
++
++static void existing_qdiscs_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
++{
++ struct flow_block_offload bo;
++ struct flow_indir_dev_info *cur;
++
++ list_for_each_entry(cur, &flow_indir_dev_list, list) {
++ memset(&bo, 0, sizeof(bo));
++ bo.command = cur->command;
++ bo.binder_type = cur->binder_type;
++ INIT_LIST_HEAD(&bo.cb_list);
++ cb(cur->dev, cur->sch, cb_priv, cur->type, &bo, cur->data, cur->cleanup);
++ list_splice(&bo.cb_list, cur->cb_list);
++ }
++}
++
+ int flow_indr_dev_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
+ {
+ struct flow_indr_dev *indr_dev;
+@@ -367,6 +395,7 @@ int flow_indr_dev_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
+ }
+
+ list_add(&indr_dev->list, &flow_block_indr_dev_list);
++ existing_qdiscs_register(cb, cb_priv);
+ mutex_unlock(&flow_indr_block_lock);
+
+ return 0;
+@@ -463,7 +492,59 @@ struct flow_block_cb *flow_indr_block_cb_alloc(flow_setup_cb_t *cb,
+ }
+ EXPORT_SYMBOL(flow_indr_block_cb_alloc);
+
+-int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch,
++static struct flow_indir_dev_info *find_indir_dev(void *data)
++{
++ struct flow_indir_dev_info *cur;
++
++ list_for_each_entry(cur, &flow_indir_dev_list, list) {
++ if (cur->data == data)
++ return cur;
++ }
++ return NULL;
++}
++
++static int indir_dev_add(void *data, struct net_device *dev, struct Qdisc *sch,
++ enum tc_setup_type type, void (*cleanup)(struct flow_block_cb *block_cb),
++ struct flow_block_offload *bo)
++{
++ struct flow_indir_dev_info *info;
++
++ info = find_indir_dev(data);
++ if (info)
++ return -EEXIST;
++
++ info = kzalloc(sizeof(*info), GFP_KERNEL);
++ if (!info)
++ return -ENOMEM;
++
++ info->data = data;
++ info->dev = dev;
++ info->sch = sch;
++ info->type = type;
++ info->cleanup = cleanup;
++ info->command = bo->command;
++ info->binder_type = bo->binder_type;
++ info->cb_list = bo->cb_list_head;
++
++ list_add(&info->list, &flow_indir_dev_list);
++ return 0;
++}
++
++static int indir_dev_remove(void *data)
++{
++ struct flow_indir_dev_info *info;
++
++ info = find_indir_dev(data);
++ if (!info)
++ return -ENOENT;
++
++ list_del(&info->list);
++
++ kfree(info);
++ return 0;
++}
++
++int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch,
+ enum tc_setup_type type, void *data,
+ struct flow_block_offload *bo,
+ void (*cleanup)(struct flow_block_cb *block_cb))
+@@ -471,6 +552,12 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch,
+ struct flow_indr_dev *this;
+
+ mutex_lock(&flow_indr_block_lock);
++
++ if (bo->command == FLOW_BLOCK_BIND)
++ indir_dev_add(data, dev, sch, type, cleanup, bo);
++ else if (bo->command == FLOW_BLOCK_UNBIND)
++ indir_dev_remove(data);
++
+ list_for_each_entry(this, &flow_block_indr_dev_list, list)
+ this->cb(dev, sch, this->cb_priv, type, bo, data, cleanup);
+
+diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
+index f92006cec94c..cbd9f59098b7 100644
+--- a/net/netfilter/nf_flow_table_offload.c
++++ b/net/netfilter/nf_flow_table_offload.c
+@@ -1097,6 +1097,7 @@ static void nf_flow_table_block_offload_init(struct flow_block_offload *bo,
+ bo->command = cmd;
+ bo->binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+ bo->extack = extack;
++ bo->cb_list_head = &flowtable->flow_block.cb_list;
+ INIT_LIST_HEAD(&bo->cb_list);
+ }
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index b58d73a96523..9656c1646222 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -353,6 +353,7 @@ static void nft_flow_block_offload_init(struct flow_block_offload *bo,
+ bo->command = cmd;
+ bo->binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+ bo->extack = extack;
++ bo->cb_list_head = &basechain->flow_block.cb_list;
+ INIT_LIST_HEAD(&bo->cb_list);
+ }
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index e3e79e9bd706..9b276d14be4c 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -634,6 +634,7 @@ static void tcf_block_offload_init(struct flow_block_offload *bo,
+ bo->block_shared = shared;
+ bo->extack = extack;
+ bo->sch = sch;
++ bo->cb_list_head = &flow_block->cb_list;
+ INIT_LIST_HEAD(&bo->cb_list);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 8b85fb9308a2f3fddfbafe4edb3127e511e2eee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 21:51:07 +0800
+Subject: net: hns3: clean up a type mismatch warning
+
+From: Guojia Liao <liaoguojia@huawei.com>
+
+[ Upstream commit e79c0e324b011b0288cd411a5b53870a7730f163 ]
+
+abs() returns signed long, which could not convert the type
+as unsigned, and it may cause a mismatch type warning from
+static tools. To fix it, this patch uses an variable to save
+the abs()'s result and does a explicit conversion.
+
+Signed-off-by: Guojia Liao <liaoguojia@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index c0a478ae9583..0dbed35645ed 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -10,7 +10,14 @@
+
+ static u16 hclge_errno_to_resp(int errno)
+ {
+- return abs(errno);
++ int resp = abs(errno);
++
++ /* The status for pf to vf msg cmd is u16, constrainted by HW.
++ * We need to keep the same type with it.
++ * The intput errno is the stander error code, it's safely to
++ * use a u16 to store the abs(errno).
++ */
++ return (u16)resp;
+ }
+
+ /* hclge_gen_resp_to_vf: used to generate a synchronous response to VF when PF
+--
+2.30.2
+
--- /dev/null
+From 3c5eb6bed399bcc6a830ea7aa1b8c1c213a75858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 12:40:08 -0500
+Subject: net: ipa: always validate filter and route tables
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 546948bf362541857d4f500705efe08a2fe0bb95 ]
+
+All checks in ipa_table_validate_build() are computed at build time,
+so build that unconditionally.
+
+In ipa_table_valid() calls to ipa_table_valid_one() are missing the
+IPA pointer parameter is missing in (a bug that shows up only when
+IPA_VALIDATE is defined). Don't bother checking whether hashed
+table memory regions are valid if hashed tables are not supported.
+
+With those things fixed, have these table validation functions built
+unconditionally (not dependent on IPA_VALIDATE).
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_table.c | 36 +++++++++++++++++-------------------
+ drivers/net/ipa/ipa_table.h | 16 ----------------
+ 2 files changed, 17 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_table.c b/drivers/net/ipa/ipa_table.c
+index 4f5b6749f6aa..c607ebec7456 100644
+--- a/drivers/net/ipa/ipa_table.c
++++ b/drivers/net/ipa/ipa_table.c
+@@ -120,8 +120,6 @@
+ */
+ #define IPA_ZERO_RULE_SIZE (2 * sizeof(__le32))
+
+-#ifdef IPA_VALIDATE
+-
+ /* Check things that can be validated at build time. */
+ static void ipa_table_validate_build(void)
+ {
+@@ -169,7 +167,7 @@ ipa_table_valid_one(struct ipa *ipa, enum ipa_mem_id mem_id, bool route)
+ return true;
+
+ /* Hashed table regions can be zero size if hashing is not supported */
+- if (hashed && !mem->size)
++ if (ipa_table_hash_support(ipa) && !mem->size)
+ return true;
+
+ dev_err(dev, "%s table region %u size 0x%02x, expected 0x%02x\n",
+@@ -183,14 +181,22 @@ bool ipa_table_valid(struct ipa *ipa)
+ {
+ bool valid;
+
+- valid = ipa_table_valid_one(IPA_MEM_V4_FILTER, false);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V4_FILTER_HASHED, false);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V6_FILTER, false);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V6_FILTER_HASHED, false);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V4_ROUTE, true);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V4_ROUTE_HASHED, true);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V6_ROUTE, true);
+- valid = valid && ipa_table_valid_one(IPA_MEM_V6_ROUTE_HASHED, true);
++ valid = ipa_table_valid_one(ipa, IPA_MEM_V4_FILTER, false);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V6_FILTER, false);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V4_ROUTE, true);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V6_ROUTE, true);
++
++ if (!ipa_table_hash_support(ipa))
++ return valid;
++
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V4_FILTER_HASHED,
++ false);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V6_FILTER_HASHED,
++ false);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V4_ROUTE_HASHED,
++ true);
++ valid = valid && ipa_table_valid_one(ipa, IPA_MEM_V6_ROUTE_HASHED,
++ true);
+
+ return valid;
+ }
+@@ -217,14 +223,6 @@ bool ipa_filter_map_valid(struct ipa *ipa, u32 filter_map)
+ return true;
+ }
+
+-#else /* !IPA_VALIDATE */
+-static void ipa_table_validate_build(void)
+-
+-{
+-}
+-
+-#endif /* !IPA_VALIDATE */
+-
+ /* Zero entry count means no table, so just return a 0 address */
+ static dma_addr_t ipa_table_addr(struct ipa *ipa, bool filter_mask, u16 count)
+ {
+diff --git a/drivers/net/ipa/ipa_table.h b/drivers/net/ipa/ipa_table.h
+index 1e2be9fce2f8..b6a9a0d79d68 100644
+--- a/drivers/net/ipa/ipa_table.h
++++ b/drivers/net/ipa/ipa_table.h
+@@ -16,8 +16,6 @@ struct ipa;
+ /* The maximum number of route table entries (IPv4, IPv6; hashed or not) */
+ #define IPA_ROUTE_COUNT_MAX 15
+
+-#ifdef IPA_VALIDATE
+-
+ /**
+ * ipa_table_valid() - Validate route and filter table memory regions
+ * @ipa: IPA pointer
+@@ -35,20 +33,6 @@ bool ipa_table_valid(struct ipa *ipa);
+ */
+ bool ipa_filter_map_valid(struct ipa *ipa, u32 filter_mask);
+
+-#else /* !IPA_VALIDATE */
+-
+-static inline bool ipa_table_valid(struct ipa *ipa)
+-{
+- return true;
+-}
+-
+-static inline bool ipa_filter_map_valid(struct ipa *ipa, u32 filter_mask)
+-{
+- return true;
+-}
+-
+-#endif /* !IPA_VALIDATE */
+-
+ /**
+ * ipa_table_hash_support() - Return true if hashed tables are supported
+ * @ipa: IPA pointer
+--
+2.30.2
+
--- /dev/null
+From 3d26d07862859bd45950366399cc82ea6abb89de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 15:23:33 -0500
+Subject: net: ipa: fix IPA v4.11 interconnect data
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 0ac26271344478ff718329fa9d4ef81d4bcbc43b ]
+
+Currently three interconnects are defined for the Qualcomm SC7280
+SoC, but this was based on a misunderstanding. There should only be
+two interconnects defined: one between the IPA and system memory;
+and another between the AP and IPA config space. The bandwidths
+defined for the memory and config interconnects do not match what I
+understand to be proper values, so update these.
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_data-v4.11.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_data-v4.11.c b/drivers/net/ipa/ipa_data-v4.11.c
+index 9353efbd504f..598b410cd7ab 100644
+--- a/drivers/net/ipa/ipa_data-v4.11.c
++++ b/drivers/net/ipa/ipa_data-v4.11.c
+@@ -368,18 +368,13 @@ static const struct ipa_mem_data ipa_mem_data = {
+ static const struct ipa_interconnect_data ipa_interconnect_data[] = {
+ {
+ .name = "memory",
+- .peak_bandwidth = 465000, /* 465 MBps */
+- .average_bandwidth = 80000, /* 80 MBps */
+- },
+- /* Average rate is unused for the next two interconnects */
+- {
+- .name = "imem",
+- .peak_bandwidth = 68570, /* 68.57 MBps */
+- .average_bandwidth = 80000, /* 80 MBps (unused?) */
++ .peak_bandwidth = 600000, /* 600 MBps */
++ .average_bandwidth = 150000, /* 150 MBps */
+ },
++ /* Average rate is unused for the next interconnect */
+ {
+ .name = "config",
+- .peak_bandwidth = 30000, /* 30 MBps */
++ .peak_bandwidth = 74000, /* 74 MBps */
+ .average_bandwidth = 0, /* unused */
+ },
+ };
+--
+2.30.2
+
--- /dev/null
+From 1372bf4f852006e7bbf8c3a04d4517770e437670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 08:54:07 -0500
+Subject: net: ipa: fix IPA v4.9 interconnects
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 0fd75f5760b6a7a7f35dff46a6cdc4f6d1a86ee8 ]
+
+Three interconnects are defined for IPA version 4.9, but there
+should only be two. They should also use names that match what's
+used for other platforms (and specified in the Device Tree binding).
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_data-v4.9.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_data-v4.9.c b/drivers/net/ipa/ipa_data-v4.9.c
+index 798d43e1eb13..4cce5dce9215 100644
+--- a/drivers/net/ipa/ipa_data-v4.9.c
++++ b/drivers/net/ipa/ipa_data-v4.9.c
+@@ -416,18 +416,13 @@ static const struct ipa_mem_data ipa_mem_data = {
+ /* Interconnect rates are in 1000 byte/second units */
+ static const struct ipa_interconnect_data ipa_interconnect_data[] = {
+ {
+- .name = "ipa_to_llcc",
++ .name = "memory",
+ .peak_bandwidth = 600000, /* 600 MBps */
+ .average_bandwidth = 150000, /* 150 MBps */
+ },
+- {
+- .name = "llcc_to_ebi1",
+- .peak_bandwidth = 1804000, /* 1.804 GBps */
+- .average_bandwidth = 150000, /* 150 MBps */
+- },
+ /* Average rate is unused for the next interconnect */
+ {
+- .name = "appss_to_ipa",
++ .name = "config",
+ .peak_bandwidth = 74000, /* 74 MBps */
+ .average_bandwidth = 0, /* unused */
+ },
+--
+2.30.2
+
--- /dev/null
+From 5da2bceca1b46d46ecfb1734b5e4145e1193a1d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 12:40:07 -0500
+Subject: net: ipa: fix ipa_cmd_table_valid()
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit f2c1dac0abcfa93e8b20065b8d6b4b2b6f9990aa ]
+
+Stop supporting different sizes for hashed and non-hashed filter or
+route tables. Add BUILD_BUG_ON() calls to verify the sizes of the
+fields in the filter/route table initialization immediate command
+are the same.
+
+Add a check to ipa_cmd_table_valid() to ensure the size of the
+memory region being checked fits within the immediate command field
+that must hold it.
+
+Remove two Boolean parameters used only for error reporting. This
+actually fixes a bug that would only show up if IPA_VALIDATE were
+defined. Define ipa_cmd_table_valid() unconditionally (no longer
+dependent on IPA_VALIDATE).
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_cmd.c | 38 ++++++++++++++++++++++++-------------
+ drivers/net/ipa/ipa_cmd.h | 15 +++------------
+ drivers/net/ipa/ipa_table.c | 2 +-
+ 3 files changed, 29 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_cmd.c b/drivers/net/ipa/ipa_cmd.c
+index af44ca41189e..bda8677eae88 100644
+--- a/drivers/net/ipa/ipa_cmd.c
++++ b/drivers/net/ipa/ipa_cmd.c
+@@ -159,35 +159,45 @@ static void ipa_cmd_validate_build(void)
+ BUILD_BUG_ON(TABLE_SIZE > field_max(IP_FLTRT_FLAGS_NHASH_SIZE_FMASK));
+ #undef TABLE_COUNT_MAX
+ #undef TABLE_SIZE
+-}
+
+-#ifdef IPA_VALIDATE
++ /* Hashed and non-hashed fields are assumed to be the same size */
++ BUILD_BUG_ON(field_max(IP_FLTRT_FLAGS_HASH_SIZE_FMASK) !=
++ field_max(IP_FLTRT_FLAGS_NHASH_SIZE_FMASK));
++ BUILD_BUG_ON(field_max(IP_FLTRT_FLAGS_HASH_ADDR_FMASK) !=
++ field_max(IP_FLTRT_FLAGS_NHASH_ADDR_FMASK));
++}
+
+ /* Validate a memory region holding a table */
+-bool ipa_cmd_table_valid(struct ipa *ipa, const struct ipa_mem *mem,
+- bool route, bool ipv6, bool hashed)
++bool ipa_cmd_table_valid(struct ipa *ipa, const struct ipa_mem *mem, bool route)
+ {
++ u32 offset_max = field_max(IP_FLTRT_FLAGS_NHASH_ADDR_FMASK);
++ u32 size_max = field_max(IP_FLTRT_FLAGS_NHASH_SIZE_FMASK);
++ const char *table = route ? "route" : "filter";
+ struct device *dev = &ipa->pdev->dev;
+- u32 offset_max;
+
+- offset_max = hashed ? field_max(IP_FLTRT_FLAGS_HASH_ADDR_FMASK)
+- : field_max(IP_FLTRT_FLAGS_NHASH_ADDR_FMASK);
++ /* Size must fit in the immediate command field that holds it */
++ if (mem->size > size_max) {
++ dev_err(dev, "%s table region size too large\n", table);
++ dev_err(dev, " (0x%04x > 0x%04x)\n",
++ mem->size, size_max);
++
++ return false;
++ }
++
++ /* Offset must fit in the immediate command field that holds it */
+ if (mem->offset > offset_max ||
+ ipa->mem_offset > offset_max - mem->offset) {
+- dev_err(dev, "IPv%c %s%s table region offset too large\n",
+- ipv6 ? '6' : '4', hashed ? "hashed " : "",
+- route ? "route" : "filter");
++ dev_err(dev, "%s table region offset too large\n", table);
+ dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
+ ipa->mem_offset, mem->offset, offset_max);
+
+ return false;
+ }
+
++ /* Entire memory range must fit within IPA-local memory */
+ if (mem->offset > ipa->mem_size ||
+ mem->size > ipa->mem_size - mem->offset) {
+- dev_err(dev, "IPv%c %s%s table region out of range\n",
+- ipv6 ? '6' : '4', hashed ? "hashed " : "",
+- route ? "route" : "filter");
++ dev_err(dev, "%s table region out of range\n", table);
+ dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
+ mem->offset, mem->size, ipa->mem_size);
+
+@@ -197,6 +207,8 @@ bool ipa_cmd_table_valid(struct ipa *ipa, const struct ipa_mem *mem,
+ return true;
+ }
+
++#ifdef IPA_VALIDATE
++
+ /* Validate the memory region that holds headers */
+ static bool ipa_cmd_header_valid(struct ipa *ipa)
+ {
+diff --git a/drivers/net/ipa/ipa_cmd.h b/drivers/net/ipa/ipa_cmd.h
+index b99262281f41..ea723419c826 100644
+--- a/drivers/net/ipa/ipa_cmd.h
++++ b/drivers/net/ipa/ipa_cmd.h
+@@ -57,20 +57,18 @@ struct ipa_cmd_info {
+ enum dma_data_direction direction;
+ };
+
+-#ifdef IPA_VALIDATE
+-
+ /**
+ * ipa_cmd_table_valid() - Validate a memory region holding a table
+ * @ipa: - IPA pointer
+ * @mem: - IPA memory region descriptor
+ * @route: - Whether the region holds a route or filter table
+- * @ipv6: - Whether the table is for IPv6 or IPv4
+- * @hashed: - Whether the table is hashed or non-hashed
+ *
+ * Return: true if region is valid, false otherwise
+ */
+ bool ipa_cmd_table_valid(struct ipa *ipa, const struct ipa_mem *mem,
+- bool route, bool ipv6, bool hashed);
++ bool route);
++
++#ifdef IPA_VALIDATE
+
+ /**
+ * ipa_cmd_data_valid() - Validate command-realted configuration is valid
+@@ -82,13 +80,6 @@ bool ipa_cmd_data_valid(struct ipa *ipa);
+
+ #else /* !IPA_VALIDATE */
+
+-static inline bool ipa_cmd_table_valid(struct ipa *ipa,
+- const struct ipa_mem *mem, bool route,
+- bool ipv6, bool hashed)
+-{
+- return true;
+-}
+-
+ static inline bool ipa_cmd_data_valid(struct ipa *ipa)
+ {
+ return true;
+diff --git a/drivers/net/ipa/ipa_table.c b/drivers/net/ipa/ipa_table.c
+index c617a9156f26..4f5b6749f6aa 100644
+--- a/drivers/net/ipa/ipa_table.c
++++ b/drivers/net/ipa/ipa_table.c
+@@ -161,7 +161,7 @@ ipa_table_valid_one(struct ipa *ipa, enum ipa_mem_id mem_id, bool route)
+ else
+ size = (1 + IPA_FILTER_COUNT_MAX) * sizeof(__le64);
+
+- if (!ipa_cmd_table_valid(ipa, mem, route, ipv6, hashed))
++ if (!ipa_cmd_table_valid(ipa, mem, route))
+ return false;
+
+ /* mem->size >= size is sufficient, but we'll demand more */
+--
+2.30.2
+
--- /dev/null
+From a4716b98b7fc37cd884b6ee5969788060d94bfb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 20:58:50 +0300
+Subject: net/mlx5: DR, Enable QP retransmission
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+[ Upstream commit ec449ed8230cd30769de3cb70ee0fce293047372 ]
+
+Under high stress, SW steering might get stuck on polling for completion
+that never comes.
+For such cases QP needs to have protocol retransmission mechanism enabled.
+Currently the retransmission timeout is defined as 0 (unlimited). Fix this
+by defining a real timeout.
+
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+index 9df0e73d1c35..69b49deb66b2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+@@ -620,6 +620,7 @@ static int dr_cmd_modify_qp_rtr2rts(struct mlx5_core_dev *mdev,
+
+ MLX5_SET(qpc, qpc, retry_count, attr->retry_cnt);
+ MLX5_SET(qpc, qpc, rnr_retry, attr->rnr_retry);
++ MLX5_SET(qpc, qpc, primary_address_path.ack_timeout, 0x8); /* ~1ms */
+
+ MLX5_SET(rtr2rts_qp_in, in, opcode, MLX5_CMD_OP_RTR2RTS_QP);
+ MLX5_SET(rtr2rts_qp_in, in, qpn, dr_qp->qpn);
+--
+2.30.2
+
--- /dev/null
+From 58bf7ba331c6648262fdbe344ea092ef405a42dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 22:30:05 +0800
+Subject: net/mlx5: DR, fix a potential use-after-free bug
+
+From: Wentao_Liang <Wentao_Liang_g@163.com>
+
+[ Upstream commit 6cc64770fb386b10a64a1fe09328396de7bb5262 ]
+
+In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to
+cur_htbl and may cause cur_htbl to be freed.
+
+However, cur_htbl is subsequently used in the next line, which may result
+in an use-after-free bug.
+
+Fix this by calling mlx5dr_err() before the cur_htbl is put.
+
+Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+index 43356fad53de..ffdfb5a94b14 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+@@ -846,9 +846,9 @@ dr_rule_handle_ste_branch(struct mlx5dr_rule *rule,
+ new_htbl = dr_rule_rehash(rule, nic_rule, cur_htbl,
+ ste_location, send_ste_list);
+ if (!new_htbl) {
+- mlx5dr_htbl_put(cur_htbl);
+ mlx5dr_err(dmn, "Failed creating rehash table, htbl-log_size: %d\n",
+ cur_htbl->chunk_size);
++ mlx5dr_htbl_put(cur_htbl);
+ } else {
+ cur_htbl = new_htbl;
+ }
+--
+2.30.2
+
--- /dev/null
+From d0b26841060038adb13acd39963e5440f939f5f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 21:15:05 +0300
+Subject: net/mlx5: Fix variable type to match 64bit
+
+From: Eran Ben Elisha <eranbe@nvidia.com>
+
+[ Upstream commit 979aa51967add26b37f9d77e01729d44a2da8e5f ]
+
+Fix the following smatch warning:
+wait_func_handle_exec_timeout() warn: should '1 << ent->idx' be a 64 bit type?
+
+Use 1ULL, to have a 64 bit type variable.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Eran Ben Elisha <eranbe@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 9d79c5ec31e9..db5dfff585c9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -877,7 +877,7 @@ static void cb_timeout_handler(struct work_struct *work)
+ ent->ret = -ETIMEDOUT;
+ mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) Async, timeout. Will cause a leak of a command resource\n",
+ ent->idx, mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in));
+- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
+
+ out:
+ cmd_ent_put(ent); /* for the cmd_ent_get() took on schedule delayed work */
+@@ -994,7 +994,7 @@ static void cmd_work_handler(struct work_struct *work)
+ MLX5_SET(mbox_out, ent->out, status, status);
+ MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
+ return;
+ }
+
+@@ -1008,7 +1008,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
+ }
+ }
+
+@@ -1068,7 +1068,7 @@ static void wait_func_handle_exec_timeout(struct mlx5_core_dev *dev,
+ mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in));
+
+ ent->ret = -ETIMEDOUT;
+- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
+ }
+
+ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
+--
+2.30.2
+
--- /dev/null
+From da13c7e7f110f5c0520387415ff7635384387bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jul 2021 14:32:49 +0200
+Subject: net: phy: Fix data type in DP83822 dp8382x_disable_wol()
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 0d6835ffe50c9c1f098b5704394331710b67af48 ]
+
+The last argument of phy_clear_bits_mmd(..., u16 val); is u16 and not
+int, just inline the value into the function call arguments.
+
+No functional change.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83822.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index f7a2ec150e54..211b5476a6f5 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -326,11 +326,9 @@ static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev)
+
+ static int dp8382x_disable_wol(struct phy_device *phydev)
+ {
+- int value = DP83822_WOL_EN | DP83822_WOL_MAGIC_EN |
+- DP83822_WOL_SECURE_ON;
+-
+- return phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
+- MII_DP83822_WOL_CFG, value);
++ return phy_clear_bits_mmd(phydev, DP83822_DEVADDR, MII_DP83822_WOL_CFG,
++ DP83822_WOL_EN | DP83822_WOL_MAGIC_EN |
++ DP83822_WOL_SECURE_ON);
+ }
+
+ static int dp83822_read_status(struct phy_device *phydev)
+--
+2.30.2
+
--- /dev/null
+From bfbdc075d33eaae9702cfee68722855e155ed97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Aug 2021 16:40:18 +0800
+Subject: net: w5100: check return value after calling platform_get_resource()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit a39ff4a47f3e1da3b036817ef436b1a9be10783a ]
+
+It will cause null-ptr-deref if platform_get_resource() returns NULL,
+we need check the return value.
+
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wiznet/w5100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
+index 811815f8cd3b..f974e70a82e8 100644
+--- a/drivers/net/ethernet/wiznet/w5100.c
++++ b/drivers/net/ethernet/wiznet/w5100.c
+@@ -1047,6 +1047,8 @@ static int w5100_mmio_probe(struct platform_device *pdev)
+ mac_addr = data->mac_addr;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!mem)
++ return -EINVAL;
+ if (resource_size(mem) < W5100_BUS_DIRECT_SIZE)
+ ops = &w5100_mmio_indirect_ops;
+ else
+--
+2.30.2
+
--- /dev/null
+From a63d64a45f891c06af472a8ce0dd2905916279f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 11:11:26 +0200
+Subject: netfilter: nft_compat: use nfnetlink_unicast()
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 241d1af4c11a75d4c17ecc0193a6ab60553efbfc ]
+
+Use nfnetlink_unicast() which already translates EAGAIN to ENOBUFS,
+since EAGAIN is reserved to report missing module dependencies to the
+nfnetlink core.
+
+e0241ae6ac59 ("netfilter: use nfnetlink_unicast() forgot to update
+this spot.
+
+Reported-by: Yajun Deng <yajun.deng@linux.dev>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_compat.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 639c337c885b..272bcdb1392d 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -683,14 +683,12 @@ static int nfnl_compat_get_rcu(struct sk_buff *skb,
+ goto out_put;
+ }
+
+- ret = netlink_unicast(info->sk, skb2, NETLINK_CB(skb).portid,
+- MSG_DONTWAIT);
+- if (ret > 0)
+- ret = 0;
++ ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid);
+ out_put:
+ rcu_read_lock();
+ module_put(THIS_MODULE);
+- return ret == -EAGAIN ? -ENOBUFS : ret;
++
++ return ret;
+ }
+
+ static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = {
+--
+2.30.2
+
--- /dev/null
+From e6c9beca36be70ddbd764b29528836637868cf9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 13:18:16 +0800
+Subject: netlink: Deal with ESRCH error in nlmsg_notify()
+
+From: Yajun Deng <yajun.deng@linux.dev>
+
+[ Upstream commit fef773fc8110d8124c73a5e6610f89e52814637d ]
+
+Yonghong Song report:
+The bpf selftest tc_bpf failed with latest bpf-next.
+The following is the command to run and the result:
+$ ./test_progs -n 132
+[ 40.947571] bpf_testmod: loading out-of-tree module taints kernel.
+test_tc_bpf:PASS:test_tc_bpf__open_and_load 0 nsec
+test_tc_bpf:PASS:bpf_tc_hook_create(BPF_TC_INGRESS) 0 nsec
+test_tc_bpf:PASS:bpf_tc_hook_create invalid hook.attach_point 0 nsec
+test_tc_bpf_basic:PASS:bpf_obj_get_info_by_fd 0 nsec
+test_tc_bpf_basic:PASS:bpf_tc_attach 0 nsec
+test_tc_bpf_basic:PASS:handle set 0 nsec
+test_tc_bpf_basic:PASS:priority set 0 nsec
+test_tc_bpf_basic:PASS:prog_id set 0 nsec
+test_tc_bpf_basic:PASS:bpf_tc_attach replace mode 0 nsec
+test_tc_bpf_basic:PASS:bpf_tc_query 0 nsec
+test_tc_bpf_basic:PASS:handle set 0 nsec
+test_tc_bpf_basic:PASS:priority set 0 nsec
+test_tc_bpf_basic:PASS:prog_id set 0 nsec
+libbpf: Kernel error message: Failed to send filter delete notification
+test_tc_bpf_basic:FAIL:bpf_tc_detach unexpected error: -3 (errno 3)
+test_tc_bpf:FAIL:test_tc_internal ingress unexpected error: -3 (errno 3)
+
+The failure seems due to the commit
+ cfdf0d9ae75b ("rtnetlink: use nlmsg_notify() in rtnetlink_send()")
+
+Deal with ESRCH error in nlmsg_notify() even the report variable is zero.
+
+Reported-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
+Link: https://lore.kernel.org/r/20210719051816.11762-1-yajun.deng@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 380f95aacdec..24b7cf447bc5 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2545,13 +2545,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
+ /* errors reported via destination sk->sk_err, but propagate
+ * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
+ err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
++ if (err == -ESRCH)
++ err = 0;
+ }
+
+ if (report) {
+ int err2;
+
+ err2 = nlmsg_unicast(sk, skb, portid);
+- if (!err || err == -ESRCH)
++ if (!err)
+ err = err2;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4387a3c5fc27d9864b5d0ddd6099206e67a740b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 13:25:02 +0200
+Subject: nfp: fix return statement in nfp_net_parse_meta()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund@corigine.com>
+
+[ Upstream commit 4431531c482a2c05126caaa9fcc5053a4a5c495b ]
+
+The return type of the function is bool and while NULL do evaluate to
+false it's not very nice, fix this by explicitly returning false. There
+is no functional change.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund@corigine.com>
+Signed-off-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index 5dfa4799c34f..ed2ade2a4f04 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -1697,7 +1697,7 @@ nfp_net_parse_meta(struct net_device *netdev, struct nfp_meta_parsed *meta,
+ case NFP_NET_META_RESYNC_INFO:
+ if (nfp_net_tls_rx_resync_req(netdev, data, pkt,
+ pkt_len))
+- return NULL;
++ return false;
+ data += sizeof(struct nfp_net_tls_resync_req);
+ break;
+ default:
+--
+2.30.2
+
--- /dev/null
+From 67a479e49f2be2acf0fc8647a484506dc925fd92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 17:02:04 -0400
+Subject: nfs: don't atempt blocking locks on nfs reexports
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit f657f8eef3ff870552c9fd2839e0061046f44618 ]
+
+NFS implements blocking locks by blocking inside its lock method. In
+the reexport case, this blocks the nfs server thread, which could lead
+to deadlocks since an nfs server thread might be required to unlock the
+conflicting lock. It also causes a crash, since the nfs server thread
+assumes it can free the lock when its lm_notify lock callback is called.
+
+Ideal would be to make the nfs lock method return without blocking in
+this case, but for now it works just not to attempt blocking locks. The
+difference is just that the original client will have to poll (as it
+does in the v4.0 case) instead of getting a callback when the lock's
+available.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Acked-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/export.c | 2 +-
+ fs/nfsd/nfs4state.c | 8 ++++++--
+ include/linux/exportfs.h | 2 ++
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/export.c b/fs/nfs/export.c
+index 37a1a88df771..d772c20bbfd1 100644
+--- a/fs/nfs/export.c
++++ b/fs/nfs/export.c
+@@ -180,5 +180,5 @@ const struct export_operations nfs_export_ops = {
+ .fetch_iversion = nfs_fetch_iversion,
+ .flags = EXPORT_OP_NOWCC|EXPORT_OP_NOSUBTREECHK|
+ EXPORT_OP_CLOSE_BEFORE_UNLINK|EXPORT_OP_REMOTE_FS|
+- EXPORT_OP_NOATOMIC_ATTR,
++ EXPORT_OP_NOATOMIC_ATTR|EXPORT_OP_SYNC_LOCKS,
+ };
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 2bedc7839ec5..d0b2041c4d75 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -6835,6 +6835,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ struct nfsd4_blocked_lock *nbl = NULL;
+ struct file_lock *file_lock = NULL;
+ struct file_lock *conflock = NULL;
++ struct super_block *sb;
+ __be32 status = 0;
+ int lkflg;
+ int err;
+@@ -6856,6 +6857,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ dprintk("NFSD: nfsd4_lock: permission denied!\n");
+ return status;
+ }
++ sb = cstate->current_fh.fh_dentry->d_sb;
+
+ if (lock->lk_is_new) {
+ if (nfsd4_has_session(cstate))
+@@ -6904,7 +6906,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ fp = lock_stp->st_stid.sc_file;
+ switch (lock->lk_type) {
+ case NFS4_READW_LT:
+- if (nfsd4_has_session(cstate))
++ if (nfsd4_has_session(cstate) &&
++ !(sb->s_export_op->flags & EXPORT_OP_SYNC_LOCKS))
+ fl_flags |= FL_SLEEP;
+ fallthrough;
+ case NFS4_READ_LT:
+@@ -6916,7 +6919,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ fl_type = F_RDLCK;
+ break;
+ case NFS4_WRITEW_LT:
+- if (nfsd4_has_session(cstate))
++ if (nfsd4_has_session(cstate) &&
++ !(sb->s_export_op->flags & EXPORT_OP_SYNC_LOCKS))
+ fl_flags |= FL_SLEEP;
+ fallthrough;
+ case NFS4_WRITE_LT:
+diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h
+index fe848901fcc3..3260fe714846 100644
+--- a/include/linux/exportfs.h
++++ b/include/linux/exportfs.h
+@@ -221,6 +221,8 @@ struct export_operations {
+ #define EXPORT_OP_NOATOMIC_ATTR (0x10) /* Filesystem cannot supply
+ atomic attribute updates
+ */
++#define EXPORT_OP_SYNC_LOCKS (0x20) /* Filesystem can't do
++ asychronous blocking locks */
+ unsigned long flags;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 03e74cb135462f0761c392d05bdc642bc63d2da6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Aug 2021 22:36:03 -0400
+Subject: nfsd: fix crash on LOCKT on reexported NFSv3
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 0bcc7ca40bd823193224e9f38bafbd8325aaf566 ]
+
+Unlike other filesystems, NFSv3 tries to use fl_file in the GETLK case.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index d0b2041c4d75..3d805f5b1f5d 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -7040,8 +7040,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ /*
+ * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
+ * so we do a temporary open here just to get an open file to pass to
+- * vfs_test_lock. (Arguably perhaps test_lock should be done with an
+- * inode operation.)
++ * vfs_test_lock.
+ */
+ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+ {
+@@ -7056,7 +7055,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
+ NFSD_MAY_READ));
+ if (err)
+ goto out;
++ lock->fl_file = nf->nf_file;
+ err = nfserrno(vfs_test_lock(nf->nf_file, lock));
++ lock->fl_file = NULL;
+ out:
+ fh_unlock(fhp);
+ nfsd_file_put(nf);
+--
+2.30.2
+
--- /dev/null
+From 229539e73bdd4ed161c6ef973fa7440f23ed5946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 08:57:20 -0400
+Subject: NFSv4/pNFS: Always allow update of a zero valued layout barrier
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 45baadaad7bf9183651fb74f4ed1200da48505a5 ]
+
+A zero value for the layout barrier indicates that it has been cleared
+(since seqid '0' is an illegal value), so we should always allow it to
+be updated.
+
+Fixes: d29b468da4f9 ("pNFS/NFSv4: Improve rejection of out-of-order layouts")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index da5cacad6979..615ac993b9f9 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -335,7 +335,7 @@ static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
+
+ static void pnfs_barrier_update(struct pnfs_layout_hdr *lo, u32 newseq)
+ {
+- if (pnfs_seqid_is_newer(newseq, lo->plh_barrier))
++ if (pnfs_seqid_is_newer(newseq, lo->plh_barrier) || !lo->plh_barrier)
+ lo->plh_barrier = newseq;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0c4dbcc75d17f8c573b2e8ad4cfc9ea74ea58dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 07:58:49 -0400
+Subject: NFSv4/pNFS: Fix a layoutget livelock loop
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit e20772cbdf463c12088837e5a08bde1b876bfd25 ]
+
+If NFS_LAYOUT_RETURN_REQUESTED is set, but there is no value set for
+the layout plh_return_seq, we can end up in a livelock loop in which
+every layout segment retrieved by a new call to layoutget is immediately
+invalidated by pnfs_layout_need_return().
+To get around this, we should just set plh_return_seq to the current
+value of the layout stateid's seqid.
+
+Fixes: d474f96104bd ("NFS: Don't return layout segments that are in use")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index ef14ea0b6ab8..da5cacad6979 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -347,11 +347,15 @@ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
+ iomode = IOMODE_ANY;
+ lo->plh_return_iomode = iomode;
+ set_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+- if (seq != 0) {
+- WARN_ON_ONCE(lo->plh_return_seq != 0 && lo->plh_return_seq != seq);
++ /*
++ * We must set lo->plh_return_seq to avoid livelocks with
++ * pnfs_layout_need_return()
++ */
++ if (seq == 0)
++ seq = be32_to_cpu(lo->plh_stateid.seqid);
++ if (!lo->plh_return_seq || pnfs_seqid_is_newer(seq, lo->plh_return_seq))
+ lo->plh_return_seq = seq;
+- pnfs_barrier_update(lo, seq);
+- }
++ pnfs_barrier_update(lo, seq);
+ }
+
+ static void
+--
+2.30.2
+
--- /dev/null
+From bc3ccdbe915d40b2200b8be5ad2eac84876f2811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 08:57:21 -0400
+Subject: NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d6236a98b3bab07c0a1455fd1ab46f79c3978cdc ]
+
+The intention of the layout barrier is to ensure that we do not update
+the layout to match an older value than the current expectation. Fix the
+test in pnfs_layout_stateid_blocked() to reflect that it is legal for
+the seqid of the stateid to match that of the barrier.
+
+Fixes: aa95edf309ef ("NFSv4/pnfs: Fix the layout barrier update")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 615ac993b9f9..51049499e98f 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1004,7 +1004,7 @@ pnfs_layout_stateid_blocked(const struct pnfs_layout_hdr *lo,
+ {
+ u32 seqid = be32_to_cpu(stateid->seqid);
+
+- return !pnfs_seqid_is_newer(seqid, lo->plh_barrier) && lo->plh_barrier;
++ return lo->plh_barrier && pnfs_seqid_is_newer(lo->plh_barrier, seqid);
+ }
+
+ /* lget is set to 1 if called from inside send_layoutget call chain */
+--
+2.30.2
+
--- /dev/null
+From fe2beb6ac65301e9d35a7b2759c3700d48cae255 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jun 2021 14:19:36 -0700
+Subject: nvme: code command_id with a genctr for use-after-free validation
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit e7006de6c23803799be000a5dcce4d916a36541a ]
+
+We cannot detect a (perhaps buggy) controller that is sending us
+a completion for a request that was already completed (for example
+sending a completion twice), this phenomenon was seen in the wild
+a few times.
+
+So to protect against this, we use the upper 4 msbits of the nvme sqe
+command_id to use as a 4-bit generation counter and verify it matches
+the existing request generation that is incrementing on every execution.
+
+The 16-bit command_id structure now is constructed by:
+| xxxx | xxxxxxxxxxxx |
+ gen request tag
+
+This means that we are giving up some possible queue depth as 12 bits
+allow for a maximum queue depth of 4095 instead of 65536, however we
+never create such long queues anyways so no real harm done.
+
+Suggested-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Acked-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Tested-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ drivers/nvme/host/nvme.h | 47 +++++++++++++++++++++++++++++++++++++-
+ drivers/nvme/host/pci.c | 2 +-
+ drivers/nvme/host/rdma.c | 4 ++--
+ drivers/nvme/host/tcp.c | 26 ++++++++++-----------
+ drivers/nvme/target/loop.c | 4 ++--
+ 6 files changed, 66 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index dfd9dec0c1f6..2f0cbaba12ac 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1029,7 +1029,8 @@ blk_status_t nvme_setup_cmd(struct nvme_ns *ns, struct request *req)
+ return BLK_STS_IOERR;
+ }
+
+- cmd->common.command_id = req->tag;
++ nvme_req(req)->genctr++;
++ cmd->common.command_id = nvme_cid(req);
+ trace_nvme_setup_cmd(req, cmd);
+ return ret;
+ }
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 5cd1fa3b8464..26511794629b 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -158,6 +158,7 @@ enum nvme_quirks {
+ struct nvme_request {
+ struct nvme_command *cmd;
+ union nvme_result result;
++ u8 genctr;
+ u8 retries;
+ u8 flags;
+ u16 status;
+@@ -497,6 +498,49 @@ struct nvme_ctrl_ops {
+ int (*get_address)(struct nvme_ctrl *ctrl, char *buf, int size);
+ };
+
++/*
++ * nvme command_id is constructed as such:
++ * | xxxx | xxxxxxxxxxxx |
++ * gen request tag
++ */
++#define nvme_genctr_mask(gen) (gen & 0xf)
++#define nvme_cid_install_genctr(gen) (nvme_genctr_mask(gen) << 12)
++#define nvme_genctr_from_cid(cid) ((cid & 0xf000) >> 12)
++#define nvme_tag_from_cid(cid) (cid & 0xfff)
++
++static inline u16 nvme_cid(struct request *rq)
++{
++ return nvme_cid_install_genctr(nvme_req(rq)->genctr) | rq->tag;
++}
++
++static inline struct request *nvme_find_rq(struct blk_mq_tags *tags,
++ u16 command_id)
++{
++ u8 genctr = nvme_genctr_from_cid(command_id);
++ u16 tag = nvme_tag_from_cid(command_id);
++ struct request *rq;
++
++ rq = blk_mq_tag_to_rq(tags, tag);
++ if (unlikely(!rq)) {
++ pr_err("could not locate request for tag %#x\n",
++ tag);
++ return NULL;
++ }
++ if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) != genctr)) {
++ dev_err(nvme_req(rq)->ctrl->device,
++ "request %#x genctr mismatch (got %#x expected %#x)\n",
++ tag, genctr, nvme_genctr_mask(nvme_req(rq)->genctr));
++ return NULL;
++ }
++ return rq;
++}
++
++static inline struct request *nvme_cid_to_rq(struct blk_mq_tags *tags,
++ u16 command_id)
++{
++ return blk_mq_tag_to_rq(tags, nvme_tag_from_cid(command_id));
++}
++
+ #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
+ void nvme_fault_inject_init(struct nvme_fault_inject *fault_inj,
+ const char *dev_name);
+@@ -594,7 +638,8 @@ static inline void nvme_put_ctrl(struct nvme_ctrl *ctrl)
+
+ static inline bool nvme_is_aen_req(u16 qid, __u16 command_id)
+ {
+- return !qid && command_id >= NVME_AQ_BLK_MQ_DEPTH;
++ return !qid &&
++ nvme_tag_from_cid(command_id) >= NVME_AQ_BLK_MQ_DEPTH;
+ }
+
+ void nvme_complete_rq(struct request *req);
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 51852085239e..c246fdacba2e 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1014,7 +1014,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ return;
+ }
+
+- req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), command_id);
++ req = nvme_find_rq(nvme_queue_tagset(nvmeq), command_id);
+ if (unlikely(!req)) {
+ dev_warn(nvmeq->dev->ctrl.device,
+ "invalid id %d completed on queue %d\n",
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 3bd9cbc80246..a68704e39084 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1730,10 +1730,10 @@ static void nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
+ struct request *rq;
+ struct nvme_rdma_request *req;
+
+- rq = blk_mq_tag_to_rq(nvme_rdma_tagset(queue), cqe->command_id);
++ rq = nvme_find_rq(nvme_rdma_tagset(queue), cqe->command_id);
+ if (!rq) {
+ dev_err(queue->ctrl->ctrl.device,
+- "tag 0x%x on QP %#x not found\n",
++ "got bad command_id %#x on QP %#x\n",
+ cqe->command_id, queue->qp->qp_num);
+ nvme_rdma_error_recovery(queue->ctrl);
+ return;
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index f05892e2e6c4..48b70e5235a3 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -487,11 +487,11 @@ static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue,
+ {
+ struct request *rq;
+
+- rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), cqe->command_id);
++ rq = nvme_find_rq(nvme_tcp_tagset(queue), cqe->command_id);
+ if (!rq) {
+ dev_err(queue->ctrl->ctrl.device,
+- "queue %d tag 0x%x not found\n",
+- nvme_tcp_queue_id(queue), cqe->command_id);
++ "got bad cqe.command_id %#x on queue %d\n",
++ cqe->command_id, nvme_tcp_queue_id(queue));
+ nvme_tcp_error_recovery(&queue->ctrl->ctrl);
+ return -EINVAL;
+ }
+@@ -508,11 +508,11 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue,
+ {
+ struct request *rq;
+
+- rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
++ rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
+ if (!rq) {
+ dev_err(queue->ctrl->ctrl.device,
+- "queue %d tag %#x not found\n",
+- nvme_tcp_queue_id(queue), pdu->command_id);
++ "got bad c2hdata.command_id %#x on queue %d\n",
++ pdu->command_id, nvme_tcp_queue_id(queue));
+ return -ENOENT;
+ }
+
+@@ -606,7 +606,7 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
+ data->hdr.plen =
+ cpu_to_le32(data->hdr.hlen + hdgst + req->pdu_len + ddgst);
+ data->ttag = pdu->ttag;
+- data->command_id = rq->tag;
++ data->command_id = nvme_cid(rq);
+ data->data_offset = cpu_to_le32(req->data_sent);
+ data->data_length = cpu_to_le32(req->pdu_len);
+ return 0;
+@@ -619,11 +619,11 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue,
+ struct request *rq;
+ int ret;
+
+- rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
++ rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
+ if (!rq) {
+ dev_err(queue->ctrl->ctrl.device,
+- "queue %d tag %#x not found\n",
+- nvme_tcp_queue_id(queue), pdu->command_id);
++ "got bad r2t.command_id %#x on queue %d\n",
++ pdu->command_id, nvme_tcp_queue_id(queue));
+ return -ENOENT;
+ }
+ req = blk_mq_rq_to_pdu(rq);
+@@ -703,7 +703,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
+ {
+ struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu;
+ struct request *rq =
+- blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
++ nvme_cid_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+
+ while (true) {
+@@ -796,8 +796,8 @@ static int nvme_tcp_recv_ddgst(struct nvme_tcp_queue *queue,
+ }
+
+ if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) {
+- struct request *rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue),
+- pdu->command_id);
++ struct request *rq = nvme_cid_to_rq(nvme_tcp_tagset(queue),
++ pdu->command_id);
+
+ nvme_tcp_end_request(rq, NVME_SC_SUCCESS);
+ queue->nr_cqe++;
+diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
+index 3a17a7e26bbf..0285ccc7541f 100644
+--- a/drivers/nvme/target/loop.c
++++ b/drivers/nvme/target/loop.c
+@@ -107,10 +107,10 @@ static void nvme_loop_queue_response(struct nvmet_req *req)
+ } else {
+ struct request *rq;
+
+- rq = blk_mq_tag_to_rq(nvme_loop_tagset(queue), cqe->command_id);
++ rq = nvme_find_rq(nvme_loop_tagset(queue), cqe->command_id);
+ if (!rq) {
+ dev_err(queue->ctrl->ctrl.device,
+- "tag 0x%x on queue %d not found\n",
++ "got bad command_id %#x on queue %d\n",
+ cqe->command_id, nvme_loop_queue_idx(queue));
+ return;
+ }
+--
+2.30.2
+
--- /dev/null
+From c2b63f82506b1cd8a97fd80be7a354038602a827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jun 2021 14:19:35 -0700
+Subject: nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 3b01a9d0caa8276d9ce314e09610f7fb70f49a00 ]
+
+We already validate it when receiving the c2hdata pdu header
+and this is not changing so this is a redundant check.
+
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 18bd68b82d78..f05892e2e6c4 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -702,17 +702,9 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
+ unsigned int *offset, size_t *len)
+ {
+ struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu;
+- struct nvme_tcp_request *req;
+- struct request *rq;
+-
+- rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+- if (!rq) {
+- dev_err(queue->ctrl->ctrl.device,
+- "queue %d tag %#x not found\n",
+- nvme_tcp_queue_id(queue), pdu->command_id);
+- return -ENOENT;
+- }
+- req = blk_mq_rq_to_pdu(rq);
++ struct request *rq =
++ blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
++ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+
+ while (true) {
+ int recv_len, ret;
+--
+2.30.2
+
--- /dev/null
+From 2d4eec09f77ad20f7a4c8a22ebad26984226af97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 09:59:45 +0100
+Subject: nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering
+
+From: Rajendra Nayak <rnayak@codeaurora.org>
+
+[ Upstream commit 11c4b3e264d68ba6dcd52d12dbcfd3f564f2f137 ]
+
+qfprom_disable_fuse_blowing() disables a bunch of resources,
+and then does a few register writes in the 'conf' address
+space.
+It works perhaps because the resources are needed only for the
+'raw' register space writes, and that the 'conf' space allows
+read/writes regardless.
+However that makes the code look confusing, so just move the
+register writes before turning off the resources in the
+function.
+
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210806085947.22682-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/qfprom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
+index 81fbad5e939d..b0ca4c626466 100644
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -139,6 +139,9 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv,
+ {
+ int ret;
+
++ writel(old->timer_val, priv->qfpconf + QFPROM_BLOW_TIMER_OFFSET);
++ writel(old->accel_val, priv->qfpconf + QFPROM_ACCEL_OFFSET);
++
+ /*
+ * This may be a shared rail and may be able to run at a lower rate
+ * when we're not blowing fuses. At the moment, the regulator framework
+@@ -159,9 +162,6 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv,
+ "Failed to set clock rate for disable (ignoring)\n");
+
+ clk_disable_unprepare(priv->secclk);
+-
+- writel(old->timer_val, priv->qfpconf + QFPROM_BLOW_TIMER_OFFSET);
+- writel(old->accel_val, priv->qfpconf + QFPROM_ACCEL_OFFSET);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 2ad505f27060e33e9a2ef19216dd83073b134a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:48:40 +0530
+Subject: octeontx2-pf: cleanup transmit link deriving logic
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 039190bb353a16657b44c5833bcad57e029c6934 ]
+
+Unlike OcteonTx2, the channel numbers used by CGX/RPM
+and LBK on CN10K silicons aren't fixed in HW. They are
+SW programmable, hence we cannot derive transmit link
+from static channel numbers anymore. Get the same from
+admin function via mailbox.
+
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/mbox.h | 1 +
+ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 9 ++++++--
+ .../marvell/octeontx2/nic/otx2_common.c | 23 ++-----------------
+ .../marvell/octeontx2/nic/otx2_common.h | 1 +
+ 4 files changed, 11 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+index f5ec39de026a..05f4334700e9 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+@@ -717,6 +717,7 @@ struct nix_lf_alloc_rsp {
+ u8 cgx_links; /* No. of CGX links present in HW */
+ u8 lbk_links; /* No. of LBK links present in HW */
+ u8 sdp_links; /* No. of SDP links present in HW */
++ u8 tx_link; /* Transmit channel link number */
+ };
+
+ struct nix_lf_free_req {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index c32195073e8a..87af164951ea 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -249,9 +249,11 @@ static bool is_valid_txschq(struct rvu *rvu, int blkaddr,
+ return true;
+ }
+
+-static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf)
++static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf,
++ struct nix_lf_alloc_rsp *rsp)
+ {
+ struct rvu_pfvf *pfvf = rvu_get_pfvf(rvu, pcifunc);
++ struct rvu_hwinfo *hw = rvu->hw;
+ struct mac_ops *mac_ops;
+ int pkind, pf, vf, lbkid;
+ u8 cgx_id, lmac_id;
+@@ -276,6 +278,8 @@ static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf)
+ pfvf->tx_chan_base = pfvf->rx_chan_base;
+ pfvf->rx_chan_cnt = 1;
+ pfvf->tx_chan_cnt = 1;
++ rsp->tx_link = cgx_id * hw->lmac_per_cgx + lmac_id;
++
+ cgx_set_pkind(rvu_cgx_pdata(cgx_id, rvu), lmac_id, pkind);
+ rvu_npc_set_pkind(rvu, pkind, pfvf);
+
+@@ -309,6 +313,7 @@ static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf)
+ rvu_nix_chan_lbk(rvu, lbkid, vf + 1);
+ pfvf->rx_chan_cnt = 1;
+ pfvf->tx_chan_cnt = 1;
++ rsp->tx_link = hw->cgx_links + lbkid;
+ rvu_npc_set_pkind(rvu, NPC_RX_LBK_PKIND, pfvf);
+ rvu_npc_install_promisc_entry(rvu, pcifunc, nixlf,
+ pfvf->rx_chan_base,
+@@ -1258,7 +1263,7 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,
+ rvu_write64(rvu, blkaddr, NIX_AF_LFX_TX_PARSE_CFG(nixlf), cfg);
+
+ intf = is_afvf(pcifunc) ? NIX_INTF_TYPE_LBK : NIX_INTF_TYPE_CGX;
+- err = nix_interface_init(rvu, pcifunc, intf, nixlf);
++ err = nix_interface_init(rvu, pcifunc, intf, nixlf, rsp);
+ if (err)
+ goto free_mem;
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index 9c8aa1f3dbbb..124465b3987c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -586,25 +586,6 @@ void otx2_get_mac_from_af(struct net_device *netdev)
+ }
+ EXPORT_SYMBOL(otx2_get_mac_from_af);
+
+-static int otx2_get_link(struct otx2_nic *pfvf)
+-{
+- int link = 0;
+- u16 map;
+-
+- /* cgx lmac link */
+- if (pfvf->hw.tx_chan_base >= CGX_CHAN_BASE) {
+- map = pfvf->hw.tx_chan_base & 0x7FF;
+- link = 4 * ((map >> 8) & 0xF) + ((map >> 4) & 0xF);
+- }
+- /* LBK channel */
+- if (pfvf->hw.tx_chan_base < SDP_CHAN_BASE) {
+- map = pfvf->hw.tx_chan_base & 0x7FF;
+- link = pfvf->hw.cgx_links | ((map >> 8) & 0xF);
+- }
+-
+- return link;
+-}
+-
+ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl)
+ {
+ struct otx2_hw *hw = &pfvf->hw;
+@@ -660,8 +641,7 @@ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl)
+ req->regval[1] = TXSCH_TL1_DFLT_RR_PRIO << 24 | DFLT_RR_QTM;
+
+ req->num_regs++;
+- req->reg[2] = NIX_AF_TL3_TL2X_LINKX_CFG(schq,
+- otx2_get_link(pfvf));
++ req->reg[2] = NIX_AF_TL3_TL2X_LINKX_CFG(schq, hw->tx_link);
+ /* Enable this queue and backpressure */
+ req->regval[2] = BIT_ULL(13) | BIT_ULL(12);
+
+@@ -1606,6 +1586,7 @@ void mbox_handler_nix_lf_alloc(struct otx2_nic *pfvf,
+ pfvf->hw.lso_tsov6_idx = rsp->lso_tsov6_idx;
+ pfvf->hw.cgx_links = rsp->cgx_links;
+ pfvf->hw.lbk_links = rsp->lbk_links;
++ pfvf->hw.tx_link = rsp->tx_link;
+ }
+ EXPORT_SYMBOL(mbox_handler_nix_lf_alloc);
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index 8c602d27108a..11686c5cf45b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -215,6 +215,7 @@ struct otx2_hw {
+ u64 cgx_fec_uncorr_blks;
+ u8 cgx_links; /* No. of CGX links present in HW */
+ u8 lbk_links; /* No. of LBK links present in HW */
++ u8 tx_link; /* Transmit channel link number */
+ #define HW_TSO 0
+ #define CN10K_MBOX 1
+ #define CN10K_LMTST 2
+--
+2.30.2
+
--- /dev/null
+From 900c95e352c1829cd28cebf25c103409498a1012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 17:32:18 +0530
+Subject: octeontx2-pf: Fix NIX1_RX interface backpressure
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit e8fb4df1f5d84bc08dd4f4827821a851d2eab241 ]
+
+'bp_ena' in Aura context is NIX block index, setting it
+zero will always backpressure NIX0 block, even if NIXLF
+belongs to NIX1. Hence fix this by setting it appropriately
+based on NIX block address.
+
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/marvell/octeontx2/nic/otx2_common.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index 94dfd64f526f..9c8aa1f3dbbb 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -1204,7 +1204,22 @@ static int otx2_aura_init(struct otx2_nic *pfvf, int aura_id,
+ /* Enable backpressure for RQ aura */
+ if (aura_id < pfvf->hw.rqpool_cnt && !is_otx2_lbkvf(pfvf->pdev)) {
+ aq->aura.bp_ena = 0;
++ /* If NIX1 LF is attached then specify NIX1_RX.
++ *
++ * Below NPA_AURA_S[BP_ENA] is set according to the
++ * NPA_BPINTF_E enumeration given as:
++ * 0x0 + a*0x1 where 'a' is 0 for NIX0_RX and 1 for NIX1_RX so
++ * NIX0_RX is 0x0 + 0*0x1 = 0
++ * NIX1_RX is 0x0 + 1*0x1 = 1
++ * But in HRM it is given that
++ * "NPA_AURA_S[BP_ENA](w1[33:32]) - Enable aura backpressure to
++ * NIX-RX based on [BP] level. One bit per NIX-RX; index
++ * enumerated by NPA_BPINTF_E."
++ */
++ if (pfvf->nix_blkaddr == BLKADDR_NIX1)
++ aq->aura.bp_ena = 1;
+ aq->aura.nix0_bpid = pfvf->bpid[0];
++
+ /* Set backpressure level for RQ's Aura */
+ aq->aura.bp = RQ_BP_LVL_AURA;
+ }
+--
+2.30.2
+
--- /dev/null
+From 438c5d2d40522d9674df59f6c621fcf6f9cd8ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 15:47:22 +0100
+Subject: of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 6211e9cb2f8faf7faae0b6caf844bfe9527cc607 ]
+
+Trying to boot without SYSFS, but with OF_DYNAMIC quickly
+results in a crash:
+
+[ 0.088460] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
+[...]
+[ 0.103927] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc3 #4179
+[ 0.105810] Hardware name: linux,dummy-virt (DT)
+[ 0.107147] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
+[ 0.108876] pc : kernfs_find_and_get_ns+0x3c/0x7c
+[ 0.110244] lr : kernfs_find_and_get_ns+0x3c/0x7c
+[...]
+[ 0.134087] Call trace:
+[ 0.134800] kernfs_find_and_get_ns+0x3c/0x7c
+[ 0.136054] safe_name+0x4c/0xd0
+[ 0.136994] __of_attach_node_sysfs+0xf8/0x124
+[ 0.138287] of_core_init+0x90/0xfc
+[ 0.139296] driver_init+0x30/0x4c
+[ 0.140283] kernel_init_freeable+0x160/0x1b8
+[ 0.141543] kernel_init+0x30/0x140
+[ 0.142561] ret_from_fork+0x10/0x18
+
+While not having sysfs isn't a very common option these days,
+it is still expected that such configuration would work.
+
+Paper over it by bailing out from __of_attach_node_sysfs() if
+CONFIG_SYSFS isn't enabled.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210820144722.169226-1-maz@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/kobj.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c
+index a32e60b024b8..6675b5e56960 100644
+--- a/drivers/of/kobj.c
++++ b/drivers/of/kobj.c
+@@ -119,7 +119,7 @@ int __of_attach_node_sysfs(struct device_node *np)
+ struct property *pp;
+ int rc;
+
+- if (!of_kset)
++ if (!IS_ENABLED(CONFIG_SYSFS) || !of_kset)
+ return 0;
+
+ np->kobj.kset = of_kset;
+--
+2.30.2
+
--- /dev/null
+From c4be34f5d0b80c2043075432567675cef5c9ad5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jul 2021 19:33:09 -0700
+Subject: openrisc: don't printk() unconditionally
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 946e1052cdcc7e585ee5d1e72528ca49fb295243 ]
+
+Don't call printk() when CONFIG_PRINTK is not set.
+Fixes the following build errors:
+
+or1k-linux-ld: arch/openrisc/kernel/entry.o: in function `_external_irq_handler':
+(.text+0x804): undefined reference to `printk'
+(.text+0x804): relocation truncated to fit: R_OR1K_INSN_REL_26 against undefined symbol `printk'
+
+Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Jonas Bonn <jonas@southpole.se>
+Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
+Cc: Stafford Horne <shorne@gmail.com>
+Cc: openrisc@lists.librecores.org
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index bc657e55c15f..98e4f97db515 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
+ l.bnf 1f // ext irq enabled, all ok.
+ l.nop
+
++#ifdef CONFIG_PRINTK
+ l.addi r1,r1,-0x8
+ l.movhi r3,hi(42f)
+ l.ori r3,r3,lo(42f)
+@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
+ .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r"
+ .align 4
+ .previous
++#endif
+
+ l.ori r4,r4,SPR_SR_IEE // fix the bug
+ // l.sw PT_SR(r1),r4
+--
+2.30.2
+
--- /dev/null
+From 8321a4e2dfe0e65fee640cdd47db5f989ef39b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:57:20 +0530
+Subject: opp: Don't print an error if required-opps is missing
+
+From: Rajendra Nayak <rnayak@codeaurora.org>
+
+[ Upstream commit 020d86fc0df8b865f6dc168d88a7c2dccabd0a9e ]
+
+The 'required-opps' property is considered optional, hence remove
+the pr_err() in of_parse_required_opp() when we find the property is
+missing.
+While at it, also fix the return value of
+of_get_required_opp_performance_state() when of_parse_required_opp()
+fails, return a -ENODEV instead of the -EINVAL.
+
+Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 67f2e0710e79..2a97c6535c4c 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -95,15 +95,7 @@ static struct dev_pm_opp *_find_opp_of_np(struct opp_table *opp_table,
+ static struct device_node *of_parse_required_opp(struct device_node *np,
+ int index)
+ {
+- struct device_node *required_np;
+-
+- required_np = of_parse_phandle(np, "required-opps", index);
+- if (unlikely(!required_np)) {
+- pr_err("%s: Unable to parse required-opps: %pOF, index: %d\n",
+- __func__, np, index);
+- }
+-
+- return required_np;
++ return of_parse_phandle(np, "required-opps", index);
+ }
+
+ /* The caller must call dev_pm_opp_put_opp_table() after the table is used */
+@@ -1328,7 +1320,7 @@ int of_get_required_opp_performance_state(struct device_node *np, int index)
+
+ required_np = of_parse_required_opp(np, index);
+ if (!required_np)
+- return -EINVAL;
++ return -ENODEV;
+
+ opp_table = _find_table_of_opp_np(required_np);
+ if (IS_ERR(opp_table)) {
+--
+2.30.2
+
--- /dev/null
+From 092db5774730e7b0bc914eb44b5919c710f58206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 11:07:10 +0100
+Subject: parport: remove non-zero check on count
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 0be883a0d795d9146f5325de582584147dd0dcdc ]
+
+The check for count appears to be incorrect since a non-zero count
+check occurs a couple of statements earlier. Currently the check is
+always false and the dev->port->irq != PARPORT_IRQ_NONE part of the
+check is never tested and the if statement is dead-code. Fix this
+by removing the check on count.
+
+Note that this code is pre-git history, so I can't find a sha for
+it.
+
+Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Addresses-Coverity: ("Logically dead code")
+Link: https://lore.kernel.org/r/20210730100710.27405-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parport/ieee1284_ops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/parport/ieee1284_ops.c b/drivers/parport/ieee1284_ops.c
+index 2c11bd3fe1fd..17061f1df0f4 100644
+--- a/drivers/parport/ieee1284_ops.c
++++ b/drivers/parport/ieee1284_ops.c
+@@ -518,7 +518,7 @@ size_t parport_ieee1284_ecp_read_data (struct parport *port,
+ goto out;
+
+ /* Yield the port for a while. */
+- if (count && dev->port->irq != PARPORT_IRQ_NONE) {
++ if (dev->port->irq != PARPORT_IRQ_NONE) {
+ parport_release (dev);
+ schedule_timeout_interruptible(msecs_to_jiffies(40));
+ parport_claim_or_block (dev);
+--
+2.30.2
+
--- /dev/null
+From 45ce646a2ab715744e11658df8e387bf6a2e2e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 15:25:06 +0200
+Subject: PCI: Use pci_update_current_state() in pci_enable_device_flags()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 14858dcc3b3587f4bb5c48e130ee7d68fc2b0a29 ]
+
+Updating the current_state field of struct pci_dev the way it is done
+in pci_enable_device_flags() before calling do_pci_enable_device() may
+not work. For example, if the given PCI device depends on an ACPI
+power resource whose _STA method initially returns 0 ("off"), but the
+config space of the PCI device is accessible and the power state
+retrieved from the PCI_PM_CTRL register is D0, the current_state
+field in the struct pci_dev representing that device will get out of
+sync with the power.state of its ACPI companion object and that will
+lead to power management issues going forward.
+
+To avoid such issues, make pci_enable_device_flags() call
+pci_update_current_state() which takes ACPI device power management
+into account, if present, to retrieve the current power state of the
+device.
+
+Link: https://lore.kernel.org/lkml/20210314000439.3138941-1-luzmaximilian@gmail.com/
+Reported-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 3f353572588d..a5e6759c407b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1906,11 +1906,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
+ * so that things like MSI message writing will behave as expected
+ * (e.g. if the device really is in D0 at enable time).
+ */
+- if (dev->pm_cap) {
+- u16 pmcsr;
+- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+- }
++ pci_update_current_state(dev, dev->current_state);
+
+ if (atomic_inc_return(&dev->enable_cnt) > 1)
+ return 0; /* already enabled */
+--
+2.30.2
+
--- /dev/null
+From 2205553ce31c718fca8d3d430b379b8d198881ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 13:29:38 +0200
+Subject: pinctrl: armada-37xx: Correct PWM pins definitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit baf8d6899b1e8906dc076ef26cc633e96a8bb0c3 ]
+
+The PWM pins on North Bridge on Armada 37xx can be configured into PWM
+or GPIO functions. When in PWM function, each pin can also be configured
+to drive low on 0 and tri-state on 1 (LED mode).
+
+The current definitions handle this by declaring two pin groups for each
+pin:
+- group "pwmN" with functions "pwm" and "gpio"
+- group "ledN_od" ("od" for open drain) with functions "led" and "gpio"
+
+This is semantically incorrect. The correct definition for each pin
+should be one group with three functions: "pwm", "led" and "gpio".
+
+Change the "pwmN" groups to support "led" function.
+
+Remove "ledN_od" groups. This cannot break backwards compatibility with
+older device trees: no device tree uses it since there is no PWM driver
+for this SOC yet. Also "ledN_od" groups are not even documented.
+
+Fixes: b835d6953009 ("pinctrl: armada-37xx: swap polarity on LED group")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210719112938.27594-1-kabel@kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../pinctrl/marvell,armada-37xx-pinctrl.txt | 8 ++++----
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 16 ++++++++--------
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
+index 38dc56a57760..ecec514b3155 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
+@@ -43,19 +43,19 @@ group emmc_nb
+
+ group pwm0
+ - pin 11 (GPIO1-11)
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm1
+ - pin 12
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm2
+ - pin 13
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm3
+ - pin 14
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pmic1
+ - pin 7
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 5a68e242f6b3..5cb018f98800 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -167,10 +167,14 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ PIN_GRP_GPIO("jtag", 20, 5, BIT(0), "jtag"),
+ PIN_GRP_GPIO("sdio0", 8, 3, BIT(1), "sdio"),
+ PIN_GRP_GPIO("emmc_nb", 27, 9, BIT(2), "emmc"),
+- PIN_GRP_GPIO("pwm0", 11, 1, BIT(3), "pwm"),
+- PIN_GRP_GPIO("pwm1", 12, 1, BIT(4), "pwm"),
+- PIN_GRP_GPIO("pwm2", 13, 1, BIT(5), "pwm"),
+- PIN_GRP_GPIO("pwm3", 14, 1, BIT(6), "pwm"),
++ PIN_GRP_GPIO_3("pwm0", 11, 1, BIT(3) | BIT(20), 0, BIT(20), BIT(3),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm1", 12, 1, BIT(4) | BIT(21), 0, BIT(21), BIT(4),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm2", 13, 1, BIT(5) | BIT(22), 0, BIT(22), BIT(5),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm3", 14, 1, BIT(6) | BIT(23), 0, BIT(23), BIT(6),
++ "pwm", "led"),
+ PIN_GRP_GPIO("pmic1", 7, 1, BIT(7), "pmic"),
+ PIN_GRP_GPIO("pmic0", 6, 1, BIT(8), "pmic"),
+ PIN_GRP_GPIO("i2c2", 2, 2, BIT(9), "i2c"),
+@@ -184,10 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19),
+ BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19),
+ 18, 2, "gpio", "uart"),
+- PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"),
+- PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
+- PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
+- PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
+ };
+
+ static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
+--
+2.30.2
+
--- /dev/null
+From 4d97273db07d461f869deb16c74728600433cb9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 22:29:05 +0300
+Subject: pinctrl: samsung: Fix pinctrl bank pin count
+
+From: Jaehyoung Choi <jkkkkk.choi@samsung.com>
+
+[ Upstream commit 70115558ab02fe8d28a6634350b3491a542aaa02 ]
+
+Commit 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO")
+changes the order of GPIO and pinctrl registration: now pinctrl is
+registered before GPIO. That means gpio_chip->ngpio is not set when
+samsung_pinctrl_register() called, and one cannot rely on that value
+anymore. Use `pin_bank->nr_pins' instead of `pin_bank->gpio_chip.ngpio'
+to fix mentioned inconsistency.
+
+Fixes: 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO")
+Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>
+Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20210730192905.7173-1-semen.protsenko@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
+index 376876bd6605..2975b4369f32 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev,
+ pin_bank->grange.pin_base = drvdata->pin_base
+ + pin_bank->pin_base;
+ pin_bank->grange.base = pin_bank->grange.pin_base;
+- pin_bank->grange.npins = pin_bank->gpio_chip.ngpio;
++ pin_bank->grange.npins = pin_bank->nr_pins;
+ pin_bank->grange.gc = &pin_bank->gpio_chip;
+ pinctrl_add_gpio_range(drvdata->pctl_dev, &pin_bank->grange);
+ }
+--
+2.30.2
+
--- /dev/null
+From 336bd2d33ad3fc146af71ad08333cd1c74f7f164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 11:39:29 +0800
+Subject: pinctrl: single: Fix error return code in
+ pcs_parse_bits_in_pinctrl_entry()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit d789a490d32fdf0465275e3607f8a3bc87d3f3ba ]
+
+Fix to return -ENOTSUPP instead of 0 when PCS_HAS_PINCONF is true, which
+is the same as that returned in pcs_parse_pinconf().
+
+Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210722033930.4034-2-thunder.leizhen@huawei.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index e3aa64798f7d..4fcae8458359 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -1224,6 +1224,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
+
+ if (PCS_HAS_PINCONF) {
+ dev_err(pcs->dev, "pinconf not supported\n");
++ res = -ENOTSUPP;
+ goto free_pingroups;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 298b016eeaf7ae29ce8b367d69484fef6197688f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 16:08:22 +0200
+Subject: platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from
+ run_smbios_call
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 0487d4fc42d7f31a56cfd9e2237f9ebd889e6112 ]
+
+As pointed out be Kees Cook if we return -EIO because the
+obj->type != ACPI_TYPE_BUFFER, then we must kfree the
+output buffer before the return.
+
+Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver")
+Reported-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210826140822.71198-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-smbios-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/dell/dell-smbios-wmi.c b/drivers/platform/x86/dell/dell-smbios-wmi.c
+index 33f823772733..8e761991455a 100644
+--- a/drivers/platform/x86/dell/dell-smbios-wmi.c
++++ b/drivers/platform/x86/dell/dell-smbios-wmi.c
+@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)
+ if (obj->type == ACPI_TYPE_INTEGER)
+ dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",
+ obj->integer.value);
++ kfree(output.pointer);
+ return -EIO;
+ }
+ memcpy(&priv->buf->std, obj->buffer.pointer, obj->buffer.length);
+--
+2.30.2
+
--- /dev/null
+From 7f027408ee3922827f93b5d93090c7c2140c463c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 09:50:52 -0700
+Subject: platform/x86: ISST: Fix optimization with use of numa
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit d36d4a1d75d2a8bd14ec00d5cb0ce166f6886146 ]
+
+When numa is used to map CPU to PCI device, the optimized path to read
+from cached data is not working and still calls _isst_if_get_pci_dev().
+
+The reason is that when caching the mapping, numa information is not
+available as it is read later. So move the assignment of
+isst_cpu_info[cpu].numa_node before calling _isst_if_get_pci_dev().
+
+Fixes: aa2ddd242572 ("platform/x86: ISST: Use numa node id for cpu pci dev mapping")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20210727165052.427238-1-srinivas.pandruvada@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_speed_select_if/isst_if_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
+index 6f0cc679c8e5..8a4d52a9028d 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
+@@ -379,6 +379,8 @@ static int isst_if_cpu_online(unsigned int cpu)
+ u64 data;
+ int ret;
+
++ isst_cpu_info[cpu].numa_node = cpu_to_node(cpu);
++
+ ret = rdmsrl_safe(MSR_CPU_BUS_NUMBER, &data);
+ if (ret) {
+ /* This is not a fatal error on MSR mailbox only I/F */
+@@ -397,7 +399,6 @@ static int isst_if_cpu_online(unsigned int cpu)
+ return ret;
+ }
+ isst_cpu_info[cpu].punit_cpu_id = data;
+- isst_cpu_info[cpu].numa_node = cpu_to_node(cpu);
+
+ isst_restore_msr_local(cpu);
+
+--
+2.30.2
+
--- /dev/null
+From 015c53f4fb8fca424faa60ca945c5e906d8e066d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 14:24:05 +0930
+Subject: powerpc/config: Fix IPV6 warning in mpc855_ads
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit c5ac55b6cbc604ad4144c380feae20f69453df91 ]
+
+When building this config there's a warning:
+
+ 79:warning: override: reassigning to symbol IPV6
+
+Commit 9a1762a4a4ff ("powerpc/8xx: Update mpc885_ads_defconfig to
+improve CI") added CONFIG_IPV6=y, but left '# CONFIG_IPV6 is not set'
+in.
+
+IPV6 is default y, so remove both to clean up the build.
+
+Fixes: 9a1762a4a4ff ("powerpc/8xx: Update mpc885_ads_defconfig to improve CI")
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210817045407.2445664-2-joel@jms.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/configs/mpc885_ads_defconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig
+index d21f266cea9a..5cd17adf903f 100644
+--- a/arch/powerpc/configs/mpc885_ads_defconfig
++++ b/arch/powerpc/configs/mpc885_ads_defconfig
+@@ -21,7 +21,6 @@ CONFIG_INET=y
+ CONFIG_IP_MULTICAST=y
+ CONFIG_IP_PNP=y
+ CONFIG_SYN_COOKIES=y
+-# CONFIG_IPV6 is not set
+ # CONFIG_FW_LOADER is not set
+ CONFIG_MTD=y
+ CONFIG_MTD_BLOCK=y
+@@ -76,7 +75,6 @@ CONFIG_PERF_EVENTS=y
+ CONFIG_MATH_EMULATION=y
+ CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
+ CONFIG_STRICT_KERNEL_RWX=y
+-CONFIG_IPV6=y
+ CONFIG_BPF_JIT=y
+ CONFIG_DEBUG_VM_PGTABLE=y
+ CONFIG_BDI_SWITCH=y
+--
+2.30.2
+
--- /dev/null
+From 026c1c8603fdbdc6ae266fd0cd1866d6002cfd73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 14:24:06 +0930
+Subject: powerpc/config: Renable MTD_PHYSMAP_OF
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit d0e28a6145c3455b69991245e7f6147eb914b34a ]
+
+CONFIG_MTD_PHYSMAP_OF is not longer enabled as it depends on
+MTD_PHYSMAP which is not enabled.
+
+This is a regression from commit 642b1e8dbed7 ("mtd: maps: Merge
+physmap_of.c into physmap-core.c"), which added the extra dependency.
+Add CONFIG_MTD_PHYSMAP=y so this stays in the config, as Christophe said
+it is useful for build coverage.
+
+Fixes: 642b1e8dbed7 ("mtd: maps: Merge physmap_of.c into physmap-core.c")
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210817045407.2445664-3-joel@jms.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/configs/mpc885_ads_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig
+index 5cd17adf903f..cd08f9ed2c8d 100644
+--- a/arch/powerpc/configs/mpc885_ads_defconfig
++++ b/arch/powerpc/configs/mpc885_ads_defconfig
+@@ -33,6 +33,7 @@ CONFIG_MTD_CFI_GEOMETRY=y
+ # CONFIG_MTD_CFI_I2 is not set
+ CONFIG_MTD_CFI_I4=y
+ CONFIG_MTD_CFI_AMDSTD=y
++CONFIG_MTD_PHYSMAP=y
+ CONFIG_MTD_PHYSMAP_OF=y
+ # CONFIG_BLK_DEV is not set
+ CONFIG_NETDEVICES=y
+--
+2.30.2
+
--- /dev/null
+From 8a0acb04bd12a8f324fae8d7c105f1297c5b069d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 09:31:36 +0200
+Subject: powerpc/numa: Consider the max NUMA node for migratable LPAR
+
+From: Laurent Dufour <ldufour@linux.ibm.com>
+
+[ Upstream commit 9c7248bb8de31f51c693bfa6a6ea53b1c07e0fa8 ]
+
+When a LPAR is migratable, we should consider the maximum possible NUMA
+node instead of the number of NUMA nodes from the actual system.
+
+The DT property 'ibm,current-associativity-domains' defines the maximum
+number of nodes the LPAR can see when running on that box. But if the
+LPAR is being migrated on another box, it may see up to the nodes
+defined by 'ibm,max-associativity-domains'. So if a LPAR is migratable,
+that value should be used.
+
+Unfortunately, there is no easy way to know if an LPAR is migratable or
+not. The hypervisor exports the property 'ibm,migratable-partition' in
+the case it set to migrate partition, but that would not mean that the
+current partition is migratable.
+
+Without this patch, when a LPAR is started on a 2 node box and then
+migrated to a 3 node box, the hypervisor may spread the LPAR's CPUs on
+the 3rd node. In that case if a CPU from that 3rd node is added to the
+LPAR, it will be wrongly assigned to the node because the kernel has
+been set to use up to 2 nodes (the configuration of the departure node).
+With this patch applies, the CPU is correctly added to the 3rd node.
+
+Fixes: f9f130ff2ec9 ("powerpc/numa: Detect support for coregroup")
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210511073136.17795-1-ldufour@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/numa.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index f2bf98bdcea2..094a1076fd1f 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -893,7 +893,7 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
+ static void __init find_possible_nodes(void)
+ {
+ struct device_node *rtas;
+- const __be32 *domains;
++ const __be32 *domains = NULL;
+ int prop_length, max_nodes;
+ u32 i;
+
+@@ -909,9 +909,14 @@ static void __init find_possible_nodes(void)
+ * it doesn't exist, then fallback on ibm,max-associativity-domains.
+ * Current denotes what the platform can support compared to max
+ * which denotes what the Hypervisor can support.
++ *
++ * If the LPAR is migratable, new nodes might be activated after a LPM,
++ * so we should consider the max number in that case.
+ */
+- domains = of_get_property(rtas, "ibm,current-associativity-domains",
+- &prop_length);
++ if (!of_get_property(of_root, "ibm,migratable-partition", NULL))
++ domains = of_get_property(rtas,
++ "ibm,current-associativity-domains",
++ &prop_length);
+ if (!domains) {
+ domains = of_get_property(rtas, "ibm,max-associativity-domains",
+ &prop_length);
+@@ -920,6 +925,8 @@ static void __init find_possible_nodes(void)
+ }
+
+ max_nodes = of_read_number(&domains[min_common_depth], 1);
++ pr_info("Partition configured for %d NUMA nodes.\n", max_nodes);
++
+ for (i = 0; i < max_nodes; i++) {
+ if (!node_possible(i))
+ node_set(i, node_possible_map);
+--
+2.30.2
+
--- /dev/null
+From d0ea5241b32253230db91e36ab5921832003a477 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 22:45:56 +0530
+Subject: powerpc/perf: Fix the check for SIAR value
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit 3c69a5f22223fa3e312689ec218b5059784d49d7 ]
+
+Incase of random sampling, there can be scenarios where
+Sample Instruction Address Register(SIAR) may not latch
+to the sampled instruction and could result in
+the value of 0. In these scenarios it is preferred to
+return regs->nip. These corner cases are seen in the
+previous generation (p9) also.
+
+Patch adds the check for SIAR value along with regs_use_siar
+and siar_valid checks so that the function will return
+regs->nip incase SIAR is zero.
+
+Patch drops the code under PPMU_P10_DD1 flag check
+which handles SIAR 0 case only for Power10 DD1.
+
+Fixes: 2ca13a4cc56c9 ("powerpc/perf: Use regs->nip when SIAR is zero")
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210818171556.36912-3-kjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/core-book3s.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index bb0ee716de91..b0a589409039 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2251,18 +2251,10 @@ unsigned long perf_misc_flags(struct pt_regs *regs)
+ */
+ unsigned long perf_instruction_pointer(struct pt_regs *regs)
+ {
+- bool use_siar = regs_use_siar(regs);
+ unsigned long siar = mfspr(SPRN_SIAR);
+
+- if (ppmu && (ppmu->flags & PPMU_P10_DD1)) {
+- if (siar)
+- return siar;
+- else
+- return regs->nip;
+- } else if (use_siar && siar_valid(regs))
+- return mfspr(SPRN_SIAR) + perf_ip_adjust(regs);
+- else if (use_siar)
+- return 0; // no valid instruction pointer
++ if (regs_use_siar(regs) && siar_valid(regs) && siar)
++ return siar + perf_ip_adjust(regs);
+ else
+ return regs->nip;
+ }
+--
+2.30.2
+
--- /dev/null
+From feb70ac0d9a9d6cb2c45c023ed19f1b0dfbecf9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 15:33:59 +0530
+Subject: powerpc/smp: Fix a crash while booting kvm guest with nr_cpus=2
+
+From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+
+[ Upstream commit 8efd249babea2fec268cff90b9f5ca723dbb7499 ]
+
+Aneesh reported a crash with a fairly recent upstream kernel when
+booting kernel whose commandline was appended with nr_cpus=2
+
+1:mon> e
+cpu 0x1: Vector: 300 (Data Access) at [c000000008a67bd0]
+ pc: c00000000002557c: cpu_to_chip_id+0x3c/0x100
+ lr: c000000000058380: start_secondary+0x460/0xb00
+ sp: c000000008a67e70
+ msr: 8000000000001033
+ dar: 10
+ dsisr: 80000
+ current = 0xc00000000891bb00
+ paca = 0xc0000018ff981f80 irqmask: 0x03 irq_happened: 0x01
+ pid = 0, comm = swapper/1
+Linux version 5.13.0-rc3-15704-ga050a6d2b7e8 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #433 SMP Tue May 25 02:38:49 CDT 2021
+1:mon> t
+[link register ] c000000000058380 start_secondary+0x460/0xb00
+[c000000008a67e70] c000000008a67eb0 (unreliable)
+[c000000008a67eb0] c0000000000589d4 start_secondary+0xab4/0xb00
+[c000000008a67f90] c00000000000c654 start_secondary_prolog+0x10/0x14
+
+Current code assumes that num_possible_cpus() is always greater than
+threads_per_core. However this may not be true when using nr_cpus=2 or
+similar options. Handle the case where num_possible_cpus() is not an
+exact multiple of threads_per_core.
+
+Fixes: c1e53367dab1 ("powerpc/smp: Cache CPU to chip lookup")
+Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Debugged-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210826100401.412519-2-srikar@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 447b78a87c8f..2e151228d7ad 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1085,7 +1085,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ }
+
+ if (cpu_to_chip_id(boot_cpuid) != -1) {
+- int idx = num_possible_cpus() / threads_per_core;
++ int idx = DIV_ROUND_UP(num_possible_cpus(), threads_per_core);
+
+ /*
+ * All threads of a core will all belong to the same core,
+--
+2.30.2
+
--- /dev/null
+From 06f256f71292097e0c87fa82b800347c96439452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 15:34:00 +0530
+Subject: powerpc/smp: Update cpu_core_map on all PowerPc systems
+
+From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+
+[ Upstream commit b8b928030332a0ca16d42433eb2c3085600d8704 ]
+
+lscpu() uses core_siblings to list the number of sockets in the
+system. core_siblings is set using topology_core_cpumask.
+
+While optimizing the powerpc bootup path, Commit 4ca234a9cbd7
+("powerpc/smp: Stop updating cpu_core_mask"). it was found that
+updating cpu_core_mask() ended up taking a lot of time. It was thought
+that on Powerpc, cpu_core_mask() would always be same as
+cpu_cpu_mask() i.e number of sockets will always be equal to number of
+nodes. As an optimization, cpu_core_mask() was made a snapshot of
+cpu_cpu_mask().
+
+However that was found to be false with PowerPc KVM guests, where each
+node could have more than one socket. So with Commit c47f892d7aa6
+("powerpc/smp: Reintroduce cpu_core_mask"), cpu_core_mask was updated
+based on chip_id but in an optimized way using some mask manipulations
+and chip_id caching.
+
+However on non-PowerNV and non-pseries KVM guests (i.e not
+implementing cpu_to_chip_id(), continued to use a copy of
+cpu_cpu_mask().
+
+There are two issues that were noticed on such systems
+1. lscpu would report one extra socket.
+On a IBM,9009-42A (aka zz system) which has only 2 chips/ sockets/
+nodes, lscpu would report
+Architecture: ppc64le
+Byte Order: Little Endian
+CPU(s): 160
+On-line CPU(s) list: 0-159
+Thread(s) per core: 8
+Core(s) per socket: 6
+Socket(s): 3 <--------------
+NUMA node(s): 2
+Model: 2.2 (pvr 004e 0202)
+Model name: POWER9 (architected), altivec supported
+Hypervisor vendor: pHyp
+Virtualization type: para
+L1d cache: 32K
+L1i cache: 32K
+L2 cache: 512K
+L3 cache: 10240K
+NUMA node0 CPU(s): 0-79
+NUMA node1 CPU(s): 80-159
+
+2. Currently cpu_cpu_mask is updated when a core is
+added/removed. However its not updated when smt mode switching or on
+CPUs are explicitly offlined. However all other percpu masks are
+updated to ensure only active/online CPUs are in the masks.
+This results in build_sched_domain traces since there will be CPUs in
+cpu_cpu_mask() but those CPUs are not present in SMT / CACHE / MC /
+NUMA domains. A loop of threads running smt mode switching and core
+add/remove will soon show this trace.
+Hence cpu_cpu_mask has to be update at smt mode switch.
+
+This will have impact on cpu_core_mask(). cpu_core_mask() is a
+snapshot of cpu_cpu_mask. Different CPUs within the same socket will
+end up having different cpu_core_masks since they are snapshots at
+different points of time. This means when lscpu will start reporting
+many more sockets than the actual number of sockets/ nodes / chips.
+
+Different ways to handle this problem:
+A. Update the snapshot aka cpu_core_mask for all CPUs whenever
+ cpu_cpu_mask is updated. This would a non-optimal solution.
+B. Instead of a cpumask_var_t, make cpu_core_map a cpumask pointer
+ pointing to cpu_cpu_mask. However percpu cpumask pointer is frowned
+ upon and we need a clean way to handle PowerPc KVM guest which is
+ not a snapshot.
+C. Update cpu_core_masks all PowerPc systems like in PowerPc KVM
+guests using mask manipulations. This approach is relatively simple
+and unifies with the existing code.
+D. On top of 3, we could also resurrect get_physical_package_id which
+ could return a nid for the said CPU. However this is not needed at this
+ time.
+
+Option C is the preferred approach for now.
+
+While this is somewhat a revert of Commit 4ca234a9cbd7 ("powerpc/smp:
+Stop updating cpu_core_mask").
+
+1. Plain revert has some conflicts
+2. For chip_id == -1, the cpu_core_mask is made identical to
+cpu_cpu_mask, unlike previously where cpu_core_mask was set to a core
+if chip_id doesn't exist.
+
+This goes by the principle that if chip_id is not exposed, then
+sockets / chip / node share the same set of CPUs.
+
+With the fix, lscpu o/p would be
+Architecture: ppc64le
+Byte Order: Little Endian
+CPU(s): 160
+On-line CPU(s) list: 0-159
+Thread(s) per core: 8
+Core(s) per socket: 6
+Socket(s): 2 <--------------
+NUMA node(s): 2
+Model: 2.2 (pvr 004e 0202)
+Model name: POWER9 (architected), altivec supported
+Hypervisor vendor: pHyp
+Virtualization type: para
+L1d cache: 32K
+L1i cache: 32K
+L2 cache: 512K
+L3 cache: 10240K
+NUMA node0 CPU(s): 0-79
+NUMA node1 CPU(s): 80-159
+
+Fixes: 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask")
+Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210826100401.412519-3-srikar@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 2e151228d7ad..12c75b95646a 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1503,6 +1503,7 @@ static void add_cpu_to_masks(int cpu)
+ * add it to it's own thread sibling mask.
+ */
+ cpumask_set_cpu(cpu, cpu_sibling_mask(cpu));
++ cpumask_set_cpu(cpu, cpu_core_mask(cpu));
+
+ for (i = first_thread; i < first_thread + threads_per_core; i++)
+ if (cpu_online(i))
+@@ -1520,11 +1521,6 @@ static void add_cpu_to_masks(int cpu)
+ if (chip_id_lookup_table && ret)
+ chip_id = cpu_to_chip_id(cpu);
+
+- if (chip_id == -1) {
+- cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu));
+- goto out;
+- }
+-
+ if (shared_caches)
+ submask_fn = cpu_l2_cache_mask;
+
+@@ -1534,6 +1530,10 @@ static void add_cpu_to_masks(int cpu)
+ /* Skip all CPUs already part of current CPU core mask */
+ cpumask_andnot(mask, cpu_online_mask, cpu_core_mask(cpu));
+
++ /* If chip_id is -1; limit the cpu_core_mask to within DIE*/
++ if (chip_id == -1)
++ cpumask_and(mask, mask, cpu_cpu_mask(cpu));
++
+ for_each_cpu(i, mask) {
+ if (chip_id == cpu_to_chip_id(i)) {
+ or_cpumasks_related(cpu, i, submask_fn, cpu_core_mask);
+@@ -1543,7 +1543,6 @@ static void add_cpu_to_masks(int cpu)
+ }
+ }
+
+-out:
+ free_cpumask_var(mask);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From ba38e938d1422e98d61458ace64cb2a5f1f579cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 20:01:03 +0200
+Subject: powerpc/stacktrace: Include linux/delay.h
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit a6cae77f1bc89368a4e2822afcddc45c3062d499 ]
+
+commit 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()")
+introduces udelay() call without including the linux/delay.h header.
+This may happen to work on master but the header that declares the
+functionshould be included nonetheless.
+
+Fixes: 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()")
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210729180103.15578-1-msuchanek@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/stacktrace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c
+index 2b0d04a1b7d2..9e4a4a7af380 100644
+--- a/arch/powerpc/kernel/stacktrace.c
++++ b/arch/powerpc/kernel/stacktrace.c
+@@ -8,6 +8,7 @@
+ * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp.
+ */
+
++#include <linux/delay.h>
+ #include <linux/export.h>
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+--
+2.30.2
+
--- /dev/null
+From cd267ceb6b59d0dfc000d141659dac310c914327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 08:56:45 +0800
+Subject: rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit fed31a4dd3adb5455df7c704de2abb639a1dc1c0 ]
+
+This commit fixes several typos where CONFIG_TASKS_RCU_TRACE should
+instead be CONFIG_TASKS_TRACE_RCU. Among other things, these typos
+could cause CONFIG_TASKS_TRACE_RCU_READ_MB=y kernels to suffer from
+memory-ordering bugs that could result in false-positive quiescent
+states and too-short grace periods.
+
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 2 +-
+ kernel/rcu/tree_plugin.h | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index d9680b798b21..955c82b4737c 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -167,7 +167,7 @@ void synchronize_rcu_tasks(void);
+ # define synchronize_rcu_tasks synchronize_rcu
+ # endif
+
+-# ifdef CONFIG_TASKS_RCU_TRACE
++# ifdef CONFIG_TASKS_TRACE_RCU
+ # define rcu_tasks_trace_qs(t) \
+ do { \
+ if (!likely(READ_ONCE((t)->trc_reader_checked)) && \
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index de1dc3bb7f70..6ce104242b23 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -2982,17 +2982,17 @@ static void noinstr rcu_dynticks_task_exit(void)
+ /* Turn on heavyweight RCU tasks trace readers on idle/user entry. */
+ static void rcu_dynticks_task_trace_enter(void)
+ {
+-#ifdef CONFIG_TASKS_RCU_TRACE
++#ifdef CONFIG_TASKS_TRACE_RCU
+ if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))
+ current->trc_reader_special.b.need_mb = true;
+-#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */
++#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
+ }
+
+ /* Turn off heavyweight RCU tasks trace readers on idle/user exit. */
+ static void rcu_dynticks_task_trace_exit(void)
+ {
+-#ifdef CONFIG_TASKS_RCU_TRACE
++#ifdef CONFIG_TASKS_TRACE_RCU
+ if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))
+ current->trc_reader_special.b.need_mb = false;
+-#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */
++#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
+ }
+--
+2.30.2
+
--- /dev/null
+From 219d7b74ae13db49ac22f6a6993db997631209f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 14:39:45 +0300
+Subject: RDMA/efa: Remove double QP type assignment
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit f9193d266347fe9bed5c173e7a1bf96268142a79 ]
+
+The QP type is set by the IB/core and shouldn't be set in the driver.
+
+Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
+Link: https://lore.kernel.org/r/838c40134c1590167b888ca06ad51071139ff2ae.1627040189.git.leonro@nvidia.com
+Acked-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/efa/efa_verbs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
+index be6d3ff0f1be..29c9df9f25aa 100644
+--- a/drivers/infiniband/hw/efa/efa_verbs.c
++++ b/drivers/infiniband/hw/efa/efa_verbs.c
+@@ -717,7 +717,6 @@ struct ib_qp *efa_create_qp(struct ib_pd *ibpd,
+
+ qp->qp_handle = create_qp_resp.qp_handle;
+ qp->ibqp.qp_num = create_qp_resp.qp_num;
+- qp->ibqp.qp_type = init_attr->qp_type;
+ qp->max_send_wr = init_attr->cap.max_send_wr;
+ qp->max_recv_wr = init_attr->cap.max_recv_wr;
+ qp->max_send_sge = init_attr->cap.max_send_sge;
+--
+2.30.2
+
--- /dev/null
+From f30e43dceabcd73940b4df2b2d7c33a97a144c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:43:10 +0800
+Subject: RDMA/hns: Bugfix for data type of dip_idx
+
+From: Junxian Huang <huangjunxian4@hisilicon.com>
+
+[ Upstream commit 4303e61264c45cb535255c5b76400f5c4ab1305d ]
+
+dip_idx is associated with qp_num whose data type is u32. However, dip_idx
+is incorrectly defined as u8 data in the hns_roce_dip struct, which leads
+to data truncation during value assignment.
+
+Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW")
+Link: https://lore.kernel.org/r/1629884592-23424-2-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Junxian Huang <huangjunxian4@hisilicon.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index b8a09d411e2e..68c8c4b225ca 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -1447,7 +1447,7 @@ struct hns_roce_v2_priv {
+
+ struct hns_roce_dip {
+ u8 dgid[GID_LEN_V2];
+- u8 dip_idx;
++ u32 dip_idx;
+ struct list_head node; /* all dips are on a list */
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 48b52461eb63266e01059f49331d967e35d5b61a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:43:12 +0800
+Subject: RDMA/hns: Bugfix for incorrect association between dip_idx and dgid
+
+From: Junxian Huang <huangjunxian4@hisilicon.com>
+
+[ Upstream commit eb653eda1e91dd3e7d1d2448d528d033dbfbe78f ]
+
+dip_idx and dgid should be a one-to-one mapping relationship, but when
+qp_num loops back to the start number, it may happen that two different
+dgid are assiociated to the same dip_idx incorrectly.
+
+One solution is to store the qp_num that is not assigned to dip_idx in an
+array. When a dip_idx needs to be allocated to a new dgid, an spare qp_num
+is extracted and assigned to dip_idx.
+
+Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW")
+Link: https://lore.kernel.org/r/1629884592-23424-4-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Junxian Huang <huangjunxian4@hisilicon.com>
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 9 ++++++++-
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 ++++++++-
+ drivers/infiniband/hw/hns/hns_roce_main.c | 8 ++++++--
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 10 +++++++++-
+ 4 files changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 991f65269fa6..8518b1571f2c 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -496,6 +496,12 @@ struct hns_roce_bank {
+ u32 next; /* Next ID to allocate. */
+ };
+
++struct hns_roce_idx_table {
++ u32 *spare_idx;
++ u32 head;
++ u32 tail;
++};
++
+ struct hns_roce_qp_table {
+ struct hns_roce_hem_table qp_table;
+ struct hns_roce_hem_table irrl_table;
+@@ -504,6 +510,7 @@ struct hns_roce_qp_table {
+ struct mutex scc_mutex;
+ struct hns_roce_bank bank[HNS_ROCE_QP_BANK_NUM];
+ struct mutex bank_mutex;
++ struct hns_roce_idx_table idx_table;
+ };
+
+ struct hns_roce_cq_table {
+@@ -1146,7 +1153,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+ void hns_roce_init_pd_table(struct hns_roce_dev *hr_dev);
+ void hns_roce_init_mr_table(struct hns_roce_dev *hr_dev);
+ void hns_roce_init_cq_table(struct hns_roce_dev *hr_dev);
+-void hns_roce_init_qp_table(struct hns_roce_dev *hr_dev);
++int hns_roce_init_qp_table(struct hns_roce_dev *hr_dev);
+ int hns_roce_init_srq_table(struct hns_roce_dev *hr_dev);
+ void hns_roce_init_xrcd_table(struct hns_roce_dev *hr_dev);
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index d9e330a383b2..21c82f5aff04 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4507,12 +4507,18 @@ static int get_dip_ctx_idx(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
+ {
+ const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr);
+ struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
++ u32 *spare_idx = hr_dev->qp_table.idx_table.spare_idx;
++ u32 *head = &hr_dev->qp_table.idx_table.head;
++ u32 *tail = &hr_dev->qp_table.idx_table.tail;
+ struct hns_roce_dip *hr_dip;
+ unsigned long flags;
+ int ret = 0;
+
+ spin_lock_irqsave(&hr_dev->dip_list_lock, flags);
+
++ spare_idx[*tail] = ibqp->qp_num;
++ *tail = (*tail == hr_dev->caps.num_qps - 1) ? 0 : (*tail + 1);
++
+ list_for_each_entry(hr_dip, &hr_dev->dip_list, node) {
+ if (!memcmp(grh->dgid.raw, hr_dip->dgid, 16)) {
+ *dip_idx = hr_dip->dip_idx;
+@@ -4530,7 +4536,8 @@ static int get_dip_ctx_idx(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
+ }
+
+ memcpy(hr_dip->dgid, grh->dgid.raw, sizeof(grh->dgid.raw));
+- hr_dip->dip_idx = *dip_idx = ibqp->qp_num;
++ hr_dip->dip_idx = *dip_idx = spare_idx[*head];
++ *head = (*head == hr_dev->caps.num_qps - 1) ? 0 : (*head + 1);
+ list_add_tail(&hr_dip->node, &hr_dev->dip_list);
+
+ out:
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index cc6eab14a222..217aad8d9bd9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -748,6 +748,12 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
+ goto err_uar_table_free;
+ }
+
++ ret = hns_roce_init_qp_table(hr_dev);
++ if (ret) {
++ dev_err(dev, "Failed to init qp_table.\n");
++ goto err_uar_table_free;
++ }
++
+ hns_roce_init_pd_table(hr_dev);
+
+ if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC)
+@@ -757,8 +763,6 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
+
+ hns_roce_init_cq_table(hr_dev);
+
+- hns_roce_init_qp_table(hr_dev);
+-
+ if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) {
+ ret = hns_roce_init_srq_table(hr_dev);
+ if (ret) {
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index c3e2fee16c0e..8f437806e07f 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1423,12 +1423,17 @@ bool hns_roce_wq_overflow(struct hns_roce_wq *hr_wq, u32 nreq,
+ return cur + nreq >= hr_wq->wqe_cnt;
+ }
+
+-void hns_roce_init_qp_table(struct hns_roce_dev *hr_dev)
++int hns_roce_init_qp_table(struct hns_roce_dev *hr_dev)
+ {
+ struct hns_roce_qp_table *qp_table = &hr_dev->qp_table;
+ unsigned int reserved_from_bot;
+ unsigned int i;
+
++ qp_table->idx_table.spare_idx = kcalloc(hr_dev->caps.num_qps,
++ sizeof(u32), GFP_KERNEL);
++ if (!qp_table->idx_table.spare_idx)
++ return -ENOMEM;
++
+ mutex_init(&qp_table->scc_mutex);
+ mutex_init(&qp_table->bank_mutex);
+ xa_init(&hr_dev->qp_table_xa);
+@@ -1446,6 +1451,8 @@ void hns_roce_init_qp_table(struct hns_roce_dev *hr_dev)
+ HNS_ROCE_QP_BANK_NUM - 1;
+ hr_dev->qp_table.bank[i].next = hr_dev->qp_table.bank[i].min;
+ }
++
++ return 0;
+ }
+
+ void hns_roce_cleanup_qp_table(struct hns_roce_dev *hr_dev)
+@@ -1454,4 +1461,5 @@ void hns_roce_cleanup_qp_table(struct hns_roce_dev *hr_dev)
+
+ for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++)
+ ida_destroy(&hr_dev->qp_table.bank[i].ida);
++ kfree(hr_dev->qp_table.idx_table.spare_idx);
+ }
+--
+2.30.2
+
--- /dev/null
+From 42c3cd3d0d924ed59dfe391725edbb6e9abf885c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:43:11 +0800
+Subject: RDMA/hns: Bugfix for the missing assignment for dip_idx
+
+From: Junxian Huang <huangjunxian4@hisilicon.com>
+
+[ Upstream commit 074f315fc54a9ce45559a44ca36d9fa1ee1ea2cd ]
+
+When the dgid-dip_idx mapping relationship exists, dip should be assigned.
+
+Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW")
+Link: https://lore.kernel.org/r/1629884592-23424-3-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Junxian Huang <huangjunxian4@hisilicon.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index f4cea6dcec2f..d9e330a383b2 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4514,8 +4514,10 @@ static int get_dip_ctx_idx(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
+ spin_lock_irqsave(&hr_dev->dip_list_lock, flags);
+
+ list_for_each_entry(hr_dip, &hr_dev->dip_list, node) {
+- if (!memcmp(grh->dgid.raw, hr_dip->dgid, 16))
++ if (!memcmp(grh->dgid.raw, hr_dip->dgid, 16)) {
++ *dip_idx = hr_dip->dip_idx;
+ goto out;
++ }
+ }
+
+ /* If no dgid is found, a new dip and a mapping between dgid and
+--
+2.30.2
+
--- /dev/null
+From dae2ad224269d76c39e34ed41b9c6bffbe90f883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 14:39:44 +0300
+Subject: RDMA/hns: Don't overwrite supplied QP attributes
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit e66e49592b690d6abd537cc207b07a3db2f413d0 ]
+
+QP attributes that were supplied by IB/core already have all parameters
+set when they are passed to the driver. The drivers are not supposed to
+change anything in struct ib_qp_init_attr.
+
+Fixes: 66d86e529dd5 ("RDMA/hns: Add UD support for HIP09")
+Link: https://lore.kernel.org/r/5987138875e8ade9aa339d4db6e1bd9694ed4591.1627040189.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index b101b7e578f2..c3e2fee16c0e 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1171,14 +1171,8 @@ struct ib_qp *hns_roce_create_qp(struct ib_pd *pd,
+ if (!hr_qp)
+ return ERR_PTR(-ENOMEM);
+
+- if (init_attr->qp_type == IB_QPT_XRC_INI)
+- init_attr->recv_cq = NULL;
+-
+- if (init_attr->qp_type == IB_QPT_XRC_TGT) {
++ if (init_attr->qp_type == IB_QPT_XRC_TGT)
+ hr_qp->xrcdn = to_hr_xrcd(init_attr->xrcd)->xrcdn;
+- init_attr->recv_cq = NULL;
+- init_attr->send_cq = NULL;
+- }
+
+ if (init_attr->qp_type == IB_QPT_GSI) {
+ hr_qp->port = init_attr->port_num - 1;
+--
+2.30.2
+
--- /dev/null
+From eadd17599b09091a3d56dcede3348ac4ab448ad3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:19:29 +0800
+Subject: RDMA/hns: Fix incorrect lsn field
+
+From: Yixing Liu <liuyixing1@huawei.com>
+
+[ Upstream commit 9bed8a70716ba65d300b9cc30eb7e0276353f7bf ]
+
+In RNR NAK screnario, according to the specification, when no credit is
+available, only the first fragment of the send request can be sent. The
+LSN(Limit Sequence Number) field should be 0 or the entire packet will be
+resent.
+
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Link: https://lore.kernel.org/r/1629883169-2306-1-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Yixing Liu <liuyixing1@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 0e0be5664137..f4cea6dcec2f 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4489,9 +4489,6 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
+
+ hr_reg_clear(qpc_mask, QPC_CHECK_FLG);
+
+- hr_reg_write(context, QPC_LSN, 0x100);
+- hr_reg_clear(qpc_mask, QPC_LSN);
+-
+ hr_reg_clear(qpc_mask, QPC_V2_IRRL_HEAD);
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 18d2b9db5a5a8e3ccb10eb713cee9090a53698a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 21:37:31 +0800
+Subject: RDMA/hns: Fix QP's resp incomplete assignment
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit d2e0ccffcdd7209fc9881c8970d2a7e28dcb43b9 ]
+
+The resp passed to the user space represents the enable flag of qp,
+incomplete assignment will cause some features of the user space to be
+disabled.
+
+Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp")
+Fixes: aba457ca890c ("RDMA/hns: Support owner mode doorbell")
+Link: https://lore.kernel.org/r/1629985056-57004-3-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 8f437806e07f..a6d1e44b75cf 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -848,7 +848,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
+ goto err_out;
+ }
+ hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
+- resp->cap_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
+ }
+
+ if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) {
+@@ -861,7 +860,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
+ goto err_sdb;
+ }
+ hr_qp->en_flags |= HNS_ROCE_QP_CAP_RQ_RECORD_DB;
+- resp->cap_flags |= HNS_ROCE_QP_CAP_RQ_RECORD_DB;
+ }
+ } else {
+ if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09)
+@@ -1073,6 +1071,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
+ }
+
+ if (udata) {
++ resp.cap_flags = hr_qp->en_flags;
+ ret = ib_copy_to_udata(udata, &resp,
+ min(udata->outlen, sizeof(resp)));
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From af6be2180c15a1aa26c99cf94ac4c4e65b7f66f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 21:37:30 +0800
+Subject: RDMA/hns: Fix query destination qpn
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit e788a3cd5787aca74e0ee00202d4dca64b43f043 ]
+
+The bit width of dqpn is 24 bits, using u8 will cause truncation error.
+
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Link: https://lore.kernel.org/r/1629985056-57004-2-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 21c82f5aff04..bf4d9f6658ff 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5136,7 +5136,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+
+ qp_attr->rq_psn = hr_reg_read(&context, QPC_RX_REQ_EPSN);
+ qp_attr->sq_psn = (u32)hr_reg_read(&context, QPC_SQ_CUR_PSN);
+- qp_attr->dest_qp_num = (u8)hr_reg_read(&context, QPC_DQPN);
++ qp_attr->dest_qp_num = hr_reg_read(&context, QPC_DQPN);
+ qp_attr->qp_access_flags =
+ ((hr_reg_read(&context, QPC_RRE)) << V2_QP_RRE_S) |
+ ((hr_reg_read(&context, QPC_RWE)) << V2_QP_RWE_S) |
+--
+2.30.2
+
--- /dev/null
+From 73eb90c3231a9927374acf1e5393446d7935b66e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 20:59:39 +0800
+Subject: RDMA/hns: Fix return in hns_roce_rereg_user_mr()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c4c7d7a43246a42b0355692c3ed53dff7cbb29bb ]
+
+If re-registering an MR in hns_roce_rereg_user_mr(), we should return NULL
+instead of passing 0 to ERR_PTR for clarity.
+
+Fixes: 4e9fc1dae2a9 ("RDMA/hns: Optimize the MR registration process")
+Link: https://lore.kernel.org/r/20210804125939.20516-1-yuehaibing@huawei.com
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 006c84bb3f9f..7089ac780291 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -352,7 +352,9 @@ struct ib_mr *hns_roce_rereg_user_mr(struct ib_mr *ibmr, int flags, u64 start,
+ free_cmd_mbox:
+ hns_roce_free_cmd_mailbox(hr_dev, mailbox);
+
+- return ERR_PTR(ret);
++ if (ret)
++ return ERR_PTR(ret);
++ return NULL;
+ }
+
+ int hns_roce_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
+--
+2.30.2
+
--- /dev/null
+From 629be427e1ac83324a7973f0d2ce1652f932f92b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 17:53:27 +0800
+Subject: RDMA/hns: Ownerbit mode add control field
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit f8c549afd1e76ad78b1d044a307783c9b94ae3ab ]
+
+The ownerbit mode is for external card mode. Make it controlled by the
+firmware.
+
+Fixes: aba457ca890c ("RDMA/hns: Support owner mode doorbell")
+Link: https://lore.kernel.org/r/1629539607-33217-4-git-send-email-liangwenpeng@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 594d4cef31b3..0e0be5664137 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4114,6 +4114,9 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp,
+ if (hr_qp->en_flags & HNS_ROCE_QP_CAP_RQ_RECORD_DB)
+ hr_reg_enable(context, QPC_RQ_RECORD_EN);
+
++ if (hr_qp->en_flags & HNS_ROCE_QP_CAP_OWNER_DB)
++ hr_reg_enable(context, QPC_OWNER_MODE);
++
+ hr_reg_write(context, QPC_RQ_DB_RECORD_ADDR_L,
+ lower_32_bits(hr_qp->rdb.dma) >> 1);
+ hr_reg_write(context, QPC_RQ_DB_RECORD_ADDR_H,
+--
+2.30.2
+
--- /dev/null
+From 1e1a495479b103a5a556cf6acde1f548731db016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 17:08:55 +0300
+Subject: RDMA/iwcm: Release resources if iw_cm module initialization fails
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit e677b72a0647249370f2635862bf0241c86f66ad ]
+
+The failure during iw_cm module initialization partially left the system
+with unreleased memory and other resources. Rewrite the module init/exit
+routines in such way that netlink commands will be opened only after
+successful initialization.
+
+Fixes: b493d91d333e ("iwcm: common code for port mapper")
+Link: https://lore.kernel.org/r/b01239f99cb1a3e6d2b0694c242d89e6410bcd93.1627048781.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/iwcm.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index 42261152b489..2b47073c61a6 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -1186,29 +1186,34 @@ static int __init iw_cm_init(void)
+
+ ret = iwpm_init(RDMA_NL_IWCM);
+ if (ret)
+- pr_err("iw_cm: couldn't init iwpm\n");
+- else
+- rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
++ return ret;
++
+ iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
+ if (!iwcm_wq)
+- return -ENOMEM;
++ goto err_alloc;
+
+ iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm",
+ iwcm_ctl_table);
+ if (!iwcm_ctl_table_hdr) {
+ pr_err("iw_cm: couldn't register sysctl paths\n");
+- destroy_workqueue(iwcm_wq);
+- return -ENOMEM;
++ goto err_sysctl;
+ }
+
++ rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
+ return 0;
++
++err_sysctl:
++ destroy_workqueue(iwcm_wq);
++err_alloc:
++ iwpm_exit(RDMA_NL_IWCM);
++ return -ENOMEM;
+ }
+
+ static void __exit iw_cm_cleanup(void)
+ {
++ rdma_nl_unregister(RDMA_NL_IWCM);
+ unregister_net_sysctl_table(iwcm_ctl_table_hdr);
+ destroy_workqueue(iwcm_wq);
+- rdma_nl_unregister(RDMA_NL_IWCM);
+ iwpm_exit(RDMA_NL_IWCM);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From b68751e90ab462ffc482e612e12420eabb5d8504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 21:20:32 +0300
+Subject: RDMA/mlx5: Delete not-available udata check
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 5f6bb7e32283b8e3339b7adc00638234ac199cc4 ]
+
+XRC_TGT QPs are created through kernel verbs and don't have udata at all.
+
+Fixes: 6eefa839c4dd ("RDMA/mlx5: Protect from kernel crash if XRC_TGT doesn't have udata")
+Fixes: e383085c2425 ("RDMA/mlx5: Set ECE options during QP create")
+Link: https://lore.kernel.org/r/b68228597e730675020aa5162745390a2d39d3a2.1628014762.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index a77db29f8391..fd88b9ae96fe 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -1906,7 +1906,6 @@ static int get_atomic_mode(struct mlx5_ib_dev *dev,
+ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ struct mlx5_create_qp_params *params)
+ {
+- struct mlx5_ib_create_qp *ucmd = params->ucmd;
+ struct ib_qp_init_attr *attr = params->attr;
+ u32 uidx = params->uidx;
+ struct mlx5_ib_resources *devr = &dev->devr;
+@@ -1926,8 +1925,6 @@ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ if (!in)
+ return -ENOMEM;
+
+- if (MLX5_CAP_GEN(mdev, ece_support) && ucmd)
+- MLX5_SET(create_qp_in, in, ece, ucmd->ece_options);
+ qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
+
+ MLX5_SET(qpc, qpc, st, MLX5_QP_ST_XRC);
+--
+2.30.2
+
--- /dev/null
+From 5b4976982670854355ae417a4366f20030824c8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 08:07:47 +0200
+Subject: RDMA/rtrs: Enable the same selective signal for heartbeat and IO
+
+From: Jack Wang <jinpu.wang@ionos.com>
+
+[ Upstream commit e2d98504c697f9c8e45b815062f8893b10808d8e ]
+
+On idle session, because we do not do signal for heartbeat, it will
+overflow the send queue after sometime.
+
+To avoid that, we need to enable the signal for heartbeat. To do that, add
+a new member signal_interval in rtrs_path, which will set min of
+queue_depth and SERVICE_CON_QUEUE_DEPTH, and track it for both heartbeat
+and IO, so the sq queue full accounting is correct.
+
+Fixes: b38041d50add ("RDMA/rtrs: Do not signal for heatbeat")
+Link: https://lore.kernel.org/r/20210712060750.16494-4-jinpu.wang@ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Aleksei Marov <aleksei.marov@ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 +++++--
+ drivers/infiniband/ulp/rtrs/rtrs-pri.h | 1 +
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 11 ++++++-----
+ drivers/infiniband/ulp/rtrs/rtrs.c | 7 ++++++-
+ 4 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 5cb00ea08919..f023676e05e4 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -478,7 +478,7 @@ static int rtrs_post_send_rdma(struct rtrs_clt_con *con,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = atomic_inc_return(&con->c.wr_cnt) % sess->queue_depth ?
++ flags = atomic_inc_return(&con->c.wr_cnt) % sess->s.signal_interval ?
+ 0 : IB_SEND_SIGNALED;
+
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev, req->iu->dma_addr,
+@@ -680,6 +680,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ case IB_WC_RDMA_WRITE:
+ /*
+ * post_send() RDMA write completions of IO reqs (read/write)
++ * and hb.
+ */
+ break;
+
+@@ -1043,7 +1044,7 @@ static int rtrs_post_rdma_write_sg(struct rtrs_clt_con *con,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = atomic_inc_return(&con->c.wr_cnt) % sess->queue_depth ?
++ flags = atomic_inc_return(&con->c.wr_cnt) % sess->s.signal_interval ?
+ 0 : IB_SEND_SIGNALED;
+
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev, req->iu->dma_addr,
+@@ -1849,6 +1850,8 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con,
+ return -ENOMEM;
+ }
+ sess->queue_depth = queue_depth;
++ sess->s.signal_interval = min_not_zero(queue_depth,
++ (unsigned short) SERVICE_CON_QUEUE_DEPTH);
+ sess->max_hdr_size = le32_to_cpu(msg->max_hdr_size);
+ sess->max_io_size = le32_to_cpu(msg->max_io_size);
+ sess->flags = le32_to_cpu(msg->flags);
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+index a44a4fb1b515..b88a4944cb30 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+@@ -109,6 +109,7 @@ struct rtrs_sess {
+ unsigned int con_num;
+ unsigned int irq_con_num;
+ unsigned int recon_cnt;
++ unsigned int signal_interval;
+ struct rtrs_ib_dev *dev;
+ int dev_ref;
+ struct ib_cqe *hb_cqe;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 31b846ca0c5e..44ed15f38896 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -201,7 +201,6 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ struct rtrs_srv_sess *sess = to_srv_sess(s);
+ dma_addr_t dma_addr = sess->dma_addr[id->msg_id];
+ struct rtrs_srv_mr *srv_mr;
+- struct rtrs_srv *srv = sess->srv;
+ struct ib_send_wr inv_wr;
+ struct ib_rdma_wr imm_wr;
+ struct ib_rdma_wr *wr = NULL;
+@@ -269,7 +268,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ * From time to time we have to post signaled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = (atomic_inc_return(&id->con->c.wr_cnt) % srv->queue_depth) ?
++ flags = (atomic_inc_return(&id->con->c.wr_cnt) % s->signal_interval) ?
+ 0 : IB_SEND_SIGNALED;
+
+ if (need_inval) {
+@@ -347,7 +346,6 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ struct ib_send_wr inv_wr, *wr = NULL;
+ struct ib_rdma_wr imm_wr;
+ struct ib_reg_wr rwr;
+- struct rtrs_srv *srv = sess->srv;
+ struct rtrs_srv_mr *srv_mr;
+ bool need_inval = false;
+ enum ib_send_flags flags;
+@@ -396,7 +394,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = (atomic_inc_return(&con->c.wr_cnt) % srv->queue_depth) ?
++ flags = (atomic_inc_return(&con->c.wr_cnt) % s->signal_interval) ?
+ 0 : IB_SEND_SIGNALED;
+ imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval);
+ imm_wr.wr.next = NULL;
+@@ -1268,8 +1266,9 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ case IB_WC_SEND:
+ /*
+ * post_send() RDMA write completions of IO reqs (read/write)
++ * and hb.
+ */
+- atomic_add(srv->queue_depth, &con->sq_wr_avail);
++ atomic_add(s->signal_interval, &con->sq_wr_avail);
+
+ if (unlikely(!list_empty_careful(&con->rsp_wr_wait_list)))
+ rtrs_rdma_process_wr_wait_list(con);
+@@ -1659,6 +1658,8 @@ static int create_con(struct rtrs_srv_sess *sess,
+ max_send_wr = min_t(int, wr_limit,
+ SERVICE_CON_QUEUE_DEPTH * 2 + 2);
+ max_recv_wr = max_send_wr;
++ s->signal_interval = min_not_zero(srv->queue_depth,
++ (size_t)SERVICE_CON_QUEUE_DEPTH);
+ } else {
+ /* when always_invlaidate enalbed, we need linv+rinv+mr+imm */
+ if (always_invalidate)
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c
+index 61919ebd92b2..a8f8affc546a 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs.c
+@@ -187,10 +187,15 @@ int rtrs_post_rdma_write_imm_empty(struct rtrs_con *con, struct ib_cqe *cqe,
+ struct ib_send_wr *head)
+ {
+ struct ib_rdma_wr wr;
++ struct rtrs_sess *sess = con->sess;
++ enum ib_send_flags sflags;
++
++ sflags = (atomic_inc_return(&con->wr_cnt) % sess->signal_interval) ?
++ 0 : IB_SEND_SIGNALED;
+
+ wr = (struct ib_rdma_wr) {
+ .wr.wr_cqe = cqe,
+- .wr.send_flags = flags,
++ .wr.send_flags = sflags,
+ .wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM,
+ .wr.ex.imm_data = cpu_to_be32(imm_data),
+ };
+--
+2.30.2
+
--- /dev/null
+From ccde03648487999cc7157265790617bc7f4ef36a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 08:07:50 +0200
+Subject: RDMA/rtrs: Move sq_wr_avail to rtrs_con
+
+From: Jack Wang <jinpu.wang@ionos.com>
+
+[ Upstream commit cfcdbd9dd7632a9bb1e308a029f5fa65008333af ]
+
+In order to account HB for sq_wr_avail properly, move sq_wr_avail from
+rtrs_srv_con to rtrs_con.
+
+Although rtrs-clt do not care sq_wr_avail, but still init it to
+max_send_wr.
+
+Fixes: b38041d50add ("RDMA/rtrs: Do not signal for heatbeat")
+Link: https://lore.kernel.org/r/20210712060750.16494-7-jinpu.wang@ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Aleksei Marov <aleksei.marov@ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 1 +
+ drivers/infiniband/ulp/rtrs/rtrs-pri.h | 1 +
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 8 ++++----
+ drivers/infiniband/ulp/rtrs/rtrs-srv.h | 1 -
+ drivers/infiniband/ulp/rtrs/rtrs.c | 1 +
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index f023676e05e4..ece3205531b8 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1680,6 +1680,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
+ sess->queue_depth * 3 + 1);
+ max_send_sge = 2;
+ }
++ atomic_set(&con->c.sq_wr_avail, max_send_wr);
+ cq_num = max_send_wr + max_recv_wr;
+ /* alloc iu to recv new rkey reply when server reports flags set */
+ if (sess->flags & RTRS_MSG_NEW_RKEY_F || con->c.cid == 0) {
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+index b88a4944cb30..119aa3f7eafe 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+@@ -97,6 +97,7 @@ struct rtrs_con {
+ unsigned int cid;
+ int nr_cqe;
+ atomic_t wr_cnt;
++ atomic_t sq_wr_avail;
+ };
+
+ struct rtrs_sess {
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 44ed15f38896..cd9a4ccf4c28 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -507,11 +507,11 @@ bool rtrs_srv_resp_rdma(struct rtrs_srv_op *id, int status)
+ ib_update_fast_reg_key(mr->mr, ib_inc_rkey(mr->mr->rkey));
+ }
+ if (unlikely(atomic_sub_return(1,
+- &con->sq_wr_avail) < 0)) {
++ &con->c.sq_wr_avail) < 0)) {
+ rtrs_err(s, "IB send queue full: sess=%s cid=%d\n",
+ kobject_name(&sess->kobj),
+ con->c.cid);
+- atomic_add(1, &con->sq_wr_avail);
++ atomic_add(1, &con->c.sq_wr_avail);
+ spin_lock(&con->rsp_wr_wait_lock);
+ list_add_tail(&id->wait_list, &con->rsp_wr_wait_list);
+ spin_unlock(&con->rsp_wr_wait_lock);
+@@ -1268,7 +1268,7 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ * post_send() RDMA write completions of IO reqs (read/write)
+ * and hb.
+ */
+- atomic_add(s->signal_interval, &con->sq_wr_avail);
++ atomic_add(s->signal_interval, &con->c.sq_wr_avail);
+
+ if (unlikely(!list_empty_careful(&con->rsp_wr_wait_list)))
+ rtrs_rdma_process_wr_wait_list(con);
+@@ -1680,7 +1680,7 @@ static int create_con(struct rtrs_srv_sess *sess,
+ */
+ }
+ cq_num = max_send_wr + max_recv_wr;
+- atomic_set(&con->sq_wr_avail, max_send_wr);
++ atomic_set(&con->c.sq_wr_avail, max_send_wr);
+ cq_vector = rtrs_srv_get_next_cq_vector(sess);
+
+ /* TODO: SOFTIRQ can be faster, but be careful with softirq context */
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.h b/drivers/infiniband/ulp/rtrs/rtrs-srv.h
+index 6785c3b6363e..e81774f5acd3 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.h
+@@ -42,7 +42,6 @@ struct rtrs_srv_stats {
+
+ struct rtrs_srv_con {
+ struct rtrs_con c;
+- atomic_t sq_wr_avail;
+ struct list_head rsp_wr_wait_list;
+ spinlock_t rsp_wr_wait_lock;
+ };
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c
+index a8f8affc546a..0a4b4e1b5e5f 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs.c
+@@ -190,6 +190,7 @@ int rtrs_post_rdma_write_imm_empty(struct rtrs_con *con, struct ib_cqe *cqe,
+ struct rtrs_sess *sess = con->sess;
+ enum ib_send_flags sflags;
+
++ atomic_dec_if_positive(&con->sq_wr_avail);
+ sflags = (atomic_inc_return(&con->wr_cnt) % sess->signal_interval) ?
+ 0 : IB_SEND_SIGNALED;
+
+--
+2.30.2
+
--- /dev/null
+From 45e40a44518dcf2addbba5629188647574c91c32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 08:07:46 +0200
+Subject: RDMA/rtrs: move wr_cnt from rtrs_srv_con to rtrs_con
+
+From: Jack Wang <jinpu.wang@ionos.com>
+
+[ Upstream commit a10431eff136ef15e1f9955efe369744b1294db1 ]
+
+We need to track also the wr used for heatbeat. This is a preparation for
+that, will be used in later patch.
+
+The io_cnt in rtrs_clt is removed, use wr_cnt instead.
+
+Link: https://lore.kernel.org/r/20210712060750.16494-3-jinpu.wang@ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Aleksei Marov <aleksei.marov@ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 ++++---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.h | 1 -
+ drivers/infiniband/ulp/rtrs/rtrs-pri.h | 1 +
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 6 +++---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.h | 1 -
+ 5 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index f2c40e50f25e..5cb00ea08919 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -478,7 +478,7 @@ static int rtrs_post_send_rdma(struct rtrs_clt_con *con,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = atomic_inc_return(&con->io_cnt) % sess->queue_depth ?
++ flags = atomic_inc_return(&con->c.wr_cnt) % sess->queue_depth ?
+ 0 : IB_SEND_SIGNALED;
+
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev, req->iu->dma_addr,
+@@ -1043,7 +1043,7 @@ static int rtrs_post_rdma_write_sg(struct rtrs_clt_con *con,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = atomic_inc_return(&con->io_cnt) % sess->queue_depth ?
++ flags = atomic_inc_return(&con->c.wr_cnt) % sess->queue_depth ?
+ 0 : IB_SEND_SIGNALED;
+
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev, req->iu->dma_addr,
+@@ -1601,7 +1601,8 @@ static int create_con(struct rtrs_clt_sess *sess, unsigned int cid)
+ con->cpu = (cid ? cid - 1 : 0) % nr_cpu_ids;
+ con->c.cid = cid;
+ con->c.sess = &sess->s;
+- atomic_set(&con->io_cnt, 0);
++ /* Align with srv, init as 1 */
++ atomic_set(&con->c.wr_cnt, 1);
+ mutex_init(&con->con_mutex);
+
+ sess->s.con[cid] = &con->c;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.h b/drivers/infiniband/ulp/rtrs/rtrs-clt.h
+index e276a2dfcf7c..3c3ff094588c 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.h
+@@ -74,7 +74,6 @@ struct rtrs_clt_con {
+ u32 queue_num;
+ unsigned int cpu;
+ struct mutex con_mutex;
+- atomic_t io_cnt;
+ int cm_err;
+ };
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+index 36f184a3b676..a44a4fb1b515 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+@@ -96,6 +96,7 @@ struct rtrs_con {
+ struct rdma_cm_id *cm_id;
+ unsigned int cid;
+ int nr_cqe;
++ atomic_t wr_cnt;
+ };
+
+ struct rtrs_sess {
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 3df290086169..31b846ca0c5e 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -269,7 +269,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ * From time to time we have to post signaled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = (atomic_inc_return(&id->con->wr_cnt) % srv->queue_depth) ?
++ flags = (atomic_inc_return(&id->con->c.wr_cnt) % srv->queue_depth) ?
+ 0 : IB_SEND_SIGNALED;
+
+ if (need_inval) {
+@@ -396,7 +396,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ * From time to time we have to post signalled sends,
+ * or send queue will fill up and only QP reset can help.
+ */
+- flags = (atomic_inc_return(&con->wr_cnt) % srv->queue_depth) ?
++ flags = (atomic_inc_return(&con->c.wr_cnt) % srv->queue_depth) ?
+ 0 : IB_SEND_SIGNALED;
+ imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval);
+ imm_wr.wr.next = NULL;
+@@ -1648,7 +1648,7 @@ static int create_con(struct rtrs_srv_sess *sess,
+ con->c.cm_id = cm_id;
+ con->c.sess = &sess->s;
+ con->c.cid = cid;
+- atomic_set(&con->wr_cnt, 1);
++ atomic_set(&con->c.wr_cnt, 1);
+ wr_limit = sess->s.dev->ib_dev->attrs.max_qp_wr;
+
+ if (con->c.cid == 0) {
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.h b/drivers/infiniband/ulp/rtrs/rtrs-srv.h
+index f8da2e3f0bda..6785c3b6363e 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.h
+@@ -42,7 +42,6 @@ struct rtrs_srv_stats {
+
+ struct rtrs_srv_con {
+ struct rtrs_con c;
+- atomic_t wr_cnt;
+ atomic_t sq_wr_avail;
+ struct list_head rsp_wr_wait_list;
+ spinlock_t rsp_wr_wait_lock;
+--
+2.30.2
+
--- /dev/null
+From fd0df2ee9e68ea9030c5c14313124f6b37e49db2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 15:35:01 +0300
+Subject: Revert "USB: xhci: fix U1/U2 handling for hardware with
+ XHCI_INTEL_HOST quirk set"
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 2847c46c61486fd8bca9136a6e27177212e78c69 ]
+
+This reverts commit 5d5323a6f3625f101dbfa94ba3ef7706cce38760.
+
+That commit effectively disabled Intel host initiated U1/U2 lpm for devices
+with periodic endpoints.
+
+Before that commit we disabled host initiated U1/U2 lpm if the exit latency
+was larger than any periodic endpoint service interval, this is according
+to xhci spec xhci 1.1 specification section 4.23.5.2
+
+After that commit we incorrectly checked that service interval was smaller
+than U1/U2 inactivity timeout. This is not relevant, and can't happen for
+Intel hosts as previously set U1/U2 timeout = 105% * service interval.
+
+Patch claimed it solved cases where devices can't be enumerated because of
+bandwidth issues. This might be true but it's a side effect of accidentally
+turning off lpm.
+
+exit latency calculations have been revised since then
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210820123503.2605901-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 3618070eba78..18a203c9011e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4705,19 +4705,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+- else
+- timeout_ns = udev->u1_params.sel;
+-
+ /* Prevent U1 if service interval is shorter than U1 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
+ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
++ else
++ timeout_ns = udev->u1_params.sel;
++
+ /* The U1 timeout is encoded in 1us intervals.
+ * Don't return a timeout of zero, because that's USB3_LPM_DISABLED.
+ */
+@@ -4769,19 +4769,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+- else
+- timeout_ns = udev->u2_params.sel;
+-
+ /* Prevent U2 if service interval is shorter than U2 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
+ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
++ else
++ timeout_ns = udev->u2_params.sel;
++
+ /* The U2 timeout is encoded in 256us intervals */
+ timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000);
+ /* If the necessary timeout value is bigger than what we can set in the
+--
+2.30.2
+
--- /dev/null
+From 37227e8b268dac5d6542550b2c2575251d684036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:41:42 -0400
+Subject: rpc: fix gss_svc_init cleanup on failure
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 5a4753446253a427c0ff1e433b9c4933e5af207c ]
+
+The failure case here should be rare, but it's obviously wrong.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index a81be45f40d9..3d685fe328fa 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1980,7 +1980,7 @@ gss_svc_init_net(struct net *net)
+ goto out2;
+ return 0;
+ out2:
+- destroy_use_gss_proxy_proc_entry(net);
++ rsi_cache_destroy_net(net);
+ out1:
+ rsc_cache_destroy_net(net);
+ return rv;
+--
+2.30.2
+
--- /dev/null
+From a7596109bb820bcb6e51dbd9326d84b693d723b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 23:13:25 +0800
+Subject: rtl8xxxu: Fix the handling of TX A-MPDU aggregation
+
+From: Chris Chiu <chris.chiu@canonical.com>
+
+[ Upstream commit 95a581ab3592082c60a08090aabe09ac7d0bd650 ]
+
+The TX A-MPDU aggregation is not handled in the driver since the
+ieee80211_start_tx_ba_session has never been started properly.
+Start and stop the TX BA session by tracking the TX aggregation
+status of each TID. Fix the ampdu_action and the tx descriptor
+accordingly with the given TID.
+
+Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210804151325.86600-1-chris.chiu@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 2 ++
+ .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 33 ++++++++++++++-----
+ 2 files changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index 01735776345a..7ddce3c3f0c4 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -1378,6 +1378,8 @@ struct rtl8xxxu_priv {
+ u8 no_pape:1;
+ u8 int_buf[USB_INTR_CONTENT_LENGTH];
+ u8 rssi_level;
++ DECLARE_BITMAP(tx_aggr_started, IEEE80211_NUM_TIDS);
++ DECLARE_BITMAP(tid_tx_operational, IEEE80211_NUM_TIDS);
+ /*
+ * Only one virtual interface permitted because only STA mode
+ * is supported and no iface_combinations are provided.
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index ac1061caacd6..3285a91efb91 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4805,6 +4805,8 @@ rtl8xxxu_fill_txdesc_v1(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
+ struct ieee80211_rate *tx_rate = ieee80211_get_tx_rate(hw, tx_info);
+ struct rtl8xxxu_priv *priv = hw->priv;
+ struct device *dev = &priv->udev->dev;
++ u8 *qc = ieee80211_get_qos_ctl(hdr);
++ u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+ u32 rate;
+ u16 rate_flags = tx_info->control.rates[0].flags;
+ u16 seq_number;
+@@ -4828,7 +4830,7 @@ rtl8xxxu_fill_txdesc_v1(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
+
+ tx_desc->txdw3 = cpu_to_le32((u32)seq_number << TXDESC32_SEQ_SHIFT);
+
+- if (ampdu_enable)
++ if (ampdu_enable && test_bit(tid, priv->tid_tx_operational))
+ tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_ENABLE);
+ else
+ tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_BREAK);
+@@ -4876,6 +4878,8 @@ rtl8xxxu_fill_txdesc_v2(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
+ struct rtl8xxxu_priv *priv = hw->priv;
+ struct device *dev = &priv->udev->dev;
+ struct rtl8xxxu_txdesc40 *tx_desc40;
++ u8 *qc = ieee80211_get_qos_ctl(hdr);
++ u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+ u32 rate;
+ u16 rate_flags = tx_info->control.rates[0].flags;
+ u16 seq_number;
+@@ -4902,7 +4906,7 @@ rtl8xxxu_fill_txdesc_v2(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
+
+ tx_desc40->txdw9 = cpu_to_le32((u32)seq_number << TXDESC40_SEQ_SHIFT);
+
+- if (ampdu_enable)
++ if (ampdu_enable && test_bit(tid, priv->tid_tx_operational))
+ tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_ENABLE);
+ else
+ tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_BREAK);
+@@ -5015,12 +5019,19 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
+ if (ieee80211_is_data_qos(hdr->frame_control) && sta) {
+ if (sta->ht_cap.ht_supported) {
+ u32 ampdu, val32;
++ u8 *qc = ieee80211_get_qos_ctl(hdr);
++ u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+
+ ampdu = (u32)sta->ht_cap.ampdu_density;
+ val32 = ampdu << TXDESC_AMPDU_DENSITY_SHIFT;
+ tx_desc->txdw2 |= cpu_to_le32(val32);
+
+ ampdu_enable = true;
++
++ if (!test_bit(tid, priv->tx_aggr_started) &&
++ !(skb->protocol == cpu_to_be16(ETH_P_PAE)))
++ if (!ieee80211_start_tx_ba_session(sta, tid, 0))
++ set_bit(tid, priv->tx_aggr_started);
+ }
+ }
+
+@@ -6096,6 +6107,7 @@ rtl8xxxu_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct device *dev = &priv->udev->dev;
+ u8 ampdu_factor, ampdu_density;
+ struct ieee80211_sta *sta = params->sta;
++ u16 tid = params->tid;
+ enum ieee80211_ampdu_mlme_action action = params->action;
+
+ switch (action) {
+@@ -6108,17 +6120,20 @@ rtl8xxxu_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ dev_dbg(dev,
+ "Changed HT: ampdu_factor %02x, ampdu_density %02x\n",
+ ampdu_factor, ampdu_density);
+- break;
++ return IEEE80211_AMPDU_TX_START_IMMEDIATE;
++ case IEEE80211_AMPDU_TX_STOP_CONT:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH:
+- dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH\n", __func__);
+- rtl8xxxu_set_ampdu_factor(priv, 0);
+- rtl8xxxu_set_ampdu_min_space(priv, 0);
+- break;
+ case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+- dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH_CONT\n",
+- __func__);
++ dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP\n", __func__);
+ rtl8xxxu_set_ampdu_factor(priv, 0);
+ rtl8xxxu_set_ampdu_min_space(priv, 0);
++ clear_bit(tid, priv->tx_aggr_started);
++ clear_bit(tid, priv->tid_tx_operational);
++ ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
++ break;
++ case IEEE80211_AMPDU_TX_OPERATIONAL:
++ dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_OPERATIONAL\n", __func__);
++ set_bit(tid, priv->tid_tx_operational);
+ break;
+ case IEEE80211_AMPDU_RX_START:
+ dev_dbg(dev, "%s: IEEE80211_AMPDU_RX_START\n", __func__);
+--
+2.30.2
+
--- /dev/null
+From e57e1e95958b83adfcbc1cd601bb8a3aa205ce2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 09:43:31 +0800
+Subject: rtw88: use read_poll_timeout instead of fixed sleep
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 02a55c0009a55b204e1e5c17295431f0a9e7d3b6 ]
+
+In current wow flow, driver calls rtw_wow_fw_start and sleep for 100ms,
+to wait firmware finish preliminary work and then update the value of
+WOWLAN_WAKE_REASON register to zero. But later firmware will start wow
+function with power-saving mode, in which mode the value of
+WOWLAN_WAKE_REASON register is 0xea. So driver may get 0xea value and
+return fail. We use read_poll_timeout instead to check the value to avoid
+this issue.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210728014335.8785-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/wow.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/wow.c b/drivers/net/wireless/realtek/rtw88/wow.c
+index fc9544f4e5e4..bdccfa70dddc 100644
+--- a/drivers/net/wireless/realtek/rtw88/wow.c
++++ b/drivers/net/wireless/realtek/rtw88/wow.c
+@@ -283,15 +283,26 @@ static void rtw_wow_rx_dma_start(struct rtw_dev *rtwdev)
+
+ static int rtw_wow_check_fw_status(struct rtw_dev *rtwdev, bool wow_enable)
+ {
+- /* wait 100ms for wow firmware to finish work */
+- msleep(100);
++ int ret;
++ u8 check;
++ u32 check_dis;
+
+ if (wow_enable) {
+- if (rtw_read8(rtwdev, REG_WOWLAN_WAKE_REASON))
++ ret = read_poll_timeout(rtw_read8, check, !check, 1000,
++ 100000, true, rtwdev,
++ REG_WOWLAN_WAKE_REASON);
++ if (ret)
+ goto wow_fail;
+ } else {
+- if (rtw_read32_mask(rtwdev, REG_FE1IMR, BIT_FS_RXDONE) ||
+- rtw_read32_mask(rtwdev, REG_RXPKT_NUM, BIT_RW_RELEASE))
++ ret = read_poll_timeout(rtw_read32_mask, check_dis,
++ !check_dis, 1000, 100000, true, rtwdev,
++ REG_FE1IMR, BIT_FS_RXDONE);
++ if (ret)
++ goto wow_fail;
++ ret = read_poll_timeout(rtw_read32_mask, check_dis,
++ !check_dis, 1000, 100000, false, rtwdev,
++ REG_RXPKT_NUM, BIT_RW_RELEASE);
++ if (ret)
+ goto wow_fail;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 31cb5ce6ca0a82a1b4a51f287fc8e74374e72efb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 09:43:33 +0800
+Subject: rtw88: wow: build wow function only if CONFIG_PM is on
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 05e45887382c4c0f9522515759b34991aa17e69d ]
+
+The kernel test robot reports undefined reference after we report wakeup
+reason to mac80211. This is because CONFIG_PM is not defined in the testing
+configuration file. In fact, functions within wow.c are used if CONFIG_PM
+is defined, so use CONFIG_PM to decide whether we build this file or not.
+
+The reported messages are:
+ hppa-linux-ld: drivers/net/wireless/realtek/rtw88/wow.o: in function `rtw_wow_show_wakeup_reason':
+>> (.text+0x6c4): undefined reference to `ieee80211_report_wowlan_wakeup'
+>> hppa-linux-ld: (.text+0x6e0): undefined reference to `ieee80211_report_wowlan_wakeup'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210728014335.8785-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/Makefile b/drivers/net/wireless/realtek/rtw88/Makefile
+index c0e4b111c8b4..73d6807a8cdf 100644
+--- a/drivers/net/wireless/realtek/rtw88/Makefile
++++ b/drivers/net/wireless/realtek/rtw88/Makefile
+@@ -15,9 +15,9 @@ rtw88_core-y += main.o \
+ ps.o \
+ sec.o \
+ bf.o \
+- wow.o \
+ regd.o
+
++rtw88_core-$(CONFIG_PM) += wow.o
+
+ obj-$(CONFIG_RTW88_8822B) += rtw88_8822b.o
+ rtw88_8822b-objs := rtw8822b.o rtw8822b_table.o
+--
+2.30.2
+
--- /dev/null
+From 5008d5a51fa9a84d56ff4d3683ea566ea416e7ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 09:43:35 +0800
+Subject: rtw88: wow: fix size access error of probe request
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 69c7044526d984df672b8d9b6d6998c34617cde4 ]
+
+Current flow will lead to null ptr access because of trying
+to get the size of freed probe-request packets. We store the
+information of packet size into rsvd page instead and also fix
+the size error issue, which will cause unstable behavoir of
+sending probe request by wow firmware.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210728014335.8785-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/fw.c | 8 ++++++--
+ drivers/net/wireless/realtek/rtw88/fw.h | 1 +
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
+index 3bfa5ecc0053..e6399519584b 100644
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -819,7 +819,7 @@ static u16 rtw_get_rsvd_page_probe_req_size(struct rtw_dev *rtwdev,
+ continue;
+ if ((!ssid && !rsvd_pkt->ssid) ||
+ rtw_ssid_equal(rsvd_pkt->ssid, ssid))
+- size = rsvd_pkt->skb->len;
++ size = rsvd_pkt->probe_req_size;
+ }
+
+ return size;
+@@ -1047,6 +1047,8 @@ static struct sk_buff *rtw_get_rsvd_page_skb(struct ieee80211_hw *hw,
+ ssid->ssid_len, 0);
+ else
+ skb_new = ieee80211_probereq_get(hw, vif->addr, NULL, 0, 0);
++ if (skb_new)
++ rsvd_pkt->probe_req_size = (u16)skb_new->len;
+ break;
+ case RSVD_NLO_INFO:
+ skb_new = rtw_nlo_info_get(hw);
+@@ -1643,6 +1645,7 @@ int rtw_fw_dump_fifo(struct rtw_dev *rtwdev, u8 fifo_sel, u32 addr, u32 size,
+ static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
+ u8 location)
+ {
++ struct rtw_chip_info *chip = rtwdev->chip;
+ u8 h2c_pkt[H2C_PKT_SIZE] = {0};
+ u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_UPDATE_PKT_LEN;
+
+@@ -1653,6 +1656,7 @@ static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
+ UPDATE_PKT_SET_LOCATION(h2c_pkt, location);
+
+ /* include txdesc size */
++ size += chip->tx_pkt_desc_sz;
+ UPDATE_PKT_SET_SIZE(h2c_pkt, size);
+
+ rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
+@@ -1662,7 +1666,7 @@ void rtw_fw_update_pkt_probe_req(struct rtw_dev *rtwdev,
+ struct cfg80211_ssid *ssid)
+ {
+ u8 loc;
+- u32 size;
++ u16 size;
+
+ loc = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
+ if (!loc) {
+diff --git a/drivers/net/wireless/realtek/rtw88/fw.h b/drivers/net/wireless/realtek/rtw88/fw.h
+index a8a7162fbe64..a3a28ac6f1de 100644
+--- a/drivers/net/wireless/realtek/rtw88/fw.h
++++ b/drivers/net/wireless/realtek/rtw88/fw.h
+@@ -147,6 +147,7 @@ struct rtw_rsvd_page {
+ u8 page;
+ bool add_txdesc;
+ struct cfg80211_ssid *ssid;
++ u16 probe_req_size;
+ };
+
+ enum rtw_keep_alive_pkt_type {
+--
+2.30.2
+
--- /dev/null
+From e24da0c9e727dce76f178ca67fab779b4faf5c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 19:26:01 +0200
+Subject: s390/jump_label: print real address in a case of a jump label bug
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 5492886c14744d239e87f1b0b774b5a341e755cc ]
+
+In case of a jump label print the real address of the piece of code
+where a mismatch was detected. This is right before the system panics,
+so there is nothing revealed.
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/jump_label.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
+index ab584e8e3527..9156653b56f6 100644
+--- a/arch/s390/kernel/jump_label.c
++++ b/arch/s390/kernel/jump_label.c
+@@ -36,7 +36,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected,
+ unsigned char *ipe = (unsigned char *)expected;
+ unsigned char *ipn = (unsigned char *)new;
+
+- pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc);
++ pr_emerg("Jump label code mismatch at %pS [%px]\n", ipc, ipc);
+ pr_emerg("Found: %6ph\n", ipc);
+ pr_emerg("Expected: %6ph\n", ipe);
+ pr_emerg("New: %6ph\n", ipn);
+--
+2.30.2
+
--- /dev/null
+From 68e5e390687326a27ff2a8e0bda5cffebfd8db17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 14:55:42 +0200
+Subject: s390: make PCI mio support a machine flag
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 3322ba0d7bea1e24ae464418626f6a15b69533ab ]
+
+Kernel support for the newer PCI mio instructions can be toggled off
+with the pci=nomio command line option which needs to integrate with
+common code PCI option parsing. However this option then toggles static
+branches which can't be toggled yet in an early_param() call.
+
+Thus commit 9964f396f1d0 ("s390: fix setting of mio addressing control")
+moved toggling the static branches to the PCI init routine.
+
+With this setup however we can't check for mio support outside the PCI
+code during early boot, i.e. before switching the static branches, which
+we need to be able to export this as an ELF HWCAP.
+
+Improve on this by turning mio availability into a machine flag that
+gets initially set based on CONFIG_PCI and the facility bit and gets
+toggled off if pci=nomio is found during PCI option parsing allowing
+simple access to this machine flag after early init.
+
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/setup.h | 2 ++
+ arch/s390/kernel/early.c | 4 ++++
+ arch/s390/pci/pci.c | 5 ++---
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
+index 3a77aa96d092..bdb0c77bcfd9 100644
+--- a/arch/s390/include/asm/setup.h
++++ b/arch/s390/include/asm/setup.h
+@@ -36,6 +36,7 @@
+ #define MACHINE_FLAG_NX BIT(15)
+ #define MACHINE_FLAG_GS BIT(16)
+ #define MACHINE_FLAG_SCC BIT(17)
++#define MACHINE_FLAG_PCI_MIO BIT(18)
+
+ #define LPP_MAGIC BIT(31)
+ #define LPP_PID_MASK _AC(0xffffffff, UL)
+@@ -110,6 +111,7 @@ extern unsigned long mio_wb_bit_mask;
+ #define MACHINE_HAS_NX (S390_lowcore.machine_flags & MACHINE_FLAG_NX)
+ #define MACHINE_HAS_GS (S390_lowcore.machine_flags & MACHINE_FLAG_GS)
+ #define MACHINE_HAS_SCC (S390_lowcore.machine_flags & MACHINE_FLAG_SCC)
++#define MACHINE_HAS_PCI_MIO (S390_lowcore.machine_flags & MACHINE_FLAG_PCI_MIO)
+
+ /*
+ * Console mode. Override with conmode=
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index fb84e3fc1686..9857cb046726 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -236,6 +236,10 @@ static __init void detect_machine_facilities(void)
+ clock_comparator_max = -1ULL >> 1;
+ __ctl_set_bit(0, 53);
+ }
++ if (IS_ENABLED(CONFIG_PCI) && test_facility(153)) {
++ S390_lowcore.machine_flags |= MACHINE_FLAG_PCI_MIO;
++ /* the control bit is set during PCI initialization */
++ }
+ }
+
+ static inline void save_vector_registers(void)
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index 77cd965cffef..34839bad33e4 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -893,7 +893,6 @@ static void zpci_mem_exit(void)
+ }
+
+ static unsigned int s390_pci_probe __initdata = 1;
+-static unsigned int s390_pci_no_mio __initdata;
+ unsigned int s390_pci_force_floating __initdata;
+ static unsigned int s390_pci_initialized;
+
+@@ -904,7 +903,7 @@ char * __init pcibios_setup(char *str)
+ return NULL;
+ }
+ if (!strcmp(str, "nomio")) {
+- s390_pci_no_mio = 1;
++ S390_lowcore.machine_flags &= ~MACHINE_FLAG_PCI_MIO;
+ return NULL;
+ }
+ if (!strcmp(str, "force_floating")) {
+@@ -935,7 +934,7 @@ static int __init pci_base_init(void)
+ return 0;
+ }
+
+- if (test_facility(153) && !s390_pci_no_mio) {
++ if (MACHINE_HAS_PCI_MIO) {
+ static_branch_enable(&have_mio);
+ ctl_set_bit(2, 5);
+ }
+--
+2.30.2
+
--- /dev/null
+From 625443f7baf162262cf9dd35aceff66dbec8fa1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 04:10:55 +0000
+Subject: samples: bpf: Fix tracex7 error raised on the missing argument
+
+From: Juhee Kang <claudiajkang@gmail.com>
+
+[ Upstream commit 7d07006f05922b95518be403f08ef8437b67aa32 ]
+
+The current behavior of 'tracex7' doesn't consist with other bpf samples
+tracex{1..6}. Other samples do not require any argument to run with, but
+tracex7 should be run with btrfs device argument. (it should be executed
+with test_override_return.sh)
+
+Currently, tracex7 doesn't have any description about how to run this
+program and raises an unexpected error. And this result might be
+confusing since users might not have a hunch about how to run this
+program.
+
+ // Current behavior
+ # ./tracex7
+ sh: 1: Syntax error: word unexpected (expecting ")")
+ // Fixed behavior
+ # ./tracex7
+ ERROR: Run with the btrfs device argument!
+
+In order to fix this error, this commit adds logic to report a message
+and exit when running this program with a missing argument.
+
+Additionally in test_override_return.sh, there is a problem with
+multiple directory(tmpmnt) creation. So in this commit adds a line with
+removing the directory with every execution.
+
+Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210727041056.23455-1-claudiajkang@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/test_override_return.sh | 1 +
+ samples/bpf/tracex7_user.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/samples/bpf/test_override_return.sh b/samples/bpf/test_override_return.sh
+index e68b9ee6814b..35db26f736b9 100755
+--- a/samples/bpf/test_override_return.sh
++++ b/samples/bpf/test_override_return.sh
+@@ -1,5 +1,6 @@
+ #!/bin/bash
+
++rm -r tmpmnt
+ rm -f testfile.img
+ dd if=/dev/zero of=testfile.img bs=1M seek=1000 count=1
+ DEVICE=$(losetup --show -f testfile.img)
+diff --git a/samples/bpf/tracex7_user.c b/samples/bpf/tracex7_user.c
+index fdcd6580dd73..8be7ce18d3ba 100644
+--- a/samples/bpf/tracex7_user.c
++++ b/samples/bpf/tracex7_user.c
+@@ -14,6 +14,11 @@ int main(int argc, char **argv)
+ int ret = 0;
+ FILE *f;
+
++ if (!argv[1]) {
++ fprintf(stderr, "ERROR: Run with the btrfs device argument!\n");
++ return 0;
++ }
++
+ snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
+ obj = bpf_object__open_file(filename, NULL);
+ if (libbpf_get_error(obj)) {
+--
+2.30.2
+
--- /dev/null
+From 8eb3f2488b4ef072a8d58cf5c8d481fc5913311a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 19:57:15 +0900
+Subject: samples: pktgen: fix to print when terminated normally
+
+From: Juhee Kang <claudiajkang@gmail.com>
+
+[ Upstream commit c0e9422c4e6ca9abd4bd6e1598400c7231eb600b ]
+
+Currently, most pktgen samples print the execution result when the
+program is terminated normally. However, sample03 doesn't work
+appropriately.
+
+This is results of samples:
+
+ # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample04_many_flows.sh -n 1
+ Running... ctrl^C to stop
+ Device: eth0@0
+ Result: OK: 19(c5+d13) usec, 1 (60byte,0frags)
+ 51762pps 24Mb/sec (24845760bps) errors: 0
+
+ # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample03_burst_single_flow.sh -n 1
+ Running... ctrl^C to stop
+
+The reason why it doesn't print the execution result when the program is
+terminated usually is that sample03 doesn't call the function which
+prints the result, unlike other samples.
+
+So, this commit solves this issue by calling the function before
+termination. Also, this commit changes control_c function to
+print_result to maintain consistency with other samples.
+
+Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/pktgen/pktgen_sample03_burst_single_flow.sh | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/samples/pktgen/pktgen_sample03_burst_single_flow.sh b/samples/pktgen/pktgen_sample03_burst_single_flow.sh
+index ab87de440277..8bf2fdffba16 100755
+--- a/samples/pktgen/pktgen_sample03_burst_single_flow.sh
++++ b/samples/pktgen/pktgen_sample03_burst_single_flow.sh
+@@ -85,7 +85,7 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
+ done
+
+ # Run if user hits control-c
+-function control_c() {
++function print_result() {
+ # Print results
+ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
+ dev=${DEV}@${thread}
+@@ -94,11 +94,13 @@ function control_c() {
+ done
+ }
+ # trap keyboard interrupt (Ctrl-C)
+-trap control_c SIGINT
++trap true SIGINT
+
+ if [ -z "$APPEND" ]; then
+ echo "Running... ctrl^C to stop" >&2
+ pg_ctrl "start"
++
++ print_result
+ else
+ echo "Append mode: config done. Do more or use 'pg_ctrl start' to run"
+ fi
+--
+2.30.2
+
--- /dev/null
+From 7cd7b76f0fedb4dfb2715244eeeaf7833976d262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Jul 2021 09:20:10 +0200
+Subject: scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit beec64d0c9749afedf51c3c10cf52de1d9a89cc0 ]
+
+SCSI_IOCTL_SEND_COMMAND has been deprecated longer than bsg exists and has
+been warning for just as long. More importantly it harcodes SCSI CDBs and
+thus will do the wrong thing on non-SCSI bsg nodes.
+
+Link: https://lore.kernel.org/r/20210724072033.1284840-2-hch@lst.de
+Fixes: aa387cc89567 ("block: add bsg helper library")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bsg.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/block/bsg.c b/block/bsg.c
+index 1f196563ae6c..79b42c5cafeb 100644
+--- a/block/bsg.c
++++ b/block/bsg.c
+@@ -373,10 +373,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case SG_GET_RESERVED_SIZE:
+ case SG_SET_RESERVED_SIZE:
+ case SG_EMULATED_HOST:
+- case SCSI_IOCTL_SEND_COMMAND:
+ return scsi_cmd_ioctl(bd->queue, NULL, file->f_mode, cmd, uarg);
+ case SG_IO:
+ return bsg_sg_io(bd->queue, file->f_mode, uarg);
++ case SCSI_IOCTL_SEND_COMMAND:
++ pr_warn_ratelimited("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n",
++ current->comm);
++ return -EINVAL;
+ default:
+ return -ENOTTY;
+ }
+--
+2.30.2
+
--- /dev/null
+From f1a54e25be8dd4d376ec31a2cc700a629e98366c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 10:50:31 +0100
+Subject: scsi: BusLogic: Use %X for u32 sized integer rather than %lX
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 2127cd21fb78c6e22d92944253afd967b0ff774d ]
+
+An earlier fix changed the print format specifier for adapter->bios_addr to
+use %lX. However, the integer is a u32 so the fix was wrong. Fix this by
+using the correct %X format specifier.
+
+Link: https://lore.kernel.org/r/20210730095031.26981-1-colin.king@canonical.com
+Fixes: 43622697117c ("scsi: BusLogic: use %lX for unsigned long rather than %X")
+Acked-by: Khalid Aziz <khalid@gonehiking.org>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Addresses-Coverity: ("Invalid type in argument")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index adddcd589941..bd615db5c58c 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -1711,7 +1711,7 @@ static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
+ if (adapter->adapter_bus_type != BLOGIC_PCI_BUS) {
+ blogic_info(" DMA Channel: None, ", adapter);
+ if (adapter->bios_addr > 0)
+- blogic_info("BIOS Address: 0x%lX, ", adapter,
++ blogic_info("BIOS Address: 0x%X, ", adapter,
+ adapter->bios_addr);
+ else
+ blogic_info("BIOS Address: None, ", adapter);
+--
+2.30.2
+
--- /dev/null
+From 70c00d2b33cfdc60cc1c7a22f4e99ed2353f4168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 11:26:25 +0800
+Subject: scsi: fdomain: Fix error return code in fdomain_probe()
+
+From: Wei Li <liwei391@huawei.com>
+
+[ Upstream commit 632c4ae6da1d629eddf9da1e692d7617c568c256 ]
+
+If request_region() fails the return value is not set. Return -EBUSY on
+error.
+
+Link: https://lore.kernel.org/r/20210715032625.1395495-1-liwei391@huawei.com
+Fixes: 8674a8aa2c39 ("scsi: fdomain: Add PCMCIA support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pcmcia/fdomain_cs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pcmcia/fdomain_cs.c b/drivers/scsi/pcmcia/fdomain_cs.c
+index e42acf314d06..33df6a9ba9b5 100644
+--- a/drivers/scsi/pcmcia/fdomain_cs.c
++++ b/drivers/scsi/pcmcia/fdomain_cs.c
+@@ -45,8 +45,10 @@ static int fdomain_probe(struct pcmcia_device *link)
+ goto fail_disable;
+
+ if (!request_region(link->resource[0]->start, FDOMAIN_REGION_SIZE,
+- "fdomain_cs"))
++ "fdomain_cs")) {
++ ret = -EBUSY;
+ goto fail_disable;
++ }
+
+ sh = fdomain_create(link->resource[0]->start, link->irq, 7, &link->dev);
+ if (!sh) {
+--
+2.30.2
+
--- /dev/null
+From d49c8deba2d1c17f08d58963143be5ac8b996904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:51:49 +0300
+Subject: scsi: qedf: Fix error codes in qedf_alloc_global_queues()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ccc89737aa6b9f248cf1623014038beb6c2b7f56 ]
+
+This driver has some left over "return 1" on failure style code mixed with
+"return negative error codes" style code. The caller doesn't care so we
+should just convert everything to return negative error codes.
+
+Then there was a problem that there were two variables used to store error
+codes which just resulted in confusion. If qedf_alloc_bdq() returned a
+negative error code, we accidentally returned success instead of
+propagating the error code. So get rid of the "rc" variable and use
+"status" every where.
+
+Also remove the "status = 0" initialization so that these sorts of bugs
+will be detected by the compiler in the future.
+
+Link: https://lore.kernel.org/r/20210810085023.GA23998@kili
+Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 85f41abcb56c..42d0d941dba5 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3004,7 +3004,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
+ {
+ u32 *list;
+ int i;
+- int status = 0, rc;
++ int status;
+ u32 *pbl;
+ dma_addr_t page;
+ int num_pages;
+@@ -3016,7 +3016,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
+ */
+ if (!qedf->num_queues) {
+ QEDF_ERR(&(qedf->dbg_ctx), "No MSI-X vectors available!\n");
+- return 1;
++ return -ENOMEM;
+ }
+
+ /*
+@@ -3024,7 +3024,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
+ * addresses of our queues
+ */
+ if (!qedf->p_cpuq) {
+- status = 1;
++ status = -EINVAL;
+ QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n");
+ goto mem_alloc_failure;
+ }
+@@ -3040,8 +3040,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
+ "qedf->global_queues=%p.\n", qedf->global_queues);
+
+ /* Allocate DMA coherent buffers for BDQ */
+- rc = qedf_alloc_bdq(qedf);
+- if (rc) {
++ status = qedf_alloc_bdq(qedf);
++ if (status) {
+ QEDF_ERR(&qedf->dbg_ctx, "Unable to allocate bdq.\n");
+ goto mem_alloc_failure;
+ }
+--
+2.30.2
+
--- /dev/null
+From c69763030f4a210df497651b0b7e7b1124aa7c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:47:53 +0300
+Subject: scsi: qedi: Fix error codes in qedi_alloc_global_queues()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4dbe57d46d54a847875fa33e7d05877bb341585e ]
+
+This function had some left over code that returned 1 on error instead
+negative error codes. Convert everything to use negative error codes. The
+caller treats all non-zero returns the same so this does not affect run
+time.
+
+A couple places set "rc" instead of "status" so those error paths ended up
+returning success by mistake. Get rid of the "rc" variable and use
+"status" everywhere.
+
+Remove the bogus "status = 0" initialization, as a future proofing measure
+so the compiler will warn about uninitialized error codes.
+
+Link: https://lore.kernel.org/r/20210810084753.GD23810@kili
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 0b0acb827071..e6dc0b495a82 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1621,7 +1621,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ {
+ u32 *list;
+ int i;
+- int status = 0, rc;
++ int status;
+ u32 *pbl;
+ dma_addr_t page;
+ int num_pages;
+@@ -1632,14 +1632,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ */
+ if (!qedi->num_queues) {
+ QEDI_ERR(&qedi->dbg_ctx, "No MSI-X vectors available!\n");
+- return 1;
++ return -ENOMEM;
+ }
+
+ /* Make sure we allocated the PBL that will contain the physical
+ * addresses of our queues
+ */
+ if (!qedi->p_cpuq) {
+- status = 1;
++ status = -EINVAL;
+ goto mem_alloc_failure;
+ }
+
+@@ -1654,13 +1654,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ "qedi->global_queues=%p.\n", qedi->global_queues);
+
+ /* Allocate DMA coherent buffers for BDQ */
+- rc = qedi_alloc_bdq(qedi);
+- if (rc)
++ status = qedi_alloc_bdq(qedi);
++ if (status)
+ goto mem_alloc_failure;
+
+ /* Allocate DMA coherent buffers for NVM_ISCSI_CFG */
+- rc = qedi_alloc_nvm_iscsi_cfg(qedi);
+- if (rc)
++ status = qedi_alloc_nvm_iscsi_cfg(qedi);
++ if (status)
+ goto mem_alloc_failure;
+
+ /* Allocate a CQ and an associated PBL for each MSI-X
+--
+2.30.2
+
--- /dev/null
+From 03c7b1855f6b67421e207e17ec0997c9428d7828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:46:13 +0300
+Subject: scsi: smartpqi: Fix an error code in pqi_get_raid_map()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d1f6581a6796c4e9fd8a4a24e8b77463d18f0df1 ]
+
+Return -EINVAL on failure instead of success.
+
+Link: https://lore.kernel.org/r/20210810084613.GB23810@kili
+Fixes: a91aaae0243b ("scsi: smartpqi: allow for larger raid maps")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index dcc0b9618a64..8819a407c02b 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -1322,6 +1322,7 @@ static int pqi_get_raid_map(struct pqi_ctrl_info *ctrl_info,
+ "requested %u bytes, received %u bytes\n",
+ raid_map_size,
+ get_unaligned_le32(&raid_map->structure_size));
++ rc = -EINVAL;
+ goto error;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 74b06b086ee41e4825e27c9fa8ffa2a7f0967140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 20:34:22 -0700
+Subject: scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit d3d9c4570285090b533b00946b72647361f0345b ]
+
+If param_offset > buff_len then the memcpy() statement in
+ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
+param_offset bytes into a buffer with size buff_len. Since param_offset <
+256 this results in writing past the bound of the output buffer.
+
+Link: https://lore.kernel.org/r/20210722033439.26550-2-bvanassche@acm.org
+Fixes: cbe193f6f093 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Daejun Park <daejun7.park@samsung.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 708b3b62fc4d..179227180961 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3419,9 +3419,11 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
+
+ if (is_kmalloc) {
+ /* Make sure we don't copy more data than available */
+- if (param_offset + param_size > buff_len)
+- param_size = buff_len - param_offset;
+- memcpy(param_read_buf, &desc_buf[param_offset], param_size);
++ if (param_offset >= buff_len)
++ ret = -EINVAL;
++ else
++ memcpy(param_read_buf, &desc_buf[param_offset],
++ min_t(u32, param_size, buff_len - param_offset));
+ }
+ out:
+ if (is_kmalloc)
+--
+2.30.2
+
--- /dev/null
+From 1be7409756a83137eb1118c15f20e49aa8a4701a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 20:34:35 -0700
+Subject: scsi: ufs: Fix the SCSI abort handler
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 64180742605f772d511903c9e50262afb13726c6 ]
+
+Make the following changes in ufshcd_abort():
+
+ - Return FAILED instead of SUCCESS if the abort handler notices that a
+ SCSI command has already been completed. Returning SUCCESS in this case
+ triggers a use-after-free and may trigger a kernel crash.
+
+ - Fix the code for aborting SCSI commands submitted to a WLUN.
+
+The current approach for aborting SCSI commands that have been submitted to
+a WLUN and that timed out is as follows:
+
+ - Report to the SCSI core that the command has completed successfully.
+ Let the block layer free any data buffers associated with the command.
+
+ - Mark the command as outstanding in 'outstanding_reqs'.
+
+ - If the block layer tries to reuse the tag associated with the aborted
+ command, busy-wait until the tag is freed.
+
+This approach can result in:
+
+ - Memory corruption if the controller accesses the data buffer after the
+ block layer has freed the associated data buffers.
+
+ - A race condition if ufshcd_queuecommand() or ufshcd_exec_dev_cmd()
+ checks the bit that corresponds to an aborted command in
+ 'outstanding_reqs' after it has been cleared and before it is reset.
+
+ - High energy consumption if ufshcd_queuecommand() repeatedly returns
+ SCSI_MLQUEUE_HOST_BUSY.
+
+Fix this by reporting to the SCSI error handler that aborting a SCSI
+command failed if the SCSI command was submitted to a WLUN.
+
+Link: https://lore.kernel.org/r/20210722033439.26550-15-bvanassche@acm.org
+Fixes: 7a7e66c65d41 ("scsi: ufs: Fix a race condition between ufshcd_abort() and eh_work()")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Stanley Chu <stanley.chu@mediatek.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 54 ++++++++++++++-------------------------
+ 1 file changed, 19 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 0fe559ddc789..1708d7ced527 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -2766,15 +2766,6 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
+ WARN_ON(ufshcd_is_clkgating_allowed(hba) &&
+ (hba->clk_gating.state != CLKS_ON));
+
+- if (unlikely(test_bit(tag, &hba->outstanding_reqs))) {
+- if (hba->pm_op_in_progress)
+- set_host_byte(cmd, DID_BAD_TARGET);
+- else
+- err = SCSI_MLQUEUE_HOST_BUSY;
+- ufshcd_release(hba);
+- goto out;
+- }
+-
+ lrbp = &hba->lrb[tag];
+ WARN_ON(lrbp->cmd);
+ lrbp->cmd = cmd;
+@@ -2973,11 +2964,6 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
+ req->timeout = msecs_to_jiffies(2 * timeout);
+ blk_mq_start_request(req);
+
+- if (unlikely(test_bit(tag, &hba->outstanding_reqs))) {
+- err = -EBUSY;
+- goto out;
+- }
+-
+ lrbp = &hba->lrb[tag];
+ WARN_ON(lrbp->cmd);
+ err = ufshcd_compose_dev_cmd(hba, lrbp, cmd_type, tag);
+@@ -6984,7 +6970,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ struct ufs_hba *hba;
+ unsigned long flags;
+ unsigned int tag;
+- int err = 0;
++ int err = FAILED;
+ struct ufshcd_lrb *lrbp;
+ u32 reg;
+
+@@ -7001,12 +6987,12 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+
+ ufshcd_hold(hba, false);
+ reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
+- /* If command is already aborted/completed, return SUCCESS */
++ /* If command is already aborted/completed, return FAILED. */
+ if (!(test_bit(tag, &hba->outstanding_reqs))) {
+ dev_err(hba->dev,
+ "%s: cmd at tag %d already completed, outstanding=0x%lx, doorbell=0x%x\n",
+ __func__, tag, hba->outstanding_reqs, reg);
+- goto out;
++ goto release;
+ }
+
+ /* Print Transfer Request of aborted task */
+@@ -7035,7 +7021,8 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ dev_err(hba->dev,
+ "%s: cmd was completed, but without a notifying intr, tag = %d",
+ __func__, tag);
+- goto cleanup;
++ __ufshcd_transfer_req_compl(hba, 1UL << tag);
++ goto release;
+ }
+
+ /*
+@@ -7048,36 +7035,33 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ */
+ if (lrbp->lun == UFS_UPIU_UFS_DEVICE_WLUN) {
+ ufshcd_update_evt_hist(hba, UFS_EVT_ABORT, lrbp->lun);
+- __ufshcd_transfer_req_compl(hba, (1UL << tag));
+- set_bit(tag, &hba->outstanding_reqs);
++
+ spin_lock_irqsave(host->host_lock, flags);
+ hba->force_reset = true;
+ ufshcd_schedule_eh_work(hba);
+ spin_unlock_irqrestore(host->host_lock, flags);
+- goto out;
++ goto release;
+ }
+
+ /* Skip task abort in case previous aborts failed and report failure */
+- if (lrbp->req_abort_skip)
+- err = -EIO;
+- else
+- err = ufshcd_try_to_abort_task(hba, tag);
++ if (lrbp->req_abort_skip) {
++ dev_err(hba->dev, "%s: skipping abort\n", __func__);
++ ufshcd_set_req_abort_skip(hba, hba->outstanding_reqs);
++ goto release;
++ }
+
+- if (!err) {
+-cleanup:
+- __ufshcd_transfer_req_compl(hba, (1UL << tag));
+-out:
+- err = SUCCESS;
+- } else {
++ err = ufshcd_try_to_abort_task(hba, tag);
++ if (err) {
+ dev_err(hba->dev, "%s: failed with err %d\n", __func__, err);
+ ufshcd_set_req_abort_skip(hba, hba->outstanding_reqs);
+ err = FAILED;
++ goto release;
+ }
+
+- /*
+- * This ufshcd_release() corresponds to the original scsi cmd that got
+- * aborted here (as we won't get any IRQ for it).
+- */
++ err = SUCCESS;
++
++release:
++ /* Matches the ufshcd_hold() call at the start of this function. */
+ ufshcd_release(hba);
+ return err;
+ }
+--
+2.30.2
+
--- /dev/null
+From f86b2f46c818f6813fd98ad1669f373d01c28525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 15:43:01 +0100
+Subject: scsi: ufs: Fix unsigned int compared with less than zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a5402cdcc2a925835db89ea336909b2b724189df ]
+
+Variable 'tag' is currently an unsigned int and is being compared to less
+than zero, this check is always false. Fix this by making 'tag' an int.
+
+Link: https://lore.kernel.org/r/20210806144301.19864-1-colin.king@canonical.com
+Fixes: 4728ab4a8e64 ("scsi: ufs: Remove ufshcd_valid_tag()")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Addresses-Coverity: ("Macro compares unsigned to 0")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 1708d7ced527..8275127749d2 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6969,7 +6969,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ struct Scsi_Host *host;
+ struct ufs_hba *hba;
+ unsigned long flags;
+- unsigned int tag;
++ int tag;
+ int err = FAILED;
+ struct ufshcd_lrb *lrbp;
+ u32 reg;
+--
+2.30.2
+
--- /dev/null
+From c14a0501ab817d271b25a654c1ab6d6c53f43429 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 22:41:31 +0530
+Subject: scsi: ufs: ufs-exynos: Fix static checker warning
+
+From: Alim Akhtar <alim.akhtar@samsung.com>
+
+[ Upstream commit 313bf281f2091552f509fd05a74172c70ce7572f ]
+
+clk_get_rate() returns unsigned long and currently this driver stores the
+return value in u32 type, resulting the below warning:
+
+Fixed smatch warnings:
+
+ drivers/scsi/ufs/ufs-exynos.c:286 exynos_ufs_get_clk_info()
+ warn: wrong type for 'ufs->mclk_rate' (should be 'ulong')
+
+ drivers/scsi/ufs/ufs-exynos.c:287 exynos_ufs_get_clk_info()
+ warn: wrong type for 'pclk_rate' (should be 'ulong')
+
+Link: https://lore.kernel.org/r/20210819171131.55912-1-alim.akhtar@samsung.com
+Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-exynos.c | 4 ++--
+ drivers/scsi/ufs/ufs-exynos.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufs-exynos.c b/drivers/scsi/ufs/ufs-exynos.c
+index cf46d6f86e0e..427a2ff7e9da 100644
+--- a/drivers/scsi/ufs/ufs-exynos.c
++++ b/drivers/scsi/ufs/ufs-exynos.c
+@@ -260,7 +260,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs)
+ struct ufs_hba *hba = ufs->hba;
+ struct list_head *head = &hba->clk_list_head;
+ struct ufs_clk_info *clki;
+- u32 pclk_rate;
++ unsigned long pclk_rate;
+ u32 f_min, f_max;
+ u8 div = 0;
+ int ret = 0;
+@@ -299,7 +299,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs)
+ }
+
+ if (unlikely(pclk_rate < f_min || pclk_rate > f_max)) {
+- dev_err(hba->dev, "not available pclk range %d\n", pclk_rate);
++ dev_err(hba->dev, "not available pclk range %lu\n", pclk_rate);
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/scsi/ufs/ufs-exynos.h b/drivers/scsi/ufs/ufs-exynos.h
+index 67505fe32ebf..dadf4fd10dd8 100644
+--- a/drivers/scsi/ufs/ufs-exynos.h
++++ b/drivers/scsi/ufs/ufs-exynos.h
+@@ -184,7 +184,7 @@ struct exynos_ufs {
+ u32 pclk_div;
+ u32 pclk_avail_min;
+ u32 pclk_avail_max;
+- u32 mclk_rate;
++ unsigned long mclk_rate;
+ int avail_ln_rx;
+ int avail_ln_tx;
+ int rx_sel_idx;
+--
+2.30.2
+
--- /dev/null
+From d2503113d29aa62f6f5824af888aff35e9d249e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 20:34:26 -0700
+Subject: scsi: ufs: Use DECLARE_COMPLETION_ONSTACK() where appropriate
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 8a686f26eaa4b8a5c494b6b69e8a97815e3ffb82 ]
+
+From Documentation/scheduler/completion.rst: "When a completion is declared
+as a local variable within a function, then the initialization should
+always use DECLARE_COMPLETION_ONSTACK() explicitly, not just to make
+lockdep happy, but also to make it clear that limited scope had been
+considered and is intentional."
+
+Link: https://lore.kernel.org/r/20210722033439.26550-6-bvanassche@acm.org
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Stanley Chu <stanley.chu@mediatek.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Reviewed-by: Daejun Park <daejun7.park@samsung.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 179227180961..0fe559ddc789 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -2949,11 +2949,11 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
+ enum dev_cmd_type cmd_type, int timeout)
+ {
+ struct request_queue *q = hba->cmd_queue;
++ DECLARE_COMPLETION_ONSTACK(wait);
+ struct request *req;
+ struct ufshcd_lrb *lrbp;
+ int err;
+ int tag;
+- struct completion wait;
+
+ down_read(&hba->clk_scaling_lock);
+
+@@ -2978,7 +2978,6 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
+ goto out;
+ }
+
+- init_completion(&wait);
+ lrbp = &hba->lrb[tag];
+ WARN_ON(lrbp->cmd);
+ err = ufshcd_compose_dev_cmd(hba, lrbp, cmd_type, tag);
+@@ -3985,14 +3984,13 @@ EXPORT_SYMBOL_GPL(ufshcd_dme_get_attr);
+ */
+ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)
+ {
+- struct completion uic_async_done;
++ DECLARE_COMPLETION_ONSTACK(uic_async_done);
+ unsigned long flags;
+ u8 status;
+ int ret;
+ bool reenable_intr = false;
+
+ mutex_lock(&hba->uic_cmd_mutex);
+- init_completion(&uic_async_done);
+ ufshcd_add_delay_before_dme_cmd(hba);
+
+ spin_lock_irqsave(hba->host->host_lock, flags);
+@@ -6665,11 +6663,11 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
+ enum query_opcode desc_op)
+ {
+ struct request_queue *q = hba->cmd_queue;
++ DECLARE_COMPLETION_ONSTACK(wait);
+ struct request *req;
+ struct ufshcd_lrb *lrbp;
+ int err = 0;
+ int tag;
+- struct completion wait;
+ u8 upiu_flags;
+
+ down_read(&hba->clk_scaling_lock);
+@@ -6687,7 +6685,6 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
+ goto out;
+ }
+
+- init_completion(&wait);
+ lrbp = &hba->lrb[tag];
+ WARN_ON(lrbp->cmd);
+ lrbp->cmd = NULL;
+--
+2.30.2
+
--- /dev/null
+From 5bfb8dd8a8f4eb25ab816b7103f4d7f2239449ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 16:04:41 +0300
+Subject: scsi: ufshcd: Fix device links when BOOT WLUN fails to probe
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit bf25967ac54129ffb676ee0dbe3b8b34af6c6232 ]
+
+Managed device links are deleted by device_del(). However it is possible to
+add a device link to a consumer before device_add(), and then discovering
+an error prevents the device from being used. In that case normally
+references to the device would be dropped and the device would be deleted.
+However the device link holds a reference to the device, so the device link
+and device remain indefinitely (unless the supplier is deleted).
+
+For UFSHCD, if a LUN fails to probe (e.g. absent BOOT WLUN), the device
+will not have been registered but can still have a device link holding a
+reference to the device. The unwanted device link will prevent runtime
+suspend indefinitely.
+
+Amend device link removal to accept removal of a link with an unregistered
+consumer device (suggested by Rafael), and fix UFSHCD by explicitly
+deleting the device link when SCSI destroys the SCSI device.
+
+Link: https://lore.kernel.org/r/a1c9bac8-b560-b662-f0aa-58c7e000cbbd@intel.com
+Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun")
+Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 2 ++
+ drivers/scsi/ufs/ufshcd.c | 23 +++++++++++++++++++++--
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 6c0ef9d55a34..8c77e14987d4 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -886,6 +886,8 @@ static void device_link_put_kref(struct device_link *link)
+ {
+ if (link->flags & DL_FLAG_STATELESS)
+ kref_put(&link->kref, __device_link_del);
++ else if (!device_is_registered(link->consumer))
++ __device_link_del(&link->kref);
+ else
+ WARN(1, "Unable to drop a managed device link reference\n");
+ }
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 8275127749d2..15ac5fa14805 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5006,15 +5006,34 @@ static int ufshcd_slave_configure(struct scsi_device *sdev)
+ static void ufshcd_slave_destroy(struct scsi_device *sdev)
+ {
+ struct ufs_hba *hba;
++ unsigned long flags;
+
+ hba = shost_priv(sdev->host);
+ /* Drop the reference as it won't be needed anymore */
+ if (ufshcd_scsi_to_upiu_lun(sdev->lun) == UFS_UPIU_UFS_DEVICE_WLUN) {
+- unsigned long flags;
+-
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ hba->sdev_ufs_device = NULL;
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
++ } else if (hba->sdev_ufs_device) {
++ struct device *supplier = NULL;
++
++ /* Ensure UFS Device WLUN exists and does not disappear */
++ spin_lock_irqsave(hba->host->host_lock, flags);
++ if (hba->sdev_ufs_device) {
++ supplier = &hba->sdev_ufs_device->sdev_gendev;
++ get_device(supplier);
++ }
++ spin_unlock_irqrestore(hba->host->host_lock, flags);
++
++ if (supplier) {
++ /*
++ * If a LUN fails to probe (e.g. absent BOOT WLUN), the
++ * device will not have been registered but can still
++ * have a device link holding a reference to the device.
++ */
++ device_link_remove(&sdev->sdev_gendev, supplier);
++ put_device(supplier);
++ }
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 71dcc3bf7f9b58da98ae20bc8838d13be321fc79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:47:30 -0700
+Subject: selftests/bpf: Correctly display subtest skip status
+
+From: Yucong Sun <fallentree@fb.com>
+
+[ Upstream commit f667d1d66760fcb27aee6c9964eefde39a464afe ]
+
+In skip_account(), test->skip_cnt is set to 0 at the end, this makes next print
+statement never display SKIP status for the subtest. This patch moves the
+accounting logic after the print statement, fixing the issue.
+
+This patch also added SKIP status display for normal tests.
+
+Signed-off-by: Yucong Sun <fallentree@fb.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210817044732.3263066-3-fallentree@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 25 ++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 6f103106a39b..bfbf2277b61a 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -148,18 +148,18 @@ void test__end_subtest()
+ struct prog_test_def *test = env.test;
+ int sub_error_cnt = test->error_cnt - test->old_error_cnt;
+
+- if (sub_error_cnt)
+- env.fail_cnt++;
+- else if (test->skip_cnt == 0)
+- env.sub_succ_cnt++;
+- skip_account();
+-
+ dump_test_log(test, sub_error_cnt);
+
+ fprintf(env.stdout, "#%d/%d %s:%s\n",
+ test->test_num, test->subtest_num, test->subtest_name,
+ sub_error_cnt ? "FAIL" : (test->skip_cnt ? "SKIP" : "OK"));
+
++ if (sub_error_cnt)
++ env.fail_cnt++;
++ else if (test->skip_cnt == 0)
++ env.sub_succ_cnt++;
++ skip_account();
++
+ free(test->subtest_name);
+ test->subtest_name = NULL;
+ }
+@@ -786,17 +786,18 @@ int main(int argc, char **argv)
+ test__end_subtest();
+
+ test->tested = true;
+- if (test->error_cnt)
+- env.fail_cnt++;
+- else
+- env.succ_cnt++;
+- skip_account();
+
+ dump_test_log(test, test->error_cnt);
+
+ fprintf(env.stdout, "#%d %s:%s\n",
+ test->test_num, test->test_name,
+- test->error_cnt ? "FAIL" : "OK");
++ test->error_cnt ? "FAIL" : (test->skip_cnt ? "SKIP" : "OK"));
++
++ if (test->error_cnt)
++ env.fail_cnt++;
++ else
++ env.succ_cnt++;
++ skip_account();
+
+ reset_affinity();
+ restore_netns();
+--
+2.30.2
+
--- /dev/null
+From 11a1d29e32202af94842a20758e7dfdf71dfbfa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 09:55:53 +0800
+Subject: selftests/bpf: Enlarge select() timeout for test_maps
+
+From: Li Zhijian <lizhijian@cn.fujitsu.com>
+
+[ Upstream commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 ]
+
+0Day robot observed that it's easily timeout on a heavy load host.
+-------------------
+ # selftests: bpf: test_maps
+ # Fork 1024 tasks to 'test_update_delete'
+ # Fork 1024 tasks to 'test_update_delete'
+ # Fork 100 tasks to 'test_hashmap'
+ # Fork 100 tasks to 'test_hashmap_percpu'
+ # Fork 100 tasks to 'test_hashmap_sizes'
+ # Fork 100 tasks to 'test_hashmap_walk'
+ # Fork 100 tasks to 'test_arraymap'
+ # Fork 100 tasks to 'test_arraymap_percpu'
+ # Failed sockmap unexpected timeout
+ not ok 3 selftests: bpf: test_maps # exit=1
+ # selftests: bpf: test_lru_map
+ # nr_cpus:8
+-------------------
+Since this test will be scheduled by 0Day to a random host that could have
+only a few cpus(2-8), enlarge the timeout to avoid a false NG report.
+
+In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps',
+and knew 10S is likely enough, but i still perfer to a larger value 30.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index abdfc41f7685..4fd01450a408 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -985,7 +985,7 @@ static void test_sockmap(unsigned int tasks, void *data)
+
+ FD_ZERO(&w);
+ FD_SET(sfd[3], &w);
+- to.tv_sec = 1;
++ to.tv_sec = 30;
+ to.tv_usec = 0;
+ s = select(sfd[3] + 1, &w, NULL, NULL, &to);
+ if (s == -1) {
+--
+2.30.2
+
--- /dev/null
+From 88a0587380eecb17ba1e09ffad7f04791bec37ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 12:09:23 -0700
+Subject: selftests/bpf: Fix flaky send_signal test
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit b16ac5bf732a5e23d164cf908ec7742d6a6120d3 ]
+
+libbpf CI has reported send_signal test is flaky although
+I am not able to reproduce it in my local environment.
+But I am able to reproduce with on-demand libbpf CI ([1]).
+
+Through code analysis, the following is possible reason.
+The failed subtest runs bpf program in softirq environment.
+Since bpf_send_signal() only sends to a fork of "test_progs"
+process. If the underlying current task is
+not "test_progs", bpf_send_signal() will not be triggered
+and the subtest will fail.
+
+To reduce the chances where the underlying process is not
+the intended one, this patch boosted scheduling priority to
+-20 (highest allowed by setpriority() call). And I did
+10 runs with on-demand libbpf CI with this patch and I
+didn't observe any failures.
+
+ [1] https://github.com/libbpf/libbpf/actions/workflows/ondemand.yml
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210817190923.3186725-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/send_signal.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/send_signal.c b/tools/testing/selftests/bpf/prog_tests/send_signal.c
+index 023cc532992d..839f7ddaec16 100644
+--- a/tools/testing/selftests/bpf/prog_tests/send_signal.c
++++ b/tools/testing/selftests/bpf/prog_tests/send_signal.c
+@@ -1,5 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <test_progs.h>
++#include <sys/time.h>
++#include <sys/resource.h>
+ #include "test_send_signal_kern.skel.h"
+
+ int sigusr1_received = 0;
+@@ -41,12 +43,23 @@ static void test_send_signal_common(struct perf_event_attr *attr,
+ }
+
+ if (pid == 0) {
++ int old_prio;
++
+ /* install signal handler and notify parent */
+ signal(SIGUSR1, sigusr1_handler);
+
+ close(pipe_c2p[0]); /* close read */
+ close(pipe_p2c[1]); /* close write */
+
++ /* boost with a high priority so we got a higher chance
++ * that if an interrupt happens, the underlying task
++ * is this process.
++ */
++ errno = 0;
++ old_prio = getpriority(PRIO_PROCESS, 0);
++ ASSERT_OK(errno, "getpriority");
++ ASSERT_OK(setpriority(PRIO_PROCESS, 0, -20), "setpriority");
++
+ /* notify parent signal handler is installed */
+ CHECK(write(pipe_c2p[1], buf, 1) != 1, "pipe_write", "err %d\n", -errno);
+
+@@ -62,6 +75,9 @@ static void test_send_signal_common(struct perf_event_attr *attr,
+ /* wait for parent notification and exit */
+ CHECK(read(pipe_p2c[0], buf, 1) != 1, "pipe_read", "err %d\n", -errno);
+
++ /* restore the old priority */
++ ASSERT_OK(setpriority(PRIO_PROCESS, 0, old_prio), "setpriority");
++
+ close(pipe_c2p[1]);
+ close(pipe_p2c[0]);
+ exit(0);
+--
+2.30.2
+
--- /dev/null
+From 375f4188280ab89e50622edc69d9a9e789e7b676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 00:41:40 -0700
+Subject: selftests/bpf: Fix potential unreleased lock
+
+From: Chengfeng Ye <cyeaa@connect.ust.hk>
+
+[ Upstream commit 47bb27a20d6ea22cd092c1fc2bb4fcecac374838 ]
+
+This lock is not released if the program
+return at the patched branch.
+
+Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210827074140.118671-1-cyeaa@connect.ust.hk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c b/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
+index ec281b0363b8..86f97681ad89 100644
+--- a/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
++++ b/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
+@@ -195,8 +195,10 @@ static void run_test(int cgroup_fd)
+
+ pthread_mutex_lock(&server_started_mtx);
+ if (CHECK_FAIL(pthread_create(&tid, NULL, server_thread,
+- (void *)&server_fd)))
++ (void *)&server_fd))) {
++ pthread_mutex_unlock(&server_started_mtx);
+ goto close_server_fd;
++ }
+ pthread_cond_wait(&server_started, &server_started_mtx);
+ pthread_mutex_unlock(&server_started_mtx);
+
+--
+2.30.2
+
--- /dev/null
+From fbc59e9897701456f5b2e1870e2360d334410284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 05:57:37 +0000
+Subject: selftests/bpf: Fix xdp_tx.c prog section name
+
+From: Jussi Maki <joamaki@gmail.com>
+
+[ Upstream commit 95413846cca37f20000dd095cf6d91f8777129d7 ]
+
+The program type cannot be deduced from 'tx' which causes an invalid
+argument error when trying to load xdp_tx.o using the skeleton.
+Rename the section name to "xdp" so that libbpf can deduce the type.
+
+Signed-off-by: Jussi Maki <joamaki@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210731055738.16820-7-joamaki@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/xdp_tx.c | 2 +-
+ tools/testing/selftests/bpf/test_xdp_veth.sh | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/xdp_tx.c b/tools/testing/selftests/bpf/progs/xdp_tx.c
+index 94e6c2b281cb..5f725c720e00 100644
+--- a/tools/testing/selftests/bpf/progs/xdp_tx.c
++++ b/tools/testing/selftests/bpf/progs/xdp_tx.c
+@@ -3,7 +3,7 @@
+ #include <linux/bpf.h>
+ #include <bpf/bpf_helpers.h>
+
+-SEC("tx")
++SEC("xdp")
+ int xdp_tx(struct xdp_md *xdp)
+ {
+ return XDP_TX;
+diff --git a/tools/testing/selftests/bpf/test_xdp_veth.sh b/tools/testing/selftests/bpf/test_xdp_veth.sh
+index ba8ffcdaac30..995278e684b6 100755
+--- a/tools/testing/selftests/bpf/test_xdp_veth.sh
++++ b/tools/testing/selftests/bpf/test_xdp_veth.sh
+@@ -108,7 +108,7 @@ ip link set dev veth2 xdp pinned $BPF_DIR/progs/redirect_map_1
+ ip link set dev veth3 xdp pinned $BPF_DIR/progs/redirect_map_2
+
+ ip -n ns1 link set dev veth11 xdp obj xdp_dummy.o sec xdp_dummy
+-ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec tx
++ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec xdp
+ ip -n ns3 link set dev veth33 xdp obj xdp_dummy.o sec xdp_dummy
+
+ trap cleanup EXIT
+--
+2.30.2
+
--- /dev/null
+From eb97f473f35245286b5e1d434bfaf404a8ce054f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 21:18:27 -0600
+Subject: selftests: firmware: Fix ignored return val of asprintf() warn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit fe968ca2cac91888310b143a483123c84906e3fc ]
+
+Fix the following ingonred return val of asprintf() warn during
+build:
+
+cc -Wall -O2 fw_namespace.c -o ../tools/testing/selftests/firmware/fw_namespace
+fw_namespace.c: In function ‘main’:
+fw_namespace.c:132:2: warning: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
+ 132 | asprintf(&fw_path, "/lib/firmware/%s", fw_name);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20210708031827.51293-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/firmware/fw_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/firmware/fw_namespace.c b/tools/testing/selftests/firmware/fw_namespace.c
+index 0e393cb5f42d..4c6f0cd83c5b 100644
+--- a/tools/testing/selftests/firmware/fw_namespace.c
++++ b/tools/testing/selftests/firmware/fw_namespace.c
+@@ -129,7 +129,8 @@ int main(int argc, char **argv)
+ die("mounting tmpfs to /lib/firmware failed\n");
+
+ sys_path = argv[1];
+- asprintf(&fw_path, "/lib/firmware/%s", fw_name);
++ if (asprintf(&fw_path, "/lib/firmware/%s", fw_name) < 0)
++ die("error: failed to build full fw_path\n");
+
+ setup_fw(fw_path);
+
+--
+2.30.2
+
--- /dev/null
+From b314cc057e27bc83db9b3fa004279ee522cfd4a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 06:28:14 -0700
+Subject: selftests: nci: Fix the code for next nlattr offset
+
+From: Bongsu Jeon <bongsu.jeon@samsung.com>
+
+[ Upstream commit 78a7b2a8a0fa31f63ac16ac13601db6ed8259dfc ]
+
+nlattr could have a padding for 4 bytes alignment. So next nla's offset
+should be calculated with a padding.
+
+Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nci/nci_dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/nci/nci_dev.c b/tools/testing/selftests/nci/nci_dev.c
+index 57b505cb1561..9687100f15ea 100644
+--- a/tools/testing/selftests/nci/nci_dev.c
++++ b/tools/testing/selftests/nci/nci_dev.c
+@@ -113,8 +113,8 @@ static int send_cmd_mt_nla(int sd, __u16 nlmsg_type, __u32 nlmsg_pid,
+ if (nla_len > 0)
+ memcpy(NLA_DATA(na), nla_data[cnt], nla_len[cnt]);
+
+- msg.n.nlmsg_len += NLMSG_ALIGN(na->nla_len);
+- prv_len = na->nla_len;
++ prv_len = NLA_ALIGN(nla_len[cnt]) + NLA_HDRLEN;
++ msg.n.nlmsg_len += prv_len;
+ }
+
+ buf = (char *)&msg;
+--
+2.30.2
+
--- /dev/null
+From 3368564f4753a22ebd7104def9fbd361c07a92c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 06:28:15 -0700
+Subject: selftests: nci: Fix the wrong condition
+
+From: Bongsu Jeon <bongsu.jeon@samsung.com>
+
+[ Upstream commit 1d5b8d01db98abb8c176838fad73287366874582 ]
+
+memcpy should be executed only in case nla_len's value is greater than 0.
+
+Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nci/nci_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/nci/nci_dev.c b/tools/testing/selftests/nci/nci_dev.c
+index 9687100f15ea..acd4125ff39f 100644
+--- a/tools/testing/selftests/nci/nci_dev.c
++++ b/tools/testing/selftests/nci/nci_dev.c
+@@ -110,7 +110,7 @@ static int send_cmd_mt_nla(int sd, __u16 nlmsg_type, __u32 nlmsg_pid,
+ na->nla_type = nla_type[cnt];
+ na->nla_len = nla_len[cnt] + NLA_HDRLEN;
+
+- if (nla_len > 0)
++ if (nla_len[cnt] > 0)
+ memcpy(NLA_DATA(na), nla_data[cnt], nla_len[cnt]);
+
+ prv_len = NLA_ALIGN(nla_len[cnt]) + NLA_HDRLEN;
+--
+2.30.2
+
--- /dev/null
+From eeea454426d660465a310139ac50e4792b750865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jun 2021 06:11:51 +0200
+Subject: serial: 8250: Define RX trigger levels for OxSemi 950 devices
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+[ Upstream commit d7aff291d069c4418285f3c8ee27b0ff67ce5998 ]
+
+Oxford Semiconductor 950 serial port devices have a 128-byte FIFO and in
+the enhanced (650) mode, which we select in `autoconfig_has_efr' with
+the ECB bit set in the EFR register, they support the receive interrupt
+trigger level selectable with FCR bits 7:6 from the set of 16, 32, 112,
+120. This applies to the original OX16C950 discrete UART[1] as well as
+950 cores embedded into more complex devices.
+
+For these devices we set the default to 112, which sets an excessively
+high level of 112 or 7/8 of the FIFO capacity, unlike with other port
+types where we choose at most 1/2 of their respective FIFO capacities.
+Additionally we don't make the trigger level configurable. Consequently
+frequent input overruns happen with high bit rates where hardware flow
+control cannot be used (e.g. terminal applications) even with otherwise
+highly-performant systems.
+
+Lower the default receive interrupt trigger level to 32 then, and make
+it configurable. Document the trigger levels along with other port
+types, including the set of 16, 32, 64, 112 for the transmit interrupt
+as well[2].
+
+References:
+
+[1] "OX16C950 rev B High Performance UART with 128 byte FIFOs", Oxford
+ Semiconductor, Inc., DS-0031, Sep 05, Table 10: "Receiver Trigger
+ Levels", p. 22
+
+[2] same, Table 9: "Transmit Interrupt Trigger Levels", p. 22
+
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260608480.37803@angie.orcam.me.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 3 ++-
+ include/uapi/linux/serial_reg.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 1da29a219842..66374704747e 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -122,7 +122,8 @@ static const struct serial8250_config uart_config[] = {
+ .name = "16C950/954",
+ .fifo_size = 128,
+ .tx_loadsz = 128,
+- .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01,
++ .rxtrig_bytes = {16, 32, 112, 120},
+ /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
+ },
+diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h
+index be07b5470f4b..f51bc8f36813 100644
+--- a/include/uapi/linux/serial_reg.h
++++ b/include/uapi/linux/serial_reg.h
+@@ -62,6 +62,7 @@
+ * ST16C654: 8 16 56 60 8 16 32 56 PORT_16654
+ * TI16C750: 1 16 32 56 xx xx xx xx PORT_16750
+ * TI16C752: 8 16 56 60 8 16 32 56
++ * OX16C950: 16 32 112 120 16 32 64 112 PORT_16C950
+ * Tegra: 1 4 8 14 16 8 4 1 PORT_TEGRA
+ */
+ #define UART_FCR_R_TRIG_00 0x00
+--
+2.30.2
+
--- /dev/null
+From 0098db03ca4fbb9d118307e53a1963d8c1b5f9e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 13:35:33 +0300
+Subject: serial: 8250_omap: Handle optional overrun-throttle-ms property
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 1fe0e1fa3209ad8e9124147775bd27b1d9f04bd4 ]
+
+Handle optional overrun-throttle-ms property as done for 8250_fsl in commit
+6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during
+input overruns"). This can be used to rate limit the UART interrupts on
+noisy lines that end up producing messages like the following:
+
+ttyS ttyS2: 4 input overrun(s)
+
+At least on droid4, the multiplexed USB and UART port is left to UART mode
+by the bootloader for a debug console, and if a USB charger is connected
+on boot, we get noise on the UART until the PMIC related drivers for PHY
+and charger are loaded.
+
+With this patch and overrun-throttle-ms = <500> we avoid the extra rx
+interrupts.
+
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210727103533.51547-2-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 79418d4beb48..b6c731a267d2 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -617,7 +617,7 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ struct uart_port *port = dev_id;
+ struct omap8250_priv *priv = port->private_data;
+ struct uart_8250_port *up = up_to_u8250p(port);
+- unsigned int iir;
++ unsigned int iir, lsr;
+ int ret;
+
+ #ifdef CONFIG_SERIAL_8250_DMA
+@@ -628,6 +628,7 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ #endif
+
+ serial8250_rpm_get(up);
++ lsr = serial_port_in(port, UART_LSR);
+ iir = serial_port_in(port, UART_IIR);
+ ret = serial8250_handle_irq(port, iir);
+
+@@ -642,6 +643,24 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
+ serial_port_in(port, UART_RX);
+ }
+
++ /* Stop processing interrupts on input overrun */
++ if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
++ unsigned long delay;
++
++ up->ier = port->serial_in(port, UART_IER);
++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ port->ops->stop_rx(port);
++ } else {
++ /* Keep restarting the timer until
++ * the input overrun subsides.
++ */
++ cancel_delayed_work(&up->overrun_backoff);
++ }
++
++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
++ schedule_delayed_work(&up->overrun_backoff, delay);
++ }
++
+ serial8250_rpm_put(up);
+
+ return IRQ_RETVAL(ret);
+@@ -1353,6 +1372,10 @@ static int omap8250_probe(struct platform_device *pdev)
+ }
+ }
+
++ if (of_property_read_u32(np, "overrun-throttle-ms",
++ &up.overrun_backoff_time_ms) != 0)
++ up.overrun_backoff_time_ms = 0;
++
+ priv->wakeirq = irq_of_parse_and_map(np, 1);
+
+ pdata = of_device_get_match_data(&pdev->dev);
+--
+2.30.2
+
--- /dev/null
+From 03417c0c1857616e580577639ab69b33372d50ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 15:07:17 +0200
+Subject: serial: 8250_pci: make setup_port() parameters explicitly unsigned
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 3a96e97ab4e835078e6f27b7e1c0947814df3841 ]
+
+The bar and offset parameters to setup_port() are used in pointer math,
+and while it would be very difficult to get them to wrap as a negative
+number, just be "safe" and make them unsigned so that static checkers do
+not trip over them unintentionally.
+
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Reported-by: Jordy Zomer <jordy@pwning.systems>
+Link: https://lore.kernel.org/r/20210726130717.2052096-1-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index a808c283883e..726912b16a55 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -87,7 +87,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
+
+ static int
+ setup_port(struct serial_private *priv, struct uart_8250_port *port,
+- int bar, int offset, int regshift)
++ u8 bar, unsigned int offset, int regshift)
+ {
+ struct pci_dev *dev = priv->dev;
+
+--
+2.30.2
+
--- /dev/null
+From 74b4d12a8846a3dfb11ea88a67d7db666c5733c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 15:59:43 +0300
+Subject: serial: max310x: Use clock-names property matching to recognize
+ EXTCLK
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3d1fa055ea7298345795b982de7a5b9ec6ae238d ]
+
+Dennis reported that on ACPI-based systems the clock frequency
+isn't enough to configure device properly. We have to respect
+the clock source as well. To achieve this match the clock-names
+property against "osc" to recognize external clock connection.
+On DT-based system this doesn't change anything.
+
+Reported-and-tested-by: Dennis Giaya <dgiaya@whoi.edu>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210723125943.22039-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index ef11860cd69e..3df0788ddeb0 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1271,18 +1271,13 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty
+ /* Always ask for fixed clock rate from a property. */
+ device_property_read_u32(dev, "clock-frequency", &uartclk);
+
+- s->clk = devm_clk_get_optional(dev, "osc");
++ xtal = device_property_match_string(dev, "clock-names", "osc") < 0;
++ if (xtal)
++ s->clk = devm_clk_get_optional(dev, "xtal");
++ else
++ s->clk = devm_clk_get_optional(dev, "osc");
+ if (IS_ERR(s->clk))
+ return PTR_ERR(s->clk);
+- if (s->clk) {
+- xtal = false;
+- } else {
+- s->clk = devm_clk_get_optional(dev, "xtal");
+- if (IS_ERR(s->clk))
+- return PTR_ERR(s->clk);
+-
+- xtal = true;
+- }
+
+ ret = clk_prepare_enable(s->clk);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From d5113b8bd6bc48998cf30b711afb8ef04b5c7cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 18:22:01 +0200
+Subject: serial: sh-sci: fix break handling for sysrq
+
+From: Ulrich Hecht <uli+renesas@fpond.eu>
+
+[ Upstream commit 87b8061bad9bd4b549b2daf36ffbaa57be2789a2 ]
+
+This fixes two issues that cause the sysrq sequence to be inadvertently
+aborted on SCIF serial consoles:
+
+- a NUL character remains in the RX queue after a break has been detected,
+ which is then passed on to uart_handle_sysrq_char()
+- the break interrupt is handled twice on controllers with multiplexed ERI
+ and BRI interrupts
+
+Signed-off-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Link: https://lore.kernel.org/r/20210816162201.28801-1-uli+renesas@fpond.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 07eb56294371..89ee43061d3a 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1758,6 +1758,10 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr)
+
+ /* Handle BREAKs */
+ sci_handle_breaks(port);
++
++ /* drop invalid character received before break was detected */
++ serial_port_in(port, SCxRDR);
++
+ sci_clear_SCxSR(port, SCxSR_BREAK_CLEAR(port));
+
+ return IRQ_HANDLED;
+@@ -1837,7 +1841,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
+ ret = sci_er_interrupt(irq, ptr);
+
+ /* Break Interrupt */
+- if ((ssr_status & SCxSR_BRK(port)) && err_enabled)
++ if (s->irqs[SCIx_ERI_IRQ] != s->irqs[SCIx_BRI_IRQ] &&
++ (ssr_status & SCxSR_BRK(port)) && err_enabled)
+ ret = sci_br_interrupt(irq, ptr);
+
+ /* Overrun Interrupt */
+--
+2.30.2
+
pci-aardvark-fix-checking-for-pio-status.patch
pci-aardvark-increase-polling-delay-to-1.5s-while-waiting-for-pio-response.patch
pci-aardvark-fix-masking-and-unmasking-legacy-intx-interrupts.patch
+f2fs-compress-fix-to-set-zstd-compress-level-correct.patch
+rdma-rtrs-move-wr_cnt-from-rtrs_srv_con-to-rtrs_con.patch
+rdma-rtrs-enable-the-same-selective-signal-for-heart.patch
+rdma-rtrs-move-sq_wr_avail-to-rtrs_con.patch
+hid-input-do-not-report-stylus-battery-state-as-full.patch
+clk-renesas-rzg2l-fix-off-by-one-check-in-rzg2l_cpg_.patch
+f2fs-quota-fix-potential-deadlock.patch
+pinctrl-armada-37xx-correct-pwm-pins-definitions.patch
+scsi-bsg-remove-support-for-scsi_ioctl_send_command.patch
+clk-rockchip-drop-grf-dependency-for-rk3328-rk3036-p.patch
+ib-hfi1-adjust-pkey-entry-in-index-0.patch
+rdma-iwcm-release-resources-if-iw_cm-module-initiali.patch
+docs-fix-infiniband-uverbs-minor-number.patch
+scsi-buslogic-use-x-for-u32-sized-integer-rather-tha.patch
+pinctrl-samsung-fix-pinctrl-bank-pin-count.patch
+f2fs-do-not-submit-new_addr-to-read-node-block.patch
+f2fs-turn-back-remapped-address-in-compressed-page-e.patch
+f2fs-fix-wrong-checkpoint_changed-value-in-f2fs_remo.patch
+vfio-use-config-not-menuconfig-for-vfio_noiommu.patch
+scsi-ufs-fix-memory-corruption-by-ufshcd_read_desc_p.patch
+scsi-ufs-use-declare_completion_onstack-where-approp.patch
+scsi-ufs-fix-the-scsi-abort-handler.patch
+cpuidle-pseries-fixup-cede0-latency-only-for-power10.patch
+powerpc-stacktrace-include-linux-delay.h.patch
+rdma-hns-don-t-overwrite-supplied-qp-attributes.patch
+rdma-efa-remove-double-qp-type-assignment.patch
+rdma-mlx5-delete-not-available-udata-check.patch
+cpuidle-pseries-mark-pseries_idle_proble-as-__init.patch
+f2fs-reduce-the-scope-of-setting-fsck-tag-when-de-na.patch
+openrisc-don-t-printk-unconditionally.patch
+dma-debug-fix-debugfs-initialization-order.patch
+xprtrdma-put-rpcrdma_reps-before-waking-the-tear-dow.patch
+nfsv4-pnfs-fix-a-layoutget-livelock-loop.patch
+nfsv4-pnfs-always-allow-update-of-a-zero-valued-layo.patch
+nfsv4-pnfs-the-layout-barrier-indicate-a-minimal-val.patch
+sunrpc-fix-potential-memory-corruption.patch
+sunrpc-xprtrdma-fix-reconnection-locking.patch
+sunrpc-fix-return-value-of-get_srcport.patch
+scsi-ufs-fix-unsigned-int-compared-with-less-than-ze.patch
+scsi-ufshcd-fix-device-links-when-boot-wlun-fails-to.patch
+scsi-fdomain-fix-error-return-code-in-fdomain_probe.patch
+pinctrl-single-fix-error-return-code-in-pcs_parse_bi.patch
+powerpc-numa-consider-the-max-numa-node-for-migratab.patch
+vfio-mbochs-fix-missing-error-unwind-of-mbochs_used_.patch
+platform-x86-isst-fix-optimization-with-use-of-numa.patch
+scsi-smartpqi-fix-an-error-code-in-pqi_get_raid_map.patch
+scsi-qedi-fix-error-codes-in-qedi_alloc_global_queue.patch
+scsi-qedf-fix-error-codes-in-qedf_alloc_global_queue.patch
+powerpc-config-fix-ipv6-warning-in-mpc855_ads.patch
+powerpc-config-renable-mtd_physmap_of.patch
+f2fs-fix-to-keep-compatibility-of-fault-injection-in.patch
+iommu-vt-d-update-the-virtual-command-related-regist.patch
+rdma-hns-fix-return-in-hns_roce_rereg_user_mr.patch
+hid-amd_sfh-fix-period-data-field-to-enable-sensor.patch
+hid-i2c-hid-fix-elan-touchpad-regression.patch
+hid-thrustmaster-clean-up-makefile-and-adapt-quirks.patch
+rdma-hns-ownerbit-mode-add-control-field.patch
+clk-imx8mm-use-correct-mux-type-for-clkout-path.patch
+clk-imx8m-fix-clock-tree-update-of-tf-a-managed-cloc.patch
+kvm-ppc-book3s-hv-fix-copy_tofrom_guest-routines.patch
+scsi-ufs-ufs-exynos-fix-static-checker-warning.patch
+kvm-ppc-book3s-hv-nested-reflect-guest-pmu-in-use-to.patch
+powerpc-perf-fix-the-check-for-siar-value.patch
+rdma-hns-fix-incorrect-lsn-field.patch
+rdma-hns-bugfix-for-data-type-of-dip_idx.patch
+rdma-hns-bugfix-for-the-missing-assignment-for-dip_i.patch
+rdma-hns-bugfix-for-incorrect-association-between-di.patch
+platform-x86-dell-smbios-wmi-add-missing-kfree-in-er.patch
+powerpc-smp-fix-a-crash-while-booting-kvm-guest-with.patch
+powerpc-smp-update-cpu_core_map-on-all-powerpc-syste.patch
+rdma-hns-fix-query-destination-qpn.patch
+rdma-hns-fix-qp-s-resp-incomplete-assignment.patch
+fscache-fix-cookie-key-hashing.patch
+clk-ralink-avoid-to-set-clk_is_critical-flag-for-gat.patch
+clk-at91-clk-generated-limit-the-requested-rate-to-o.patch
+kvm-ppc-fix-clearing-never-mapped-tces-in-realmode.patch
+soc-mediatek-cmdq-add-address-shift-in-jump.patch
+f2fs-fix-to-account-missing-.skipped_gc_rwsem.patch
+f2fs-fix-unexpected-enoent-comes-from-f2fs_map_block.patch
+f2fs-fix-to-unmap-pages-from-userspace-process-in-pu.patch
+f2fs-deallocate-compressed-pages-when-error-happens.patch
+f2fs-should-put-a-page-beyond-eof-when-preparing-a-w.patch
+mips-malta-fix-alignment-of-the-devicetree-buffer.patch
+kbuild-fix-no-symbols-warning-when-config_trim_unusd.patch
+userfaultfd-prevent-concurrent-api-initialization.patch
+drm-vmwgfx-fix-subresource-updates-with-new-contexts.patch
+drm-vmwgfx-fix-some-static-checker-warnings.patch
+drm-vc4-hdmi-set-hd_ctl_wholsmp-and-hd_ctl_chalign_s.patch
+drm-ttm-fix-multihop-assert-on-eviction.patch
+drm-omap-follow-implicit-fencing-in-prepare_fb.patch
+drm-amdgpu-fix-amdgpu_ras_eeprom_init.patch
+drm-amdgpu-fix-koops-when-accessing-ras-eeprom.patch
+drm-vc4-fix-pixel-wrap-issue-with-dvp-teardown.patch
+dma-buf-fix-dma_resv_test_signaled-test_all-handling.patch
+drm-panel-fix-up-dt-bindings-for-samsung-lms397kf04.patch
+asoc-ti-davinci-mcasp-fix-dit-mode-support.patch
+asoc-atmel-atmel-drivers-don-t-need-has_dma.patch
+media-dib8000-rewrite-the-init-prbs-logic.patch
+media-ti-vpe-cal-fix-error-handling-in-cal_camerarx_.patch
+media-ti-vpe-cal-fix-queuing-of-the-initial-buffer.patch
+libbpf-fix-reuse-of-pinned-map-on-older-kernel.patch
+drm-vkms-let-shadow-plane-helpers-prepare-the-plane-.patch
+x86-hyperv-fix-for-unwanted-manipulation-of-sched_cl.patch
+crypto-mxs-dcp-use-sg_mapping_iter-to-copy-data.patch
+pci-use-pci_update_current_state-in-pci_enable_devic.patch
+tipc-keep-the-skb-in-rcv-queue-until-the-whole-data-.patch
+net-phy-fix-data-type-in-dp83822-dp8382x_disable_wol.patch
+iio-dac-ad5624r-fix-incorrect-handling-of-an-optiona.patch
+iavf-do-not-override-the-adapter-state-in-the-watchd.patch
+iavf-fix-locking-of-critical-sections.patch
+arm-dts-qcom-apq8064-correct-clock-names.patch
+video-fbdev-kyro-fix-a-dos-bug-by-restricting-user-i.patch
+drm-ast-disable-fast-reset-after-dram-initial.patch
+netlink-deal-with-esrch-error-in-nlmsg_notify.patch
+arm64-dts-qcom-fix-usb-entries-for-sa8155p-adp-board.patch
+net-ipa-fix-ipa-v4.11-interconnect-data.patch
+smack-fix-wrong-semantics-in-smk_access_entry.patch
+drm-avoid-blocking-in-drm_clients_info-s-rcu-section.patch
+drm-serialize-drm_file.master-with-a-new-spinlock.patch
+drm-protect-drm_master-pointers-in-drm_lease.c.patch
+rcu-fix-macro-name-config_tasks_rcu_trace.patch
+igc-check-if-num-of-q_vectors-is-smaller-than-max-be.patch
+usb-host-fotg210-fix-the-endpoint-s-transactional-op.patch
+usb-host-fotg210-fix-the-actual_length-of-an-iso-pac.patch
+usb-gadget-u_ether-fix-a-potential-null-pointer-dere.patch
+usb-ehci-ehci-mv-improve-error-handling-in-mv_ehci_e.patch
+usb-gadget-composite-allow-bmaxpower-0-if-self-power.patch
+staging-board-fix-uninitialized-spinlock-when-attach.patch
+staging-hisilicon-hi6421-spmi-pmic.yaml-fix-patternp.patch
+tty-serial-jsm-hold-port-lock-when-reporting-modem-l.patch
+bus-fsl-mc-fix-arg-in-call-to-dprc_scan_objects.patch
+bus-fsl-mc-fix-mmio-base-address-for-child-dprcs.patch
+misc-pvpanic-pci-allow-automatic-loading.patch
+selftests-firmware-fix-ignored-return-val-of-asprint.patch
+drm-amd-display-fix-timer_per_pixel-unit-error.patch
+media-hantro-vp8-move-noisy-warn_on-to-vpu_debug.patch
+media-platform-stm32-unprepare-clocks-at-handling-er.patch
+media-atomisp-fix-runtime-pm-imbalance-in-atomisp_pc.patch
+media-atomisp-pci-fix-error-return-code-in-atomisp_p.patch
+nfp-fix-return-statement-in-nfp_net_parse_meta.patch
+spi-imx-fix-err009165.patch
+spi-imx-remove-err009165-workaround-on-i.mx6ul.patch
+ethtool-improve-compat-ioctl-handling.patch
+drm-amd-display-fixed-hardware-power-down-bypass-dur.patch
+drm-amdgpu-fix-a-printing-message.patch
+drm-amd-amdgpu-update-debugfs-link_settings-output-l.patch
+bpf-tests-fix-copy-and-paste-error-in-double-word-te.patch
+bpf-tests-do-not-pass-tests-without-actually-testing.patch
+drm-bridge-nwl-dsi-avoid-potential-multiplication-ov.patch
+arm64-dts-allwinner-h6-tanix-tx6-fix-regulator-node-.patch
+video-fbdev-asiliantfb-error-out-if-pixclock-equals-.patch
+video-fbdev-kyro-error-out-if-pixclock-equals-zero.patch
+video-fbdev-riva-error-out-if-pixclock-equals-zero.patch
+net-ipa-fix-ipa_cmd_table_valid.patch
+net-ipa-always-validate-filter-and-route-tables.patch
+ipv4-ip_output.c-fix-out-of-bounds-warning-in-ip_cop.patch
+flow_dissector-fix-out-of-bounds-warnings.patch
+s390-jump_label-print-real-address-in-a-case-of-a-ju.patch
+s390-make-pci-mio-support-a-machine-flag.patch
+serial-8250-define-rx-trigger-levels-for-oxsemi-950-.patch
+serial-max310x-use-clock-names-property-matching-to-.patch
+xtensa-iss-don-t-panic-in-rs_init.patch
+hvsi-don-t-panic-on-tty_register_driver-failure.patch
+serial-8250_pci-make-setup_port-parameters-explicitl.patch
+vt-keyboard.c-make-console-an-unsigned-int.patch
+staging-ks7010-fix-the-initialization-of-the-sleep_s.patch
+drm-amd-display-fix-psr-command-version.patch
+samples-bpf-fix-tracex7-error-raised-on-the-missing-.patch
+libbpf-fix-race-when-pinning-maps-in-parallel.patch
+ata-sata_dwc_460ex-no-need-to-call-phy_exit-befre-ph.patch
+drm-rcar-du-shutdown-the-display-on-system-shutdown.patch
+bluetooth-skip-invalid-hci_sync_conn_complete_evt.patch
+workqueue-fix-possible-memory-leaks-in-wq_numa_init.patch
+arm-dts-stm32-set-bitclock-frame-master-phandles-on-.patch
+arm-dts-stm32-set-bitclock-frame-master-phandles-on-.patch-5435
+arm-dts-stm32-update-av96-adv7513-node-per-dtbs_chec.patch
+drm-msm-a6xx-fix-llcc-configuration-for-a660-gpu.patch
+netfilter-nft_compat-use-nfnetlink_unicast.patch
+bonding-3ad-fix-the-concurrency-between-__bond_relea.patch
+arm-dts-at91-use-the-right-property-for-shutdown-con.patch
+arm64-tegra-fix-tegra194-pcie-ep-compatible-string.patch
+asoc-intel-bytcr_rt5640-move-platform-clock-routes-t.patch
+bpf-fix-off-by-one-in-tail-call-count-limiting.patch
+asoc-intel-update-sof_pcm512x-quirks.patch
+bluetooth-fix-not-generating-rpa-when-required.patch
+dpaa2-switch-do-not-enable-the-dpsw-at-probe-time.patch
+media-imx258-rectify-mismatch-of-vts-value.patch
+media-imx258-limit-the-max-analogue-gain-to-480.patch
+media-imx-imx7-media-csi-fix-buffer-return-upon-stre.patch
+media-v4l2-dv-timings.c-fix-wrong-condition-in-two-f.patch
+media-tda1997x-fix-tda1997x_query_dv_timings-return-.patch
+media-tegra-cec-handle-errors-of-clk_prepare_enable.patch
+gfs2-fix-glock-recursion-in-freeze_go_xmote_bh.patch
+arm64-dts-qcom-sdm630-rewrite-memory-map.patch
+arm64-dts-qcom-sdm630-fix-tlmm-node-and-pinctrl-conf.patch
+net-ipa-fix-ipa-v4.9-interconnects.patch
+serial-8250_omap-handle-optional-overrun-throttle-ms.patch
+misc-sram-only-map-reserved-areas-in-tegra-sysram.patch
+arm-dts-imx53-ppd-fix-achc-entry.patch
+arm64-dts-qcom-ipq8074-fix-pci-node-reg-property.patch
+arm64-dts-qcom-sdm660-use-reg-value-for-memory-node.patch
+arm64-dts-qcom-ipq6018-drop-0x-from-unit-address.patch
+arm64-dts-qcom-sdm630-don-t-use-underscore-in-node-n.patch
+arm64-dts-qcom-msm8994-don-t-use-underscore-in-node-.patch
+arm64-dts-qcom-msm8996-don-t-use-underscore-in-node-.patch
+arm64-dts-qcom-sm8250-fix-epss_l3-unit-address.patch
+nvmem-qfprom-fix-up-qfprom_disable_fuse_blowing-orde.patch
+net-ethernet-stmmac-do-not-use-unreachable-in-ipq806.patch
+drm-msm-mdp4-drop-vblank-get-put-from-prepare-comple.patch
+drm-msm-dsi-fix-dsi-and-dsi-phy-regulator-config-fro.patch
+drm-xlnx-zynqmp_dpsub-call-pm_runtime_get_sync-befor.patch
+drm-xlnx-zynqmp-release-reset-to-dp-controller-befor.patch
+arm-dts-ixp4xx-fix-up-bad-interrupt-flags.patch
+thunderbolt-fix-port-linking-by-checking-all-adapter.patch
+drm-amd-display-fix-missing-writeback-disablement-if.patch
+drm-amd-display-fix-incorrect-cm-tf-programming-sequ.patch
+selftests-bpf-fix-xdp_tx.c-prog-section-name.patch
+drm-vmwgfx-fix-potential-uaf-in-vmwgfx_surface.c.patch
+staging-rtl8723bs-fix-right-side-of-condition.patch
+bluetooth-schedule-sco-timeouts-with-delayed_work.patch
+bluetooth-avoid-circular-locks-in-sco_sock_connect.patch
+drm-msm-dp-reduce-link-rate-if-failed-at-link-traini.patch
+drm-msm-dp-reset-aux-controller-after-dp_aux_cmd_fif.patch
+drm-msm-dp-return-correct-edid-checksum-after-corrup.patch
+drm-msm-dp-do-not-end-dp-link-training-until-video-i.patch
+net-mlx5-fix-variable-type-to-match-64bit.patch
+gpu-drm-amd-amdgpu-amdgpu_i2c-fix-possible-uninitial.patch
+drm-display-fix-possible-null-pointer-dereference-in.patch
+mac80211-fix-monitor-mtu-limit-so-that-a-msdus-get-t.patch
+arm-tegra-acer-a500-remove-bogus-usb-vbus-regulators.patch
+arm-tegra-tamonten-fix-uart-pad-setting.patch
+arm64-tegra-fix-compatible-string-for-tegra132-cpus.patch
+arm64-dts-imx8mm-venice-gw700x-fix-mp5416-pmic-confi.patch
+arm64-dts-imx8mm-venice-gw700x-fix-invalid-pmic-pin-.patch
+arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
+arm64-dts-ls1046a-fix-eeprom-entries.patch
+nvme-tcp-don-t-check-blk_mq_tag_to_rq-when-receiving.patch
+nvme-code-command_id-with-a-genctr-for-use-after-fre.patch
+bluetooth-fix-handling-of-le-enhanced-connection-com.patch
+bluetooth-fix-race-condition-in-handling-nop-command.patch
+opp-don-t-print-an-error-if-required-opps-is-missing.patch
+serial-sh-sci-fix-break-handling-for-sysrq.patch
+iomap-pass-writeback-errors-to-the-mapping.patch
+tcp-enable-data-less-empty-cookie-syn-with-tfo_serve.patch
+locking-rtmutex-set-proper-wait-context-for-lockdep.patch
+rpc-fix-gss_svc_init-cleanup-on-failure.patch
+iavf-use-mutexes-for-locking-of-critical-sections.patch
+selftests-bpf-correctly-display-subtest-skip-status.patch
+selftests-bpf-fix-flaky-send_signal-test.patch
+hwmon-pmbus-ibm-cffps-fix-write-bits-for-led-control.patch
+staging-rts5208-fix-get_ms_information-heap-buffer-s.patch
+selftests-nci-fix-the-code-for-next-nlattr-offset.patch
+selftests-nci-fix-the-wrong-condition.patch
+net-fix-offloading-indirect-devices-dependency-on-qd.patch
+kselftest-arm64-mte-fix-misleading-output-when-skipp.patch
+kselftest-arm64-pac-fix-skipping-of-tests-on-systems.patch
+asoc-rsnd-adg-clearly-handle-clock-error-null-case.patch
+gfs2-don-t-call-dlm-after-protocol-is-unmounted.patch
+usb-chipidea-host-fix-port-index-underflow-and-ubsan.patch
+lockd-lockd-server-side-shouldn-t-set-fl_ops.patch
+drm-exynos-always-initialize-mapping-in-exynos_drm_r.patch
+rtl8xxxu-fix-the-handling-of-tx-a-mpdu-aggregation.patch
+rtw88-use-read_poll_timeout-instead-of-fixed-sleep.patch
+rtw88-wow-build-wow-function-only-if-config_pm-is-on.patch
+rtw88-wow-fix-size-access-error-of-probe-request.patch
+octeontx2-pf-fix-nix1_rx-interface-backpressure.patch
+m68knommu-only-set-config_isa_dma_api-for-coldfire-s.patch
+btrfs-remove-racy-and-unnecessary-inode-transaction-.patch
+btrfs-tree-log-check-btrfs_lookup_data_extent-return.patch
+soundwire-intel-fix-potential-race-condition-during-.patch
+asoc-intel-skylake-fix-module-configuration-for-kpb-.patch
+asoc-intel-skylake-fix-passing-loadable-flag-for-mod.patch
+of-don-t-allow-__of_attached_node_sysfs-without-conf.patch
+mmc-sdhci-of-arasan-modified-sd-default-speed-to-19m.patch
+mmc-sdhci-of-arasan-check-return-value-of-non-void-f.patch
+mmc-core-avoid-hogging-the-cpu-while-polling-for-bus.patch
+mmc-core-avoid-hogging-the-cpu-while-polling-for-bus.patch-6438
+mmc-core-avoid-hogging-the-cpu-while-polling-for-bus.patch-32247
+mmc-rtsx_pci-fix-long-reads-when-clock-is-prescaled.patch
+selftests-bpf-enlarge-select-timeout-for-test_maps.patch
+mmc-core-return-correct-emmc-response-in-case-of-ioc.patch
+octeontx2-pf-cleanup-transmit-link-deriving-logic.patch
+samples-pktgen-fix-to-print-when-terminated-normally.patch
+cifs-fix-wrong-release-in-sess_alloc_buffer-failed-p.patch
+revert-usb-xhci-fix-u1-u2-handling-for-hardware-with.patch
+usb-dwc3-imx8mp-request-irq-after-initializing-dwc3.patch
+usb-musb-musb_dsps-request_irq-after-initializing-mu.patch
+usbip-give-back-urbs-for-unsent-unlink-requests-duri.patch
+usbip-vhci_hcd-usb-port-can-get-stuck-in-the-disable.patch
+usb-xhci-mtk-fix-use-after-free-of-mtk-hcd.patch
+usb-xhci-mtk-do-not-use-xhci-s-virt_dev-in-drop_endp.patch
+asoc-rockchip-i2s-fix-regmap_ops-hang.patch
+asoc-rockchip-i2s-fixup-config-for-daifmt_dsp_a-b.patch
+asoc-soc-pcm-protect-be-dailink-state-changes-in-tri.patch
+drm-amdkfd-account-for-sh-se-count-when-setting-up-c.patch
+nfs-don-t-atempt-blocking-locks-on-nfs-reexports.patch
+nfsd-fix-crash-on-lockt-on-reexported-nfsv3.patch
+iwlwifi-pcie-free-rbs-during-configure.patch
+iwlwifi-mvm-do-not-use-full-ssids-in-6ghz-scan.patch
+iwlwifi-mvm-fix-a-memory-leak-in-iwl_mvm_mac_ctxt_be.patch
+iwlwifi-mvm-avoid-static-queue-number-aliasing.patch
+iwlwifi-mvm-fix-umac-scan-request-probe-parameters.patch
+iwlwifi-mvm-fix-access-to-bss-elements.patch
+iwlwifi-fw-correctly-limit-to-monitor-dump.patch
+iwlwifi-mvm-don-t-schedule-the-roc_done_wk-if-it-is-.patch
+iwlwifi-mvm-fix-scan-channel-flags-settings.patch
+net-mlx5-dr-fix-a-potential-use-after-free-bug.patch
+net-mlx5-dr-enable-qp-retransmission.patch
+usb-isp1760-fix-memory-pool-initialization.patch
+usb-isp1760-fix-qtd-fill-length.patch
+usb-isp1760-write-to-status-and-address-register.patch
+usb-isp1760-use-the-right-irq-status-bit.patch
+usb-isp1760-otg-control-register-access.patch
+parport-remove-non-zero-check-on-count.patch
+selftests-bpf-fix-potential-unreleased-lock.patch
+wcn36xx-fix-missing-frame-timestamp-for-beacon-probe.patch
+ath9k-fix-oob-read-ar9300_eeprom_restore_internal.patch
+ath9k-fix-sleeping-in-atomic-context.patch
+net-fix-null-pointer-reference-in-cipso_v4_doi_free.patch
+fix-array-index-out-of-bounds-in-taprio_change.patch
+net-w5100-check-return-value-after-calling-platform_.patch
+net-hns3-clean-up-a-type-mismatch-warning.patch
--- /dev/null
+From 375f813cf06f64d3eba18a29cd88541ec6b42e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 17:17:24 +0800
+Subject: Smack: Fix wrong semantics in smk_access_entry()
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]
+
+In the smk_access_entry() function, if no matching rule is found
+in the rust_list, a negative error code will be used to perform bit
+operations with the MAY_ enumeration value. This is semantically
+wrong. This patch fixes this issue.
+
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack_access.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index 1f391f6a3d47..d2186e2757be 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;
+ int smk_access_entry(char *subject_label, char *object_label,
+ struct list_head *rule_list)
+ {
+- int may = -ENOENT;
+ struct smack_rule *srp;
+
+ list_for_each_entry_rcu(srp, rule_list, list) {
+ if (srp->smk_object->smk_known == object_label &&
+ srp->smk_subject->smk_known == subject_label) {
+- may = srp->smk_access;
+- break;
++ int may = srp->smk_access;
++ /*
++ * MAY_WRITE implies MAY_LOCK.
++ */
++ if ((may & MAY_WRITE) == MAY_WRITE)
++ may |= MAY_LOCK;
++ return may;
+ }
+ }
+
+- /*
+- * MAY_WRITE implies MAY_LOCK.
+- */
+- if ((may & MAY_WRITE) == MAY_WRITE)
+- may |= MAY_LOCK;
+- return may;
++ return -ENOENT;
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 5820d7a229293296bec75bd2564eb7840e5a0575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 15:52:26 +0800
+Subject: soc: mediatek: cmdq: add address shift in jump
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 8b60ed2b1674b78ebc433a11efa7d48821229037 ]
+
+Add address shift when compose jump instruction
+to compatible with 35bit format.
+
+Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index 67a42b514429..4f907e8f3894 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -168,7 +168,8 @@ static void cmdq_task_insert_into_thread(struct cmdq_task *task)
+ dma_sync_single_for_cpu(dev, prev_task->pa_base,
+ prev_task->pkt->cmd_buf_size, DMA_TO_DEVICE);
+ prev_task_base[CMDQ_NUM_CMD(prev_task->pkt) - 1] =
+- (u64)CMDQ_JUMP_BY_PA << 32 | task->pa_base;
++ (u64)CMDQ_JUMP_BY_PA << 32 |
++ (task->pa_base >> task->cmdq->shift_pa);
+ dma_sync_single_for_device(dev, prev_task->pa_base,
+ prev_task->pkt->cmd_buf_size, DMA_TO_DEVICE);
+
+--
+2.30.2
+
--- /dev/null
+From 011d91528afc73f32119aafce98881e4b3a27159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:49:52 +0800
+Subject: soundwire: intel: fix potential race condition during power down
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit ea6942dad4b2a7e1735aa0f10f3d0b04b847750f ]
+
+The power down sequence sets the link_up flag as false outside of the
+mutex_lock. This is potentially unsafe.
+
+In additional the flow in that sequence can be improved by first
+testing if the link was powered, setting the link_up flag as false and
+proceeding with the power down. In case the CPA bits cannot be
+cleared, we only flag an error since we cannot deal with interrupts
+any longer.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210818024954.16873-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index c11e3d8cd308..f156de765c68 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -537,12 +537,14 @@ static int intel_link_power_down(struct sdw_intel *sdw)
+
+ mutex_lock(sdw->link_res->shim_lock);
+
+- intel_shim_master_ip_to_glue(sdw);
+-
+ if (!(*shim_mask & BIT(link_id)))
+ dev_err(sdw->cdns.dev,
+ "%s: Unbalanced power-up/down calls\n", __func__);
+
++ sdw->cdns.link_up = false;
++
++ intel_shim_master_ip_to_glue(sdw);
++
+ *shim_mask &= ~BIT(link_id);
+
+ if (!*shim_mask) {
+@@ -559,18 +561,19 @@ static int intel_link_power_down(struct sdw_intel *sdw)
+ link_control &= spa_mask;
+
+ ret = intel_clear_bit(shim, SDW_SHIM_LCTL, link_control, cpa_mask);
++ if (ret < 0) {
++ dev_err(sdw->cdns.dev, "%s: could not power down link\n", __func__);
++
++ /*
++ * we leave the sdw->cdns.link_up flag as false since we've disabled
++ * the link at this point and cannot handle interrupts any longer.
++ */
++ }
+ }
+
+ mutex_unlock(sdw->link_res->shim_lock);
+
+- if (ret < 0) {
+- dev_err(sdw->cdns.dev, "%s: could not power down link\n", __func__);
+-
+- return ret;
+- }
+-
+- sdw->cdns.link_up = false;
+- return 0;
++ return ret;
+ }
+
+ static void intel_shim_sync_arm(struct sdw_intel *sdw)
+--
+2.30.2
+
--- /dev/null
+From e69d0655765eb8d57db75369faff9e63dd44507b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 18:20:47 +0800
+Subject: spi: imx: fix ERR009165
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 980f884866eed4dda2a18de888c5a67dde67d640 ]
+
+Change to XCH mode even in dma mode, please refer to the below
+errata:
+https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf
+
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index fa68e9817929..d89b11205815 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -622,8 +622,8 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
+ ctrl |= mx51_ecspi_clkdiv(spi_imx, spi_imx->spi_bus_clk, &clk);
+ spi_imx->spi_bus_clk = clk;
+
+- if (spi_imx->usedma)
+- ctrl |= MX51_ECSPI_CTRL_SMC;
++ /* ERR009165: work in XHC mode as PIO */
++ ctrl &= ~MX51_ECSPI_CTRL_SMC;
+
+ writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL);
+
+@@ -637,7 +637,7 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ * and enable DMA request.
+ */
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+- MX51_ECSPI_DMA_TX_WML(spi_imx->wml) |
++ MX51_ECSPI_DMA_TX_WML(0) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+ MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+@@ -1253,10 +1253,6 @@ static int spi_imx_sdma_init(struct device *dev, struct spi_imx_data *spi_imx,
+ {
+ int ret;
+
+- /* use pio mode for i.mx6dl chip TKT238285 */
+- if (of_machine_is_compatible("fsl,imx6dl"))
+- return 0;
+-
+ spi_imx->wml = spi_imx->devtype_data->fifo_size / 2;
+
+ /* Prepare for TX DMA: */
+--
+2.30.2
+
--- /dev/null
+From b7dcd66347e8fb1009218871650ec1cc157d1074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 18:20:48 +0800
+Subject: spi: imx: remove ERR009165 workaround on i.mx6ul
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 8eb1252bbedfb0e800bbbd3e9055a7db0ae2cac9 ]
+
+ERR009165 fixed on i.mx6ul/6ull/6sll. All other i.mx6/7 and
+i.mx8m/8mm still need this errata. Please refer to nxp official
+errata document from https://www.nxp.com/ .
+
+For removing workaround on those chips. Add new i.mx6ul type.
+
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 39 ++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 36 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index d89b11205815..289ed3d4eda2 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -77,6 +77,11 @@ struct spi_imx_devtype_data {
+ bool has_slavemode;
+ unsigned int fifo_size;
+ bool dynamic_burst;
++ /*
++ * ERR009165 fixed or not:
++ * https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf
++ */
++ bool tx_glitch_fixed;
+ enum spi_imx_devtype devtype;
+ };
+
+@@ -622,8 +627,14 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
+ ctrl |= mx51_ecspi_clkdiv(spi_imx, spi_imx->spi_bus_clk, &clk);
+ spi_imx->spi_bus_clk = clk;
+
+- /* ERR009165: work in XHC mode as PIO */
+- ctrl &= ~MX51_ECSPI_CTRL_SMC;
++ /*
++ * ERR009165: work in XHC mode instead of SMC as PIO on the chips
++ * before i.mx6ul.
++ */
++ if (spi_imx->usedma && spi_imx->devtype_data->tx_glitch_fixed)
++ ctrl |= MX51_ECSPI_CTRL_SMC;
++ else
++ ctrl &= ~MX51_ECSPI_CTRL_SMC;
+
+ writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL);
+
+@@ -632,12 +643,16 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
+
+ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ {
++ u32 tx_wml = 0;
++
++ if (spi_imx->devtype_data->tx_glitch_fixed)
++ tx_wml = spi_imx->wml;
+ /*
+ * Configure the DMA register: setup the watermark
+ * and enable DMA request.
+ */
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+- MX51_ECSPI_DMA_TX_WML(0) |
++ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+ MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+@@ -1028,6 +1043,23 @@ static struct spi_imx_devtype_data imx53_ecspi_devtype_data = {
+ .devtype = IMX53_ECSPI,
+ };
+
++static struct spi_imx_devtype_data imx6ul_ecspi_devtype_data = {
++ .intctrl = mx51_ecspi_intctrl,
++ .prepare_message = mx51_ecspi_prepare_message,
++ .prepare_transfer = mx51_ecspi_prepare_transfer,
++ .trigger = mx51_ecspi_trigger,
++ .rx_available = mx51_ecspi_rx_available,
++ .reset = mx51_ecspi_reset,
++ .setup_wml = mx51_setup_wml,
++ .fifo_size = 64,
++ .has_dmamode = true,
++ .dynamic_burst = true,
++ .has_slavemode = true,
++ .tx_glitch_fixed = true,
++ .disable = mx51_ecspi_disable,
++ .devtype = IMX51_ECSPI,
++};
++
+ static const struct of_device_id spi_imx_dt_ids[] = {
+ { .compatible = "fsl,imx1-cspi", .data = &imx1_cspi_devtype_data, },
+ { .compatible = "fsl,imx21-cspi", .data = &imx21_cspi_devtype_data, },
+@@ -1036,6 +1068,7 @@ static const struct of_device_id spi_imx_dt_ids[] = {
+ { .compatible = "fsl,imx35-cspi", .data = &imx35_cspi_devtype_data, },
+ { .compatible = "fsl,imx51-ecspi", .data = &imx51_ecspi_devtype_data, },
+ { .compatible = "fsl,imx53-ecspi", .data = &imx53_ecspi_devtype_data, },
++ { .compatible = "fsl,imx6ul-ecspi", .data = &imx6ul_ecspi_devtype_data, },
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, spi_imx_dt_ids);
+--
+2.30.2
+
--- /dev/null
+From 23a0329ff7c34dc514fb0a718b89ec8fa9af60b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 12:13:46 +0200
+Subject: staging: board: Fix uninitialized spinlock when attaching genpd
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit df00609821bf17f50a75a446266d19adb8339d84 ]
+
+On Armadillo-800-EVA with CONFIG_DEBUG_SPINLOCK=y:
+
+ BUG: spinlock bad magic on CPU#0, swapper/1
+ lock: lcdc0_device+0x10c/0x308, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
+ CPU: 0 PID: 1 Comm: swapper Not tainted 5.11.0-rc5-armadillo-00036-gbbca04be7a80-dirty #287
+ Hardware name: Generic R8A7740 (Flattened Device Tree)
+ [<c010c3c8>] (unwind_backtrace) from [<c010a49c>] (show_stack+0x10/0x14)
+ [<c010a49c>] (show_stack) from [<c0159534>] (do_raw_spin_lock+0x20/0x94)
+ [<c0159534>] (do_raw_spin_lock) from [<c040858c>] (dev_pm_get_subsys_data+0x8c/0x11c)
+ [<c040858c>] (dev_pm_get_subsys_data) from [<c05fbcac>] (genpd_add_device+0x78/0x2b8)
+ [<c05fbcac>] (genpd_add_device) from [<c0412db4>] (of_genpd_add_device+0x34/0x4c)
+ [<c0412db4>] (of_genpd_add_device) from [<c0a1ea74>] (board_staging_register_device+0x11c/0x148)
+ [<c0a1ea74>] (board_staging_register_device) from [<c0a1eac4>] (board_staging_register_devices+0x24/0x28)
+
+of_genpd_add_device() is called before platform_device_register(), as it
+needs to attach the genpd before the device is probed. But the spinlock
+is only initialized when the device is registered.
+
+Fix this by open-coding the spinlock initialization, cfr.
+device_pm_init_common() in the internal drivers/base code, and in the
+SuperH early platform code.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/57783ece7ddae55f2bda2f59f452180bff744ea0.1626257398.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/board/board.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c
+index cb6feb34dd40..f980af037345 100644
+--- a/drivers/staging/board/board.c
++++ b/drivers/staging/board/board.c
+@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)
+ static int board_staging_add_dev_domain(struct platform_device *pdev,
+ const char *domain)
+ {
++ struct device *dev = &pdev->dev;
+ struct of_phandle_args pd_args;
+ struct device_node *np;
+
+@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev,
+ pd_args.np = np;
+ pd_args.args_count = 0;
+
+- return of_genpd_add_device(&pd_args, &pdev->dev);
++ /* Initialization similar to device_pm_init_common() */
++ spin_lock_init(&dev->power.lock);
++ dev->power.early_init = true;
++
++ return of_genpd_add_device(&pd_args, dev);
+ }
+ #else
+ static inline int board_staging_add_dev_domain(struct platform_device *pdev,
+--
+2.30.2
+
--- /dev/null
+From 9b75816bc249f585424ef30166df750e2c7f5b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jul 2021 11:58:17 +0200
+Subject: staging: hisilicon,hi6421-spmi-pmic.yaml: fix patternProperties
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 334201d503d5903f38f6e804263fc291ce8f451a ]
+
+The regex at the patternProperties is wrong, although this was
+not reported as the DT schema was not enforcing properties.
+
+Fix it.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Link: https://lore.kernel.org/r/46b2f30df235481cb1404913380e45706dfd8253.1626515862.git.mchehab+huawei@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml b/drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml
+index 8e355cddd437..6c348578e4a2 100644
+--- a/drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml
++++ b/drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml
+@@ -41,6 +41,8 @@ properties:
+ regulators:
+ type: object
+
++ additionalProperties: false
++
+ properties:
+ '#address-cells':
+ const: 1
+@@ -49,11 +51,13 @@ properties:
+ const: 0
+
+ patternProperties:
+- '^ldo[0-9]+@[0-9a-f]$':
++ '^(ldo|LDO)[0-9]+$':
+ type: object
+
+ $ref: "/schemas/regulator/regulator.yaml#"
+
++ unevaluatedProperties: false
++
+ required:
+ - compatible
+ - reg
+--
+2.30.2
+
--- /dev/null
+From bd7afcc3d3af62072fe711c5d8c6a9ad627c23c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 10:45:11 +0200
+Subject: staging: ks7010: Fix the initialization of the 'sleep_status'
+ structure
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 56315e55119c0ea57e142b6efb7c31208628ad86 ]
+
+'sleep_status' has 3 atomic_t members. Initialize the 3 of them instead of
+initializing only 2 of them and setting 0 twice to the same variable.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/d2e52a33a9beab41879551d0ae2fdfc99970adab.1626856991.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/ks7010/ks7010_sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c
+index cbc0032c1604..98d759e7cc95 100644
+--- a/drivers/staging/ks7010/ks7010_sdio.c
++++ b/drivers/staging/ks7010/ks7010_sdio.c
+@@ -939,9 +939,9 @@ static void ks7010_private_init(struct ks_wlan_private *priv,
+ memset(&priv->wstats, 0, sizeof(priv->wstats));
+
+ /* sleep mode */
++ atomic_set(&priv->sleepstatus.status, 0);
+ atomic_set(&priv->sleepstatus.doze_request, 0);
+ atomic_set(&priv->sleepstatus.wakeup_request, 0);
+- atomic_set(&priv->sleepstatus.wakeup_request, 0);
+
+ trx_device_init(priv);
+ hostif_init(priv);
+--
+2.30.2
+
--- /dev/null
+From 9c396088df503d9c4ceb6986c4d570095de4c6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Aug 2021 11:48:00 +0200
+Subject: staging: rtl8723bs: fix right side of condition
+
+From: Fabio Aiuto <fabioaiuto83@gmail.com>
+
+[ Upstream commit e3678dc1ea40425b7218c20e2fe7b00a72f23a41 ]
+
+TxNum value is compared against ODM_RF_PATH_D,
+which is inconsistent. Compare it against
+RF_MAX_TX_NUM, as in other places in the same file.
+
+Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
+Link: https://lore.kernel.org/r/147631fe6f4f5de84cc54a62ba71d739b92697be.1628329348.git.fabioaiuto83@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/hal/hal_com_phycfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c b/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
+index bb7941aee0c4..fcf31f6d4b36 100644
+--- a/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
++++ b/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
+@@ -463,7 +463,7 @@ static void PHY_StoreTxPowerByRateNew(
+ if (RfPath > ODM_RF_PATH_D)
+ return;
+
+- if (TxNum > ODM_RF_PATH_D)
++ if (TxNum > RF_MAX_TX_NUM)
+ return;
+
+ for (i = 0; i < rateNum; ++i) {
+--
+2.30.2
+
--- /dev/null
+From 6546010349f624fc1467f517db881e1d98ff9425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 21:42:52 -0700
+Subject: staging: rts5208: Fix get_ms_information() heap buffer size
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit cbe34165cc1b7d1110b268ba8b9f30843c941639 ]
+
+Fix buf allocation size (it needs to be 2 bytes larger). Found when
+__alloc_size() annotations were added to kmalloc() interfaces.
+
+In file included from ./include/linux/string.h:253,
+ from ./include/linux/bitmap.h:10,
+ from ./include/linux/cpumask.h:12,
+ from ./arch/x86/include/asm/paravirt.h:17,
+ from ./arch/x86/include/asm/irqflags.h:63,
+ from ./include/linux/irqflags.h:16,
+ from ./include/linux/rcupdate.h:26,
+ from ./include/linux/rculist.h:11,
+ from ./include/linux/pid.h:5,
+ from ./include/linux/sched.h:14,
+ from ./include/linux/blkdev.h:5,
+ from drivers/staging/rts5208/rtsx_scsi.c:12:
+In function 'get_ms_information',
+ inlined from 'ms_sp_cmnd' at drivers/staging/rts5208/rtsx_scsi.c:2877:12,
+ inlined from 'rtsx_scsi_handler' at drivers/staging/rts5208/rtsx_scsi.c:3247:12:
+./include/linux/fortify-string.h:54:29: warning: '__builtin_memcpy' forming offset [106, 107] is out
+ of the bounds [0, 106] [-Warray-bounds]
+ 54 | #define __underlying_memcpy __builtin_memcpy
+ | ^
+./include/linux/fortify-string.h:417:2: note: in expansion of macro '__underlying_memcpy'
+ 417 | __underlying_##op(p, q, __fortify_size); \
+ | ^~~~~~~~~~~~~
+./include/linux/fortify-string.h:463:26: note: in expansion of macro '__fortify_memcpy_chk'
+ 463 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
+ | ^~~~~~~~~~~~~~~~~~~~
+drivers/staging/rts5208/rtsx_scsi.c:2851:3: note: in expansion of macro 'memcpy'
+ 2851 | memcpy(buf + i, ms_card->raw_sys_info, 96);
+ | ^~~~~~
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: linux-staging@lists.linux.dev
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20210818044252.1533634-1-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rts5208/rtsx_scsi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
+index 1deb74112ad4..11d9d9155eef 100644
+--- a/drivers/staging/rts5208/rtsx_scsi.c
++++ b/drivers/staging/rts5208/rtsx_scsi.c
+@@ -2802,10 +2802,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
+ }
+
+ if (dev_info_id == 0x15) {
+- buf_len = 0x3A;
++ buf_len = 0x3C;
+ data_len = 0x3A;
+ } else {
+- buf_len = 0x6A;
++ buf_len = 0x6C;
+ data_len = 0x6A;
+ }
+
+@@ -2855,11 +2855,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
+ }
+
+ rtsx_stor_set_xfer_buf(buf, buf_len, srb);
+-
+- if (dev_info_id == 0x15)
+- scsi_set_resid(srb, scsi_bufflen(srb) - 0x3C);
+- else
+- scsi_set_resid(srb, scsi_bufflen(srb) - 0x6C);
++ scsi_set_resid(srb, scsi_bufflen(srb) - buf_len);
+
+ kfree(buf);
+ return STATUS_SUCCESS;
+--
+2.30.2
+
--- /dev/null
+From 74571d5624d62c583d81260413d7a2ef1bdb6dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 07:59:23 -0400
+Subject: SUNRPC: Fix potential memory corruption
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]
+
+We really should not call rpc_wake_up_queued_task_set_status() with
+xprt->snd_task as an argument unless we are certain that is actually an
+rpc_task.
+
+Fixes: 0445f92c5d53 ("SUNRPC: Fix disconnection races")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/xprt.h | 1 +
+ net/sunrpc/xprt.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index c8c39f22d3b1..59cd97da895b 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -432,6 +432,7 @@ void xprt_release_write(struct rpc_xprt *, struct rpc_task *);
+ #define XPRT_CONGESTED (9)
+ #define XPRT_CWND_WAIT (10)
+ #define XPRT_WRITE_SPACE (11)
++#define XPRT_SND_IS_COOKIE (12)
+
+ static inline void xprt_set_connected(struct rpc_xprt *xprt)
+ {
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index fb6db09725c7..bddd354a0076 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -775,9 +775,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)
+ /* Try to schedule an autoclose RPC call */
+ if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
+ queue_work(xprtiod_workqueue, &xprt->task_cleanup);
+- else if (xprt->snd_task)
++ else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
+ rpc_wake_up_queued_task_set_status(&xprt->pending,
+- xprt->snd_task, -ENOTCONN);
++ xprt->snd_task, -ENOTCONN);
+ spin_unlock(&xprt->transport_lock);
+ }
+ EXPORT_SYMBOL_GPL(xprt_force_disconnect);
+@@ -866,6 +866,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
+ goto out;
+ if (xprt->snd_task != task)
+ goto out;
++ set_bit(XPRT_SND_IS_COOKIE, &xprt->state);
+ xprt->snd_task = cookie;
+ ret = true;
+ out:
+@@ -881,6 +882,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
+ if (!test_bit(XPRT_LOCKED, &xprt->state))
+ goto out;
+ xprt->snd_task =NULL;
++ clear_bit(XPRT_SND_IS_COOKIE, &xprt->state);
+ xprt->ops->release_xprt(xprt, NULL);
+ xprt_schedule_autodisconnect(xprt);
+ out:
+--
+2.30.2
+
--- /dev/null
+From d00cda244d28acd3c9de1f4fa7cc8df97b84d658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 16:04:42 -0400
+Subject: sunrpc: Fix return value of get_srcport()
+
+From: Anna Schumaker <Anna.Schumaker@Netapp.com>
+
+[ Upstream commit 5d46dd04cb68771f77ba66dbf6fd323a4a2ce00d ]
+
+Since bc1c56e9bbe9 transport->srcport may by unset, causing
+get_srcport() to return 0 when called. Fix this by querying the port
+from the underlying socket instead of the transport.
+
+Fixes: bc1c56e9bbe9 (SUNRPC: prevent port reuse on transports which don't request it)
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index e573dcecdd66..02b071dbdd22 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1656,7 +1656,7 @@ static int xs_get_srcport(struct sock_xprt *transport)
+ unsigned short get_srcport(struct rpc_xprt *xprt)
+ {
+ struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);
+- return sock->srcport;
++ return xs_sock_getport(sock->sock);
+ }
+ EXPORT_SYMBOL(get_srcport);
+
+--
+2.30.2
+
--- /dev/null
+From a22c0c133721b5b1d717689ed11cd03baa5ceb4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 08:03:12 -0400
+Subject: SUNRPC/xprtrdma: Fix reconnection locking
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit f99fa50880f5300fbbb3c0754ddc7f8738d24fe7 ]
+
+The xprtrdma client code currently relies on the task that initiated the
+connect to hold the XPRT_LOCK for the duration of the connection
+attempt. If the task is woken early, due to some other event, then that
+lock could get released early.
+Avoid races by using the same mechanism that the socket code uses of
+transferring lock ownership to the RDMA connect worker itself. That
+frees us to call rpcrdma_xprt_disconnect() directly since we're now
+guaranteed exclusion w.r.t. other callers.
+
+Fixes: 4cf44be6f1e8 ("xprtrdma: Fix recursion into rpcrdma_xprt_disconnect()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprt.c | 2 ++
+ net/sunrpc/xprtrdma/transport.c | 11 +++++------
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index bddd354a0076..d55e980521da 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -873,6 +873,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
+ spin_unlock(&xprt->transport_lock);
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(xprt_lock_connect);
+
+ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
+ {
+@@ -889,6 +890,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
+ spin_unlock(&xprt->transport_lock);
+ wake_up_bit(&xprt->state, XPRT_LOCKED);
+ }
++EXPORT_SYMBOL_GPL(xprt_unlock_connect);
+
+ /**
+ * xprt_connect - schedule a transport connect operation
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 9c2ffc67c0fd..975aef16ad34 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -250,12 +250,9 @@ xprt_rdma_connect_worker(struct work_struct *work)
+ xprt->stat.connect_start;
+ xprt_set_connected(xprt);
+ rc = -EAGAIN;
+- } else {
+- /* Force a call to xprt_rdma_close to clean up */
+- spin_lock(&xprt->transport_lock);
+- set_bit(XPRT_CLOSE_WAIT, &xprt->state);
+- spin_unlock(&xprt->transport_lock);
+- }
++ } else
++ rpcrdma_xprt_disconnect(r_xprt);
++ xprt_unlock_connect(xprt, r_xprt);
+ xprt_wake_pending_tasks(xprt, rc);
+ }
+
+@@ -489,6 +486,8 @@ xprt_rdma_connect(struct rpc_xprt *xprt, struct rpc_task *task)
+ struct rpcrdma_ep *ep = r_xprt->rx_ep;
+ unsigned long delay;
+
++ WARN_ON_ONCE(!xprt_lock_connect(xprt, task, r_xprt));
++
+ delay = 0;
+ if (ep && ep->re_connect_status != 0) {
+ delay = xprt_reconnect_delay(xprt);
+--
+2.30.2
+
--- /dev/null
+From 89eade29af42e031a6be49b417482aeeb5ec1e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 20:51:06 +0000
+Subject: tcp: enable data-less, empty-cookie SYN with
+ TFO_SERVER_COOKIE_NOT_REQD
+
+From: Luke Hsiao <lukehsiao@google.com>
+
+[ Upstream commit e3faa49bcecdfcc80e94dd75709d6acb1a5d89f6 ]
+
+Since the original TFO server code was implemented in commit
+168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ("tcp: TCP Fast Open Server -
+main code path") the TFO server code has supported the sysctl bit flag
+TFO_SERVER_COOKIE_NOT_REQD. Currently, when the TFO_SERVER_ENABLE and
+TFO_SERVER_COOKIE_NOT_REQD sysctl bit flags are set, a server connection
+will accept a SYN with N bytes of data (N > 0) that has no TFO cookie,
+create a new fast open connection, process the incoming data in the SYN,
+and make the connection ready for accepting. After accepting, the
+connection is ready for read()/recvmsg() to read the N bytes of data in
+the SYN, ready for write()/sendmsg() calls and data transmissions to
+transmit data.
+
+This commit changes an edge case in this feature by changing this
+behavior to apply to (N >= 0) bytes of data in the SYN rather than only
+(N > 0) bytes of data in the SYN. Now, a server will accept a data-less
+SYN without a TFO cookie if TFO_SERVER_COOKIE_NOT_REQD is set.
+
+Caveat! While this enables a new kind of TFO (data-less empty-cookie
+SYN), some firewall rules setup may not work if they assume such packets
+are not legit TFOs and will filter them.
+
+Signed-off-by: Luke Hsiao <lukehsiao@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20210816205105.2533289-1-luke.w.hsiao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_fastopen.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 25fa4c01a17f..f1e90fc1cd18 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -379,8 +379,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
+ return NULL;
+ }
+
+- if (syn_data &&
+- tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
++ if (tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
+ goto fastopen;
+
+ if (foc->len == 0) {
+--
+2.30.2
+
--- /dev/null
+From ab5862c9182358c5b65c3846df9a3d07a1693095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 07:34:56 -0500
+Subject: thunderbolt: Fix port linking by checking all adapters
+
+From: Sanjay R Mehta <sanju.mehta@amd.com>
+
+[ Upstream commit 42716425ad7e1b6529ec61c260c11176841f4b5f ]
+
+In tb_switch_default_link_ports(), while linking of ports,
+only odd-numbered ports (1,3,5..) are considered and even-numbered
+ports are not considered.
+
+AMD host router has lane adapters at 2 and 3 and link ports at adapter 2
+is not considered due to which lane bonding gets disabled.
+
+Hence added a fix such that all ports are considered during
+linking of ports.
+
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Sanjay R Mehta <sanju.mehta@amd.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/switch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 10d6b228cc94..eec59030c3a7 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -2443,7 +2443,7 @@ static void tb_switch_default_link_ports(struct tb_switch *sw)
+ {
+ int i;
+
+- for (i = 1; i <= sw->config.max_port_number; i += 2) {
++ for (i = 1; i <= sw->config.max_port_number; i++) {
+ struct tb_port *port = &sw->ports[i];
+ struct tb_port *subordinate;
+
+--
+2.30.2
+
--- /dev/null
+From 6564b86ce7edbf523ae145eab91a4337c4aa1895 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 17:44:07 -0400
+Subject: tipc: keep the skb in rcv queue until the whole data is read
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit f4919ff59c2828064b4156e3c3600a169909bcf4 ]
+
+Currently, when userspace reads a datagram with a buffer that is
+smaller than this datagram, the data will be truncated and only
+part of it can be received by users. It doesn't seem right that
+users don't know the datagram size and have to use a huge buffer
+to read it to avoid the truncation.
+
+This patch to fix it by keeping the skb in rcv queue until the
+whole data is read by users. Only the last msg of the datagram
+will be marked with MSG_EOR, just as TCP/SCTP does.
+
+Note that this will work as above only when MSG_EOR is set in the
+flags parameter of recvmsg(), so that it won't break any old user
+applications.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 36 +++++++++++++++++++++++++++---------
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 8754bd885169..a155cfaf01f2 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1886,6 +1886,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ bool connected = !tipc_sk_type_connectionless(sk);
+ struct tipc_sock *tsk = tipc_sk(sk);
+ int rc, err, hlen, dlen, copy;
++ struct tipc_skb_cb *skb_cb;
+ struct sk_buff_head xmitq;
+ struct tipc_msg *hdr;
+ struct sk_buff *skb;
+@@ -1909,6 +1910,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ if (unlikely(rc))
+ goto exit;
+ skb = skb_peek(&sk->sk_receive_queue);
++ skb_cb = TIPC_SKB_CB(skb);
+ hdr = buf_msg(skb);
+ dlen = msg_data_sz(hdr);
+ hlen = msg_hdr_sz(hdr);
+@@ -1928,18 +1930,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+
+ /* Capture data if non-error msg, otherwise just set return value */
+ if (likely(!err)) {
+- copy = min_t(int, dlen, buflen);
+- if (unlikely(copy != dlen))
+- m->msg_flags |= MSG_TRUNC;
+- rc = skb_copy_datagram_msg(skb, hlen, m, copy);
++ int offset = skb_cb->bytes_read;
++
++ copy = min_t(int, dlen - offset, buflen);
++ rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy);
++ if (unlikely(rc))
++ goto exit;
++ if (unlikely(offset + copy < dlen)) {
++ if (flags & MSG_EOR) {
++ if (!(flags & MSG_PEEK))
++ skb_cb->bytes_read = offset + copy;
++ } else {
++ m->msg_flags |= MSG_TRUNC;
++ skb_cb->bytes_read = 0;
++ }
++ } else {
++ if (flags & MSG_EOR)
++ m->msg_flags |= MSG_EOR;
++ skb_cb->bytes_read = 0;
++ }
+ } else {
+ copy = 0;
+ rc = 0;
+- if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control)
++ if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control) {
+ rc = -ECONNRESET;
++ goto exit;
++ }
+ }
+- if (unlikely(rc))
+- goto exit;
+
+ /* Mark message as group event if applicable */
+ if (unlikely(grp_evt)) {
+@@ -1962,9 +1979,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ tipc_node_distr_xmit(sock_net(sk), &xmitq);
+ }
+
+- tsk_advance_rx_queue(sk);
++ if (!skb_cb->bytes_read)
++ tsk_advance_rx_queue(sk);
+
+- if (likely(!connected))
++ if (likely(!connected) || skb_cb->bytes_read)
+ goto exit;
+
+ /* Send connection flow control advertisement when applicable */
+--
+2.30.2
+
--- /dev/null
+From 3e6451e8e0d79521935a803f3493afcc79590b5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 05:53:23 +0000
+Subject: tty: serial: jsm: hold port lock when reporting modem line changes
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 240e126c28df084222f0b661321e8e3ecb0d232e ]
+
+uart_handle_dcd_change() requires a port lock to be held and will emit a
+warning when lockdep is enabled.
+
+Held corresponding lock to fix the following warnings.
+
+[ 132.528648] WARNING: CPU: 5 PID: 11600 at drivers/tty/serial/serial_core.c:3046 uart_handle_dcd_change+0xf4/0x120
+[ 132.530482] Modules linked in:
+[ 132.531050] CPU: 5 PID: 11600 Comm: jsm Not tainted 5.14.0-rc1-00003-g7fef2edf7cc7-dirty #31
+[ 132.535268] RIP: 0010:uart_handle_dcd_change+0xf4/0x120
+[ 132.557100] Call Trace:
+[ 132.557562] ? __free_pages+0x83/0xb0
+[ 132.558213] neo_parse_modem+0x156/0x220
+[ 132.558897] neo_param+0x399/0x840
+[ 132.559495] jsm_tty_open+0x12f/0x2d0
+[ 132.560131] uart_startup.part.18+0x153/0x340
+[ 132.560888] ? lock_is_held_type+0xe9/0x140
+[ 132.561660] uart_port_activate+0x7f/0xe0
+[ 132.562351] ? uart_startup.part.18+0x340/0x340
+[ 132.563003] tty_port_open+0x8d/0xf0
+[ 132.563523] ? uart_set_options+0x1e0/0x1e0
+[ 132.564125] uart_open+0x24/0x40
+[ 132.564604] tty_open+0x15c/0x630
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Link: https://lore.kernel.org/r/1626242003-3809-1-git-send-email-zheyuma97@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/jsm/jsm_neo.c | 2 ++
+ drivers/tty/serial/jsm/jsm_tty.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c
+index bf0e2a4cb0ce..c6f927a76c3b 100644
+--- a/drivers/tty/serial/jsm/jsm_neo.c
++++ b/drivers/tty/serial/jsm/jsm_neo.c
+@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port)
+ /* Parse any modem signal changes */
+ jsm_dbg(INTR, &ch->ch_bd->pci_dev,
+ "MOD_STAT: sending to parse_modem_sigs\n");
++ spin_lock_irqsave(&ch->uart_port.lock, lock_flags);
+ neo_parse_modem(ch, readb(&ch->ch_neo_uart->msr));
++ spin_unlock_irqrestore(&ch->uart_port.lock, lock_flags);
+ }
+ }
+
+diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c
+index 8e42a7682c63..d74cbbbf33c6 100644
+--- a/drivers/tty/serial/jsm/jsm_tty.c
++++ b/drivers/tty/serial/jsm/jsm_tty.c
+@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state)
+
+ static int jsm_tty_open(struct uart_port *port)
+ {
++ unsigned long lock_flags;
+ struct jsm_board *brd;
+ struct jsm_channel *channel =
+ container_of(port, struct jsm_channel, uart_port);
+@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port)
+ channel->ch_cached_lsr = 0;
+ channel->ch_stops_sent = 0;
+
++ spin_lock_irqsave(&port->lock, lock_flags);
+ termios = &port->state->port.tty->termios;
+ channel->ch_c_cflag = termios->c_cflag;
+ channel->ch_c_iflag = termios->c_iflag;
+@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port)
+ jsm_carrier(channel);
+
+ channel->ch_open_count++;
++ spin_unlock_irqrestore(&port->lock, lock_flags);
+
+ jsm_dbg(OPEN, &channel->ch_bd->pci_dev, "finish\n");
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From afab0bffba6cacb0558525934b12dd8fb6b62b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 16:28:58 +0800
+Subject: usb: chipidea: host: fix port index underflow and UBSAN complains
+
+From: Li Jun <jun.li@nxp.com>
+
+[ Upstream commit e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 ]
+
+If wIndex is 0 (and it often is), these calculations underflow and
+UBSAN complains, here resolve this by not decrementing the index when
+it is equal to 0, this copies the solution from commit 85e3990bea49
+("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")
+
+Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/host.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index e86d13c04bdb..bdc3885c0d49 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -240,15 +240,18 @@ static int ci_ehci_hub_control(
+ )
+ {
+ struct ehci_hcd *ehci = hcd_to_ehci(hcd);
++ unsigned int ports = HCS_N_PORTS(ehci->hcs_params);
+ u32 __iomem *status_reg;
+- u32 temp;
++ u32 temp, port_index;
+ unsigned long flags;
+ int retval = 0;
+ bool done = false;
+ struct device *dev = hcd->self.controller;
+ struct ci_hdrc *ci = dev_get_drvdata(dev);
+
+- status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
++ port_index = wIndex & 0xff;
++ port_index -= (port_index > 0);
++ status_reg = &ehci->regs->port_status[port_index];
+
+ spin_lock_irqsave(&ehci->lock, flags);
+
+@@ -260,6 +263,11 @@ static int ci_ehci_hub_control(
+ }
+
+ if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
++ if (!wIndex || wIndex > ports) {
++ retval = -EPIPE;
++ goto done;
++ }
++
+ temp = ehci_readl(ehci, status_reg);
+ if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
+ retval = -EPIPE;
+@@ -288,7 +296,7 @@ static int ci_ehci_hub_control(
+ ehci_writel(ehci, temp, status_reg);
+ }
+
+- set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
++ set_bit(port_index, &ehci->suspended_ports);
+ goto done;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 7e8ee371e4224417be95b215e1776abbc38e916f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 18:48:18 +0300
+Subject: usb: dwc3: imx8mp: request irq after initializing dwc3
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+[ Upstream commit 6a48d0ae01a6ab05ae5e78328546a2f5f6d3054a ]
+
+If IRQ occurs between calling devm_request_threaded_irq() and
+initializing dwc3_imx->dwc3, then null pointer dereference occurs
+since dwc3_imx->dwc3 is used in dwc3_imx8mp_interrupt().
+
+The patch puts registration of the interrupt handler after
+initializing of neccesery data.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210819154818.18334-1-lutovinova@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-imx8mp.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-imx8mp.c b/drivers/usb/dwc3/dwc3-imx8mp.c
+index 756faa46d33a..d328d20abfbc 100644
+--- a/drivers/usb/dwc3/dwc3-imx8mp.c
++++ b/drivers/usb/dwc3/dwc3-imx8mp.c
+@@ -152,13 +152,6 @@ static int dwc3_imx8mp_probe(struct platform_device *pdev)
+ }
+ dwc3_imx->irq = irq;
+
+- err = devm_request_threaded_irq(dev, irq, NULL, dwc3_imx8mp_interrupt,
+- IRQF_ONESHOT, dev_name(dev), dwc3_imx);
+- if (err) {
+- dev_err(dev, "failed to request IRQ #%d --> %d\n", irq, err);
+- goto disable_clks;
+- }
+-
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+ err = pm_runtime_get_sync(dev);
+@@ -186,6 +179,13 @@ static int dwc3_imx8mp_probe(struct platform_device *pdev)
+ }
+ of_node_put(dwc3_np);
+
++ err = devm_request_threaded_irq(dev, irq, NULL, dwc3_imx8mp_interrupt,
++ IRQF_ONESHOT, dev_name(dev), dwc3_imx);
++ if (err) {
++ dev_err(dev, "failed to request IRQ #%d --> %d\n", irq, err);
++ goto depopulate;
++ }
++
+ device_set_wakeup_capable(dev, true);
+ pm_runtime_put(dev);
+
+--
+2.30.2
+
--- /dev/null
+From 2cf50025af8e05a3766eac2f463c6a34c863cd63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 11:30:56 +0300
+Subject: USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 61136a12cbed234374ec6f588af57c580b20b772 ]
+
+mv_ehci_enable() did not disable and unprepare clocks in case of
+failures of phy_init(). Besides, it did not take into account failures
+of ehci_clock_enable() (in effect, failures of clk_prepare_enable()).
+The patch fixes both issues and gets rid of redundant wrappers around
+clk_prepare_enable() and clk_disable_unprepare() to simplify this a bit.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Link: https://lore.kernel.org/r/20210708083056.21543-1-novikov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-mv.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
+index cffdc8d01b2a..8fd27249ad25 100644
+--- a/drivers/usb/host/ehci-mv.c
++++ b/drivers/usb/host/ehci-mv.c
+@@ -42,26 +42,25 @@ struct ehci_hcd_mv {
+ int (*set_vbus)(unsigned int vbus);
+ };
+
+-static void ehci_clock_enable(struct ehci_hcd_mv *ehci_mv)
++static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv)
+ {
+- clk_prepare_enable(ehci_mv->clk);
+-}
++ int retval;
+
+-static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
+-{
+- clk_disable_unprepare(ehci_mv->clk);
+-}
++ retval = clk_prepare_enable(ehci_mv->clk);
++ if (retval)
++ return retval;
+
+-static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv)
+-{
+- ehci_clock_enable(ehci_mv);
+- return phy_init(ehci_mv->phy);
++ retval = phy_init(ehci_mv->phy);
++ if (retval)
++ clk_disable_unprepare(ehci_mv->clk);
++
++ return retval;
+ }
+
+ static void mv_ehci_disable(struct ehci_hcd_mv *ehci_mv)
+ {
+ phy_exit(ehci_mv->phy);
+- ehci_clock_disable(ehci_mv);
++ clk_disable_unprepare(ehci_mv->clk);
+ }
+
+ static int mv_ehci_reset(struct usb_hcd *hcd)
+--
+2.30.2
+
--- /dev/null
+From 36dfa23c44b835942ac619bcedbf371f632eb84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 01:09:07 -0700
+Subject: usb: gadget: composite: Allow bMaxPower=0 if self-powered
+
+From: Jack Pham <jackp@codeaurora.org>
+
+[ Upstream commit bcacbf06c891374e7fdd7b72d11cda03b0269b43 ]
+
+Currently the composite driver encodes the MaxPower field of
+the configuration descriptor by reading the c->MaxPower of the
+usb_configuration only if it is non-zero, otherwise it falls back
+to using the value hard-coded in CONFIG_USB_GADGET_VBUS_DRAW.
+However, there are cases when a configuration must explicitly set
+bMaxPower to 0, particularly if its bmAttributes also has the
+Self-Powered bit set, which is a valid combination.
+
+This is specifically called out in the USB PD specification section
+9.1, in which a PDUSB device "shall report zero in the bMaxPower
+field after negotiating a mutually agreeable Contract", and also
+verified by the USB Type-C Functional Test TD.4.10.2 Sink Power
+Precedence Test.
+
+The fix allows the c->MaxPower to be used for encoding the bMaxPower
+even if it is 0, if the self-powered bit is also set. An example
+usage of this would be for a ConfigFS gadget to be dynamically
+updated by userspace when the Type-C connection is determined to be
+operating in Power Delivery mode.
+
+Co-developed-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Link: https://lore.kernel.org/r/20210720080907.30292-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/composite.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 72a9797dbbae..504c1cbc255d 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -482,7 +482,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
+ {
+ unsigned val;
+
+- if (c->MaxPower)
++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
+ val = c->MaxPower;
+ else
+ val = CONFIG_USB_GADGET_VBUS_DRAW;
+@@ -936,7 +936,11 @@ static int set_config(struct usb_composite_dev *cdev,
+ }
+
+ /* when we return, be sure our power usage is valid */
+- power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
++ power = c->MaxPower;
++ else
++ power = CONFIG_USB_GADGET_VBUS_DRAW;
++
+ if (gadget->speed < USB_SPEED_SUPER)
+ power = min(power, 500U);
+ else
+--
+2.30.2
+
--- /dev/null
+From 8ba983bab01617c17983512403ac2b567fc27f24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 04:48:34 -0700
+Subject: usb: gadget: u_ether: fix a potential null pointer dereference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+[ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ]
+
+f_ncm tx timeout can call us with null skb to flush
+a pending frame. In this case skb is NULL to begin
+with but ceases to be null after dev->wrap() completes.
+
+In such a case in->maxpacket will be read, even though
+we've failed to check that 'in' is not NULL.
+
+Though I've never observed this fail in practice,
+however the 'flush operation' simply does not make sense with
+a null usb IN endpoint - there's nowhere to flush to...
+(note that we're the gadget/device, and IN is from the point
+ of view of the host, so here IN actually means outbound...)
+
+Cc: Brooke Basile <brookebasile@gmail.com>
+Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Link: https://lore.kernel.org/r/20210701114834.884597-6-zenczykowski@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_ether.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index d1d044d9f859..85a3f6d4b5af 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -492,8 +492,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
+ }
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+- if (skb && !in) {
+- dev_kfree_skb_any(skb);
++ if (!in) {
++ if (skb)
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From e22ade3712eb91d1d32f50253d98ad48ad1e0c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jun 2021 20:57:47 +0800
+Subject: usb: host: fotg210: fix the actual_length of an iso packet
+
+From: Kelly Devilliv <kelly.devilliv@gmail.com>
+
+[ Upstream commit 091cb2f782f32ab68c6f5f326d7868683d3d4875 ]
+
+We should acquire the actual_length of an iso packet
+from the iTD directly using FOTG210_ITD_LENGTH() macro.
+
+Signed-off-by: Kelly Devilliv <kelly.devilliv@gmail.com>
+Link: https://lore.kernel.org/r/20210627125747.127646-4-kelly.devilliv@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fotg210-hcd.c | 5 ++---
+ drivers/usb/host/fotg210.h | 5 -----
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index dd29f7b68d6f..aeb235ce06c1 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -4460,13 +4460,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
+
+ /* HC need not update length with this error */
+ if (!(t & FOTG210_ISOC_BABBLE)) {
+- desc->actual_length =
+- fotg210_itdlen(urb, desc, t);
++ desc->actual_length = FOTG210_ITD_LENGTH(t);
+ urb->actual_length += desc->actual_length;
+ }
+ } else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) {
+ desc->status = 0;
+- desc->actual_length = fotg210_itdlen(urb, desc, t);
++ desc->actual_length = FOTG210_ITD_LENGTH(t);
+ urb->actual_length += desc->actual_length;
+ } else {
+ /* URB was too late */
+diff --git a/drivers/usb/host/fotg210.h b/drivers/usb/host/fotg210.h
+index 0a91061a0551..0781442b7a24 100644
+--- a/drivers/usb/host/fotg210.h
++++ b/drivers/usb/host/fotg210.h
+@@ -683,11 +683,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210)
+ return fotg210_readl(fotg210, &fotg210->regs->frame_index);
+ }
+
+-#define fotg210_itdlen(urb, desc, t) ({ \
+- usb_pipein((urb)->pipe) ? \
+- (desc)->length - FOTG210_ITD_LENGTH(t) : \
+- FOTG210_ITD_LENGTH(t); \
+-})
+ /*-------------------------------------------------------------------------*/
+
+ #endif /* __LINUX_FOTG210_H */
+--
+2.30.2
+
--- /dev/null
+From acd46cbdc08b49acf988daab89280558df0bbfa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jun 2021 20:57:46 +0800
+Subject: usb: host: fotg210: fix the endpoint's transactional opportunities
+ calculation
+
+From: Kelly Devilliv <kelly.devilliv@gmail.com>
+
+[ Upstream commit c2e898764245c852bc8ee4857613ba4f3a6d761d ]
+
+Now that usb_endpoint_maxp() only returns the lowest
+11 bits from wMaxPacketSize, we should make use of the
+usb_endpoint_* helpers instead and remove the unnecessary
+max_packet()/hb_mult() macro.
+
+Signed-off-by: Kelly Devilliv <kelly.devilliv@gmail.com>
+Link: https://lore.kernel.org/r/20210627125747.127646-3-kelly.devilliv@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fotg210-hcd.c | 36 ++++++++++++++++------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 05fb8d97cf02..dd29f7b68d6f 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -2510,11 +2510,6 @@ static unsigned qh_completions(struct fotg210_hcd *fotg210,
+ return count;
+ }
+
+-/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */
+-#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
+-/* ... and packet size, for any kind of endpoint descriptor */
+-#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
+-
+ /* reverse of qh_urb_transaction: free a list of TDs.
+ * used for cleanup after errors, before HC sees an URB's TDs.
+ */
+@@ -2600,7 +2595,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
+ token |= (1 /* "in" */ << 8);
+ /* else it's already initted to "out" pid (0 << 8) */
+
+- maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
++ maxpacket = usb_maxpacket(urb->dev, urb->pipe, !is_input);
+
+ /*
+ * buffer gets wrapped in one or more qtds;
+@@ -2714,9 +2709,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ gfp_t flags)
+ {
+ struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags);
++ struct usb_host_endpoint *ep;
+ u32 info1 = 0, info2 = 0;
+ int is_input, type;
+ int maxp = 0;
++ int mult;
+ struct usb_tt *tt = urb->dev->tt;
+ struct fotg210_qh_hw *hw;
+
+@@ -2731,14 +2728,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+
+ is_input = usb_pipein(urb->pipe);
+ type = usb_pipetype(urb->pipe);
+- maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input);
++ ep = usb_pipe_endpoint(urb->dev, urb->pipe);
++ maxp = usb_endpoint_maxp(&ep->desc);
++ mult = usb_endpoint_maxp_mult(&ep->desc);
+
+ /* 1024 byte maxpacket is a hardware ceiling. High bandwidth
+ * acts like up to 3KB, but is built from smaller packets.
+ */
+- if (max_packet(maxp) > 1024) {
+- fotg210_dbg(fotg210, "bogus qh maxpacket %d\n",
+- max_packet(maxp));
++ if (maxp > 1024) {
++ fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp);
+ goto done;
+ }
+
+@@ -2752,8 +2750,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ */
+ if (type == PIPE_INTERRUPT) {
+ qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
+- is_input, 0,
+- hb_mult(maxp) * max_packet(maxp)));
++ is_input, 0, mult * maxp));
+ qh->start = NO_FRAME;
+
+ if (urb->dev->speed == USB_SPEED_HIGH) {
+@@ -2790,7 +2787,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ think_time = tt ? tt->think_time : 0;
+ qh->tt_usecs = NS_TO_US(think_time +
+ usb_calc_bus_time(urb->dev->speed,
+- is_input, 0, max_packet(maxp)));
++ is_input, 0, maxp));
+ qh->period = urb->interval;
+ if (qh->period > fotg210->periodic_size) {
+ qh->period = fotg210->periodic_size;
+@@ -2853,11 +2850,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ * to help them do so. So now people expect to use
+ * such nonconformant devices with Linux too; sigh.
+ */
+- info1 |= max_packet(maxp) << 16;
++ info1 |= maxp << 16;
+ info2 |= (FOTG210_TUNE_MULT_HS << 30);
+ } else { /* PIPE_INTERRUPT */
+- info1 |= max_packet(maxp) << 16;
+- info2 |= hb_mult(maxp) << 30;
++ info1 |= maxp << 16;
++ info2 |= mult << 30;
+ }
+ break;
+ default:
+@@ -3927,6 +3924,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
+ int is_input;
+ long bandwidth;
+ unsigned multi;
++ struct usb_host_endpoint *ep;
+
+ /*
+ * this might be a "high bandwidth" highspeed endpoint,
+@@ -3934,14 +3932,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
+ */
+ epnum = usb_pipeendpoint(pipe);
+ is_input = usb_pipein(pipe) ? USB_DIR_IN : 0;
+- maxp = usb_maxpacket(dev, pipe, !is_input);
++ ep = usb_pipe_endpoint(dev, pipe);
++ maxp = usb_endpoint_maxp(&ep->desc);
+ if (is_input)
+ buf1 = (1 << 11);
+ else
+ buf1 = 0;
+
+- maxp = max_packet(maxp);
+- multi = hb_mult(maxp);
++ multi = usb_endpoint_maxp_mult(&ep->desc);
+ buf1 |= maxp;
+ maxp *= multi;
+
+--
+2.30.2
+
--- /dev/null
+From 889c671749fe872d4475b808089f757fa7eaeeb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:11:50 +0100
+Subject: usb: isp1760: fix memory pool initialization
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit f757f9291f920e1da4c6cfd4064c6bf59639983e ]
+
+The loops to setup the memory pool were skipping some
+blocks, that was not visible on the ISP1763 because it has
+fewer blocks than the ISP1761. But won testing on that IP
+from the family that would be an issue.
+
+Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Link: https://lore.kernel.org/r/20210827131154.4151862-2-rui.silva@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/isp1760/isp1760-hcd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
+index 27168b4a4ef2..ffb3a0c8c909 100644
+--- a/drivers/usb/isp1760/isp1760-hcd.c
++++ b/drivers/usb/isp1760/isp1760-hcd.c
+@@ -588,8 +588,8 @@ static void init_memory(struct isp1760_hcd *priv)
+
+ payload_addr = PAYLOAD_OFFSET;
+
+- for (i = 0, curr = 0; i < ARRAY_SIZE(mem->blocks); i++) {
+- for (j = 0; j < mem->blocks[i]; j++, curr++) {
++ for (i = 0, curr = 0; i < ARRAY_SIZE(mem->blocks); i++, curr += j) {
++ for (j = 0; j < mem->blocks[i]; j++) {
+ priv->memory_pool[curr + j].start = payload_addr;
+ priv->memory_pool[curr + j].size = mem->blocks_size[i];
+ priv->memory_pool[curr + j].free = 1;
+--
+2.30.2
+
--- /dev/null
+From 9cee2d62ca1c55df0c5129d90e47bd5ffbef1ad3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:11:51 +0100
+Subject: usb: isp1760: fix qtd fill length
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit cbfa3effdf5c2d411c9ce9820f3d33d77bc4697d ]
+
+When trying to send bulks bigger than the biggest block size
+we need to split them over several qtd. Fix this limiting the
+maximum qtd size to largest block size.
+
+Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Link: https://lore.kernel.org/r/20210827131154.4151862-3-rui.silva@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/isp1760/isp1760-hcd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
+index ffb3a0c8c909..d2d19548241e 100644
+--- a/drivers/usb/isp1760/isp1760-hcd.c
++++ b/drivers/usb/isp1760/isp1760-hcd.c
+@@ -1826,9 +1826,11 @@ static void packetize_urb(struct usb_hcd *hcd,
+ goto cleanup;
+
+ if (len > mem->blocks_size[ISP176x_BLOCK_NUM - 1])
+- len = mem->blocks_size[ISP176x_BLOCK_NUM - 1];
++ this_qtd_len = mem->blocks_size[ISP176x_BLOCK_NUM - 1];
++ else
++ this_qtd_len = len;
+
+- this_qtd_len = qtd_fill(qtd, buf, len);
++ this_qtd_len = qtd_fill(qtd, buf, this_qtd_len);
+ list_add_tail(&qtd->qtd_list, head);
+
+ len -= this_qtd_len;
+--
+2.30.2
+
--- /dev/null
+From 116151c0e9c38616b6b84fd43959319daa50b0a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:11:54 +0100
+Subject: usb: isp1760: otg control register access
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit 9c1587d99f9305aa4f10b47fcf1981012aa5381f ]
+
+The set/clear of the otg control values is done writing to
+two different 16bit registers, however we setup the regmap
+width for isp1760/61 to 32bit value bits.
+
+So, just access the clear register address (0x376)as the high
+part of the otg control register set (0x374), and write the
+values in one go to make sure they get clear/set.
+
+Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Link: https://lore.kernel.org/r/20210827131154.4151862-6-rui.silva@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/isp1760/isp1760-core.c | 50 ++++++++++++++++--------------
+ drivers/usb/isp1760/isp1760-regs.h | 16 ++++++++++
+ 2 files changed, 42 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/usb/isp1760/isp1760-core.c b/drivers/usb/isp1760/isp1760-core.c
+index ff07e2890692..1f2ca22384b0 100644
+--- a/drivers/usb/isp1760/isp1760-core.c
++++ b/drivers/usb/isp1760/isp1760-core.c
+@@ -30,6 +30,7 @@ static int isp1760_init_core(struct isp1760_device *isp)
+ {
+ struct isp1760_hcd *hcd = &isp->hcd;
+ struct isp1760_udc *udc = &isp->udc;
++ u32 otg_ctrl;
+
+ /* Low-level chip reset */
+ if (isp->rst_gpio) {
+@@ -83,16 +84,17 @@ static int isp1760_init_core(struct isp1760_device *isp)
+ *
+ * TODO: Really support OTG. For now we configure port 1 in device mode
+ */
+- if (((isp->devflags & ISP1760_FLAG_ISP1761) ||
+- (isp->devflags & ISP1760_FLAG_ISP1763)) &&
+- (isp->devflags & ISP1760_FLAG_PERIPHERAL_EN)) {
+- isp1760_field_set(hcd->fields, HW_DM_PULLDOWN);
+- isp1760_field_set(hcd->fields, HW_DP_PULLDOWN);
+- isp1760_field_set(hcd->fields, HW_OTG_DISABLE);
+- } else {
+- isp1760_field_set(hcd->fields, HW_SW_SEL_HC_DC);
+- isp1760_field_set(hcd->fields, HW_VBUS_DRV);
+- isp1760_field_set(hcd->fields, HW_SEL_CP_EXT);
++ if (isp->devflags & ISP1760_FLAG_ISP1761) {
++ if (isp->devflags & ISP1760_FLAG_PERIPHERAL_EN) {
++ otg_ctrl = (ISP176x_HW_DM_PULLDOWN_CLEAR |
++ ISP176x_HW_DP_PULLDOWN_CLEAR |
++ ISP176x_HW_OTG_DISABLE);
++ } else {
++ otg_ctrl = (ISP176x_HW_SW_SEL_HC_DC_CLEAR |
++ ISP176x_HW_VBUS_DRV |
++ ISP176x_HW_SEL_CP_EXT);
++ }
++ isp1760_reg_write(hcd->regs, ISP176x_HC_OTG_CTRL, otg_ctrl);
+ }
+
+ dev_info(isp->dev, "%s bus width: %u, oc: %s\n",
+@@ -235,20 +237,20 @@ static const struct reg_field isp1760_hc_reg_fields[] = {
+ [HC_ISO_IRQ_MASK_AND] = REG_FIELD(ISP176x_HC_ISO_IRQ_MASK_AND, 0, 31),
+ [HC_INT_IRQ_MASK_AND] = REG_FIELD(ISP176x_HC_INT_IRQ_MASK_AND, 0, 31),
+ [HC_ATL_IRQ_MASK_AND] = REG_FIELD(ISP176x_HC_ATL_IRQ_MASK_AND, 0, 31),
+- [HW_OTG_DISABLE] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 10, 10),
+- [HW_SW_SEL_HC_DC] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 7, 7),
+- [HW_VBUS_DRV] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 4, 4),
+- [HW_SEL_CP_EXT] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 3, 3),
+- [HW_DM_PULLDOWN] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 2, 2),
+- [HW_DP_PULLDOWN] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 1, 1),
+- [HW_DP_PULLUP] = REG_FIELD(ISP176x_HC_OTG_CTRL_SET, 0, 0),
+- [HW_OTG_DISABLE_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 10, 10),
+- [HW_SW_SEL_HC_DC_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 7, 7),
+- [HW_VBUS_DRV_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 4, 4),
+- [HW_SEL_CP_EXT_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 3, 3),
+- [HW_DM_PULLDOWN_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 2, 2),
+- [HW_DP_PULLDOWN_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 1, 1),
+- [HW_DP_PULLUP_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL_CLEAR, 0, 0),
++ [HW_OTG_DISABLE_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 26, 26),
++ [HW_SW_SEL_HC_DC_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 23, 23),
++ [HW_VBUS_DRV_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 20, 20),
++ [HW_SEL_CP_EXT_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 19, 19),
++ [HW_DM_PULLDOWN_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 18, 18),
++ [HW_DP_PULLDOWN_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 17, 17),
++ [HW_DP_PULLUP_CLEAR] = REG_FIELD(ISP176x_HC_OTG_CTRL, 16, 16),
++ [HW_OTG_DISABLE] = REG_FIELD(ISP176x_HC_OTG_CTRL, 10, 10),
++ [HW_SW_SEL_HC_DC] = REG_FIELD(ISP176x_HC_OTG_CTRL, 7, 7),
++ [HW_VBUS_DRV] = REG_FIELD(ISP176x_HC_OTG_CTRL, 4, 4),
++ [HW_SEL_CP_EXT] = REG_FIELD(ISP176x_HC_OTG_CTRL, 3, 3),
++ [HW_DM_PULLDOWN] = REG_FIELD(ISP176x_HC_OTG_CTRL, 2, 2),
++ [HW_DP_PULLDOWN] = REG_FIELD(ISP176x_HC_OTG_CTRL, 1, 1),
++ [HW_DP_PULLUP] = REG_FIELD(ISP176x_HC_OTG_CTRL, 0, 0),
+ };
+
+ static const struct reg_field isp1763_hc_reg_fields[] = {
+diff --git a/drivers/usb/isp1760/isp1760-regs.h b/drivers/usb/isp1760/isp1760-regs.h
+index 94ea60c20b2a..3a6751197e97 100644
+--- a/drivers/usb/isp1760/isp1760-regs.h
++++ b/drivers/usb/isp1760/isp1760-regs.h
+@@ -61,6 +61,7 @@
+ #define ISP176x_HC_INT_IRQ_MASK_AND 0x328
+ #define ISP176x_HC_ATL_IRQ_MASK_AND 0x32c
+
++#define ISP176x_HC_OTG_CTRL 0x374
+ #define ISP176x_HC_OTG_CTRL_SET 0x374
+ #define ISP176x_HC_OTG_CTRL_CLEAR 0x376
+
+@@ -179,6 +180,21 @@ enum isp176x_host_controller_fields {
+ #define ISP176x_DC_IESUSP BIT(3)
+ #define ISP176x_DC_IEBRST BIT(0)
+
++#define ISP176x_HW_OTG_DISABLE_CLEAR BIT(26)
++#define ISP176x_HW_SW_SEL_HC_DC_CLEAR BIT(23)
++#define ISP176x_HW_VBUS_DRV_CLEAR BIT(20)
++#define ISP176x_HW_SEL_CP_EXT_CLEAR BIT(19)
++#define ISP176x_HW_DM_PULLDOWN_CLEAR BIT(18)
++#define ISP176x_HW_DP_PULLDOWN_CLEAR BIT(17)
++#define ISP176x_HW_DP_PULLUP_CLEAR BIT(16)
++#define ISP176x_HW_OTG_DISABLE BIT(10)
++#define ISP176x_HW_SW_SEL_HC_DC BIT(7)
++#define ISP176x_HW_VBUS_DRV BIT(4)
++#define ISP176x_HW_SEL_CP_EXT BIT(3)
++#define ISP176x_HW_DM_PULLDOWN BIT(2)
++#define ISP176x_HW_DP_PULLDOWN BIT(1)
++#define ISP176x_HW_DP_PULLUP BIT(0)
++
+ #define ISP176x_DC_ENDPTYP_ISOC 0x01
+ #define ISP176x_DC_ENDPTYP_BULK 0x02
+ #define ISP176x_DC_ENDPTYP_INTERRUPT 0x03
+--
+2.30.2
+
--- /dev/null
+From 5f92f9f805569e00c0b70b08cb0286674d7451c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:11:53 +0100
+Subject: usb: isp1760: use the right irq status bit
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit 955d0fb590f18ec5c3a4085c7d0e39b6abde0dd6 ]
+
+Instead of using the fields enum values to check interrupts
+trigged, use the correct bit values.
+
+Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Link: https://lore.kernel.org/r/20210827131154.4151862-5-rui.silva@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/isp1760/isp1760-udc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
+index a78da59d6417..5cafd23345ca 100644
+--- a/drivers/usb/isp1760/isp1760-udc.c
++++ b/drivers/usb/isp1760/isp1760-udc.c
+@@ -1363,7 +1363,7 @@ static irqreturn_t isp1760_udc_irq(int irq, void *dev)
+
+ status = isp1760_udc_irq_get_status(udc);
+
+- if (status & DC_IEVBUS) {
++ if (status & ISP176x_DC_IEVBUS) {
+ dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
+ /* The VBUS interrupt is only triggered when VBUS appears. */
+ spin_lock(&udc->lock);
+@@ -1371,7 +1371,7 @@ static irqreturn_t isp1760_udc_irq(int irq, void *dev)
+ spin_unlock(&udc->lock);
+ }
+
+- if (status & DC_IEBRST) {
++ if (status & ISP176x_DC_IEBRST) {
+ dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
+
+ isp1760_udc_reset(udc);
+@@ -1391,18 +1391,18 @@ static irqreturn_t isp1760_udc_irq(int irq, void *dev)
+ }
+ }
+
+- if (status & DC_IEP0SETUP) {
++ if (status & ISP176x_DC_IEP0SETUP) {
+ dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
+
+ isp1760_ep0_setup(udc);
+ }
+
+- if (status & DC_IERESM) {
++ if (status & ISP176x_DC_IERESM) {
+ dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
+ isp1760_udc_resume(udc);
+ }
+
+- if (status & DC_IESUSP) {
++ if (status & ISP176x_DC_IESUSP) {
+ dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
+
+ spin_lock(&udc->lock);
+@@ -1413,7 +1413,7 @@ static irqreturn_t isp1760_udc_irq(int irq, void *dev)
+ spin_unlock(&udc->lock);
+ }
+
+- if (status & DC_IEHS_STA) {
++ if (status & ISP176x_DC_IEHS_STA) {
+ dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
+ udc->gadget.speed = USB_SPEED_HIGH;
+ }
+--
+2.30.2
+
--- /dev/null
+From a5148e24ef30b0702832d9c97c06ab4137ee1b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 14:11:52 +0100
+Subject: usb: isp1760: write to status and address register
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit 36815a4a0763bb405ebd776c45553005c1ef7a15 ]
+
+We were already writing directly the port status register to
+trigger changes in isp1763. The same is needed in other IP
+from the family, including also to setup the read address
+before reading from device.
+
+Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Link: https://lore.kernel.org/r/20210827131154.4151862-4-rui.silva@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/isp1760/isp1760-hcd.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
+index d2d19548241e..e517376c3291 100644
+--- a/drivers/usb/isp1760/isp1760-hcd.c
++++ b/drivers/usb/isp1760/isp1760-hcd.c
+@@ -182,7 +182,7 @@ struct urb_listitem {
+ struct urb *urb;
+ };
+
+-static const u32 isp1763_hc_portsc1_fields[] = {
++static const u32 isp176x_hc_portsc1_fields[] = {
+ [PORT_OWNER] = BIT(13),
+ [PORT_POWER] = BIT(12),
+ [PORT_LSTATUS] = BIT(10),
+@@ -205,27 +205,28 @@ static u32 isp1760_hcd_read(struct usb_hcd *hcd, u32 field)
+ }
+
+ /*
+- * We need, in isp1763, to write directly the values to the portsc1
++ * We need, in isp176x, to write directly the values to the portsc1
+ * register so it will make the other values to trigger.
+ */
+ static void isp1760_hcd_portsc1_set_clear(struct isp1760_hcd *priv, u32 field,
+ u32 val)
+ {
+- u32 bit = isp1763_hc_portsc1_fields[field];
+- u32 port_status = readl(priv->base + ISP1763_HC_PORTSC1);
++ u32 bit = isp176x_hc_portsc1_fields[field];
++ u16 portsc1_reg = priv->is_isp1763 ? ISP1763_HC_PORTSC1 :
++ ISP176x_HC_PORTSC1;
++ u32 port_status = readl(priv->base + portsc1_reg);
+
+ if (val)
+- writel(port_status | bit, priv->base + ISP1763_HC_PORTSC1);
++ writel(port_status | bit, priv->base + portsc1_reg);
+ else
+- writel(port_status & ~bit, priv->base + ISP1763_HC_PORTSC1);
++ writel(port_status & ~bit, priv->base + portsc1_reg);
+ }
+
+ static void isp1760_hcd_write(struct usb_hcd *hcd, u32 field, u32 val)
+ {
+ struct isp1760_hcd *priv = hcd_to_priv(hcd);
+
+- if (unlikely(priv->is_isp1763 &&
+- (field >= PORT_OWNER && field <= PORT_CONNECT)))
++ if (unlikely((field >= PORT_OWNER && field <= PORT_CONNECT)))
+ return isp1760_hcd_portsc1_set_clear(priv, field, val);
+
+ isp1760_field_write(priv->fields, field, val);
+@@ -367,8 +368,7 @@ static void isp1760_mem_read(struct usb_hcd *hcd, u32 src_offset, void *dst,
+ {
+ struct isp1760_hcd *priv = hcd_to_priv(hcd);
+
+- isp1760_hcd_write(hcd, MEM_BANK_SEL, ISP_BANK_0);
+- isp1760_hcd_write(hcd, MEM_START_ADDR, src_offset);
++ isp1760_reg_write(priv->regs, ISP176x_HC_MEMORY, src_offset);
+ ndelay(100);
+
+ bank_reads8(priv->base, src_offset, ISP_BANK_0, dst, bytes);
+@@ -496,8 +496,7 @@ static void isp1760_ptd_read(struct usb_hcd *hcd, u32 ptd_offset, u32 slot,
+ u16 src_offset = ptd_offset + slot * sizeof(*ptd);
+ struct isp1760_hcd *priv = hcd_to_priv(hcd);
+
+- isp1760_hcd_write(hcd, MEM_BANK_SEL, ISP_BANK_0);
+- isp1760_hcd_write(hcd, MEM_START_ADDR, src_offset);
++ isp1760_reg_write(priv->regs, ISP176x_HC_MEMORY, src_offset);
+ ndelay(90);
+
+ bank_reads8(priv->base, src_offset, ISP_BANK_0, (void *)ptd,
+--
+2.30.2
+
--- /dev/null
+From 22cbe261a089ebff69b3f86b56488c4cbc1b2985 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 19:33:23 +0300
+Subject: usb: musb: musb_dsps: request_irq() after initializing musb
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+[ Upstream commit 7c75bde329d7e2a93cf86a5c15c61f96f1446cdc ]
+
+If IRQ occurs between calling dsps_setup_optional_vbus_irq()
+and dsps_create_musb_pdev(), then null pointer dereference occurs
+since glue->musb wasn't initialized yet.
+
+The patch puts initializing of neccesery data before registration
+of the interrupt handler.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210819163323.17714-1-lutovinova@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/musb_dsps.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
+index 5892f3ce0cdc..ce9fc46c9266 100644
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -890,23 +890,22 @@ static int dsps_probe(struct platform_device *pdev)
+ if (!glue->usbss_base)
+ return -ENXIO;
+
+- if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
+- ret = dsps_setup_optional_vbus_irq(pdev, glue);
+- if (ret)
+- goto err_iounmap;
+- }
+-
+ platform_set_drvdata(pdev, glue);
+ pm_runtime_enable(&pdev->dev);
+ ret = dsps_create_musb_pdev(glue, pdev);
+ if (ret)
+ goto err;
+
++ if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
++ ret = dsps_setup_optional_vbus_irq(pdev, glue);
++ if (ret)
++ goto err;
++ }
++
+ return 0;
+
+ err:
+ pm_runtime_disable(&pdev->dev);
+-err_iounmap:
+ iounmap(glue->usbss_base);
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 6d437d38583b3b90c4a71796bad0c18c488becdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 10:51:43 +0800
+Subject: usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit b8731209958a1dffccc2888121f4c0280c990550 ]
+
+xhci-mtk depends on xhci's internal virt_dev when it retrieves its
+internal data from usb_host_endpoint both in add_endpoint and
+drop_endpoint callbacks. But when setup packet was retired by
+transaction errors in xhci_setup_device() path, a virt_dev for the slot
+is newly created with real_port 0. This leads to xhci-mtks's NULL pointer
+dereference from drop_endpoint callback as xhci-mtk assumes that virt_dev's
+real_port is always started from one. The similar problems were addressed
+by [1] but that can't cover the failure cases from setup_device.
+
+This patch drops the usages of xhci's virt_dev in xhci-mtk's drop_endpoint
+callback by adopting rhashtable for searching mtk's schedule entity
+from a given usb_host_endpoint pointer instead of searching a linked list.
+So mtk's drop_endpoint callback doesn't have to rely on virt_dev at all.
+
+[1] https://lore.kernel.org/r/1617179142-2681-2-git-send-email-chunfeng.yun@mediatek.com
+
+Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
+Link: https://lore.kernel.org/r/20210805133731.1.Icc0f080e75b1312692d4c7c7d25e7df9fe1a05c2@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mtk-sch.c | 100 ++++++++++++++++----------------
+ drivers/usb/host/xhci-mtk.h | 11 +++-
+ 2 files changed, 60 insertions(+), 51 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 0bb1a6295d64..f8adf393875f 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -80,7 +80,7 @@ decode_ep(struct usb_host_endpoint *ep, enum usb_device_speed speed)
+ interval /= 1000;
+ }
+
+- snprintf(buf, DBG_BUF_EN, "%s ep%d%s %s, mpkt:%d, interval:%d/%d%s\n",
++ snprintf(buf, DBG_BUF_EN, "%s ep%d%s %s, mpkt:%d, interval:%d/%d%s",
+ usb_speed_string(speed), usb_endpoint_num(epd),
+ usb_endpoint_dir_in(epd) ? "in" : "out",
+ usb_ep_type_string(usb_endpoint_type(epd)),
+@@ -129,6 +129,10 @@ get_bw_info(struct xhci_hcd_mtk *mtk, struct usb_device *udev,
+ int bw_index;
+
+ virt_dev = xhci->devs[udev->slot_id];
++ if (!virt_dev->real_port) {
++ WARN_ONCE(1, "%s invalid real_port\n", dev_name(&udev->dev));
++ return NULL;
++ }
+
+ if (udev->speed >= USB_SPEED_SUPER) {
+ if (usb_endpoint_dir_out(&ep->desc))
+@@ -236,14 +240,20 @@ static void drop_tt(struct usb_device *udev)
+ }
+ }
+
+-static struct mu3h_sch_ep_info *create_sch_ep(struct usb_device *udev,
+- struct usb_host_endpoint *ep, struct xhci_ep_ctx *ep_ctx)
++static struct mu3h_sch_ep_info *
++create_sch_ep(struct xhci_hcd_mtk *mtk, struct usb_device *udev,
++ struct usb_host_endpoint *ep, struct xhci_ep_ctx *ep_ctx)
+ {
+ struct mu3h_sch_ep_info *sch_ep;
++ struct mu3h_sch_bw_info *bw_info;
+ struct mu3h_sch_tt *tt = NULL;
+ u32 len_bw_budget_table;
+ size_t mem_size;
+
++ bw_info = get_bw_info(mtk, udev, ep);
++ if (!bw_info)
++ return ERR_PTR(-ENODEV);
++
+ if (is_fs_or_ls(udev->speed))
+ len_bw_budget_table = TT_MICROFRAMES_MAX;
+ else if ((udev->speed >= USB_SPEED_SUPER)
+@@ -266,11 +276,13 @@ static struct mu3h_sch_ep_info *create_sch_ep(struct usb_device *udev,
+ }
+ }
+
++ sch_ep->bw_info = bw_info;
+ sch_ep->sch_tt = tt;
+ sch_ep->ep = ep;
+ sch_ep->speed = udev->speed;
+ INIT_LIST_HEAD(&sch_ep->endpoint);
+ INIT_LIST_HEAD(&sch_ep->tt_endpoint);
++ INIT_HLIST_NODE(&sch_ep->hentry);
+
+ return sch_ep;
+ }
+@@ -587,9 +599,9 @@ static u32 get_esit_boundary(struct mu3h_sch_ep_info *sch_ep)
+ return boundary;
+ }
+
+-static int check_sch_bw(struct mu3h_sch_bw_info *sch_bw,
+- struct mu3h_sch_ep_info *sch_ep)
++static int check_sch_bw(struct mu3h_sch_ep_info *sch_ep)
+ {
++ struct mu3h_sch_bw_info *sch_bw = sch_ep->bw_info;
+ const u32 esit_boundary = get_esit_boundary(sch_ep);
+ const u32 bw_boundary = get_bw_boundary(sch_ep->speed);
+ u32 offset;
+@@ -635,23 +647,26 @@ static int check_sch_bw(struct mu3h_sch_bw_info *sch_bw,
+ return load_ep_bw(sch_bw, sch_ep, true);
+ }
+
+-static void destroy_sch_ep(struct usb_device *udev,
+- struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep)
++static void destroy_sch_ep(struct xhci_hcd_mtk *mtk, struct usb_device *udev,
++ struct mu3h_sch_ep_info *sch_ep)
+ {
+ /* only release ep bw check passed by check_sch_bw() */
+ if (sch_ep->allocated)
+- load_ep_bw(sch_bw, sch_ep, false);
++ load_ep_bw(sch_ep->bw_info, sch_ep, false);
+
+ if (sch_ep->sch_tt)
+ drop_tt(udev);
+
+ list_del(&sch_ep->endpoint);
++ hlist_del(&sch_ep->hentry);
+ kfree(sch_ep);
+ }
+
+-static bool need_bw_sch(struct usb_host_endpoint *ep,
+- enum usb_device_speed speed, int has_tt)
++static bool need_bw_sch(struct usb_device *udev,
++ struct usb_host_endpoint *ep)
+ {
++ bool has_tt = udev->tt && udev->tt->hub->parent;
++
+ /* only for periodic endpoints */
+ if (usb_endpoint_xfer_control(&ep->desc)
+ || usb_endpoint_xfer_bulk(&ep->desc))
+@@ -662,7 +677,7 @@ static bool need_bw_sch(struct usb_host_endpoint *ep,
+ * a TT are also ignored, root-hub will schedule them directly,
+ * but need set @bpkts field of endpoint context to 1.
+ */
+- if (is_fs_or_ls(speed) && !has_tt)
++ if (is_fs_or_ls(udev->speed) && !has_tt)
+ return false;
+
+ /* skip endpoint with zero maxpkt */
+@@ -677,7 +692,6 @@ int xhci_mtk_sch_init(struct xhci_hcd_mtk *mtk)
+ struct xhci_hcd *xhci = hcd_to_xhci(mtk->hcd);
+ struct mu3h_sch_bw_info *sch_array;
+ int num_usb_bus;
+- int i;
+
+ /* ss IN and OUT are separated */
+ num_usb_bus = xhci->usb3_rhub.num_ports * 2 + xhci->usb2_rhub.num_ports;
+@@ -686,12 +700,10 @@ int xhci_mtk_sch_init(struct xhci_hcd_mtk *mtk)
+ if (sch_array == NULL)
+ return -ENOMEM;
+
+- for (i = 0; i < num_usb_bus; i++)
+- INIT_LIST_HEAD(&sch_array[i].bw_ep_list);
+-
+ mtk->sch_array = sch_array;
+
+ INIT_LIST_HEAD(&mtk->bw_ep_chk_list);
++ hash_init(mtk->sch_ep_hash);
+
+ return 0;
+ }
+@@ -715,9 +727,7 @@ static int add_ep_quirk(struct usb_hcd *hcd, struct usb_device *udev,
+ ep_index = xhci_get_endpoint_index(&ep->desc);
+ ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
+
+- xhci_dbg(xhci, "%s %s\n", __func__, decode_ep(ep, udev->speed));
+-
+- if (!need_bw_sch(ep, udev->speed, !!virt_dev->tt_info)) {
++ if (!need_bw_sch(udev, ep)) {
+ /*
+ * set @bpkts to 1 if it is LS or FS periodic endpoint, and its
+ * device does not connected through an external HS hub
+@@ -729,13 +739,16 @@ static int add_ep_quirk(struct usb_hcd *hcd, struct usb_device *udev,
+ return 0;
+ }
+
+- sch_ep = create_sch_ep(udev, ep, ep_ctx);
++ xhci_dbg(xhci, "%s %s\n", __func__, decode_ep(ep, udev->speed));
++
++ sch_ep = create_sch_ep(mtk, udev, ep, ep_ctx);
+ if (IS_ERR_OR_NULL(sch_ep))
+ return -ENOMEM;
+
+ setup_sch_info(ep_ctx, sch_ep);
+
+ list_add_tail(&sch_ep->endpoint, &mtk->bw_ep_chk_list);
++ hash_add(mtk->sch_ep_hash, &sch_ep->hentry, (unsigned long)ep);
+
+ return 0;
+ }
+@@ -745,22 +758,18 @@ static void drop_ep_quirk(struct usb_hcd *hcd, struct usb_device *udev,
+ {
+ struct xhci_hcd_mtk *mtk = hcd_to_mtk(hcd);
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct xhci_virt_device *virt_dev;
+- struct mu3h_sch_bw_info *sch_bw;
+- struct mu3h_sch_ep_info *sch_ep, *tmp;
+-
+- virt_dev = xhci->devs[udev->slot_id];
+-
+- xhci_dbg(xhci, "%s %s\n", __func__, decode_ep(ep, udev->speed));
++ struct mu3h_sch_ep_info *sch_ep;
++ struct hlist_node *hn;
+
+- if (!need_bw_sch(ep, udev->speed, !!virt_dev->tt_info))
++ if (!need_bw_sch(udev, ep))
+ return;
+
+- sch_bw = get_bw_info(mtk, udev, ep);
++ xhci_err(xhci, "%s %s\n", __func__, decode_ep(ep, udev->speed));
+
+- list_for_each_entry_safe(sch_ep, tmp, &sch_bw->bw_ep_list, endpoint) {
++ hash_for_each_possible_safe(mtk->sch_ep_hash, sch_ep,
++ hn, hentry, (unsigned long)ep) {
+ if (sch_ep->ep == ep) {
+- destroy_sch_ep(udev, sch_bw, sch_ep);
++ destroy_sch_ep(mtk, udev, sch_ep);
+ break;
+ }
+ }
+@@ -771,30 +780,22 @@ int xhci_mtk_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ struct xhci_hcd_mtk *mtk = hcd_to_mtk(hcd);
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev = xhci->devs[udev->slot_id];
+- struct mu3h_sch_bw_info *sch_bw;
+- struct mu3h_sch_ep_info *sch_ep, *tmp;
++ struct mu3h_sch_ep_info *sch_ep;
+ int ret;
+
+ xhci_dbg(xhci, "%s() udev %s\n", __func__, dev_name(&udev->dev));
+
+ list_for_each_entry(sch_ep, &mtk->bw_ep_chk_list, endpoint) {
+- sch_bw = get_bw_info(mtk, udev, sch_ep->ep);
++ struct xhci_ep_ctx *ep_ctx;
++ struct usb_host_endpoint *ep = sch_ep->ep;
++ unsigned int ep_index = xhci_get_endpoint_index(&ep->desc);
+
+- ret = check_sch_bw(sch_bw, sch_ep);
++ ret = check_sch_bw(sch_ep);
+ if (ret) {
+ xhci_err(xhci, "Not enough bandwidth! (%s)\n",
+ sch_error_string(-ret));
+ return -ENOSPC;
+ }
+- }
+-
+- list_for_each_entry_safe(sch_ep, tmp, &mtk->bw_ep_chk_list, endpoint) {
+- struct xhci_ep_ctx *ep_ctx;
+- struct usb_host_endpoint *ep = sch_ep->ep;
+- unsigned int ep_index = xhci_get_endpoint_index(&ep->desc);
+-
+- sch_bw = get_bw_info(mtk, udev, ep);
+- list_move_tail(&sch_ep->endpoint, &sch_bw->bw_ep_list);
+
+ ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
+ ep_ctx->reserved[0] = cpu_to_le32(EP_BPKTS(sch_ep->pkts)
+@@ -808,22 +809,23 @@ int xhci_mtk_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ sch_ep->offset, sch_ep->repeat);
+ }
+
+- return xhci_check_bandwidth(hcd, udev);
++ ret = xhci_check_bandwidth(hcd, udev);
++ if (!ret)
++ INIT_LIST_HEAD(&mtk->bw_ep_chk_list);
++
++ return ret;
+ }
+
+ void xhci_mtk_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd_mtk *mtk = hcd_to_mtk(hcd);
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct mu3h_sch_bw_info *sch_bw;
+ struct mu3h_sch_ep_info *sch_ep, *tmp;
+
+ xhci_dbg(xhci, "%s() udev %s\n", __func__, dev_name(&udev->dev));
+
+- list_for_each_entry_safe(sch_ep, tmp, &mtk->bw_ep_chk_list, endpoint) {
+- sch_bw = get_bw_info(mtk, udev, sch_ep->ep);
+- destroy_sch_ep(udev, sch_bw, sch_ep);
+- }
++ list_for_each_entry_safe(sch_ep, tmp, &mtk->bw_ep_chk_list, endpoint)
++ destroy_sch_ep(mtk, udev, sch_ep);
+
+ xhci_reset_bandwidth(hcd, udev);
+ }
+diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
+index ace432356c41..f87d199b0818 100644
+--- a/drivers/usb/host/xhci-mtk.h
++++ b/drivers/usb/host/xhci-mtk.h
+@@ -10,11 +10,15 @@
+ #define _XHCI_MTK_H_
+
+ #include <linux/clk.h>
++#include <linux/hashtable.h>
+
+ #include "xhci.h"
+
+ #define BULK_CLKS_NUM 5
+
++/* support at most 64 ep, use 32 size hash table */
++#define SCH_EP_HASH_BITS 5
++
+ /**
+ * To simplify scheduler algorithm, set a upper limit for ESIT,
+ * if a synchromous ep's ESIT is larger than @XHCI_MTK_MAX_ESIT,
+@@ -36,14 +40,12 @@ struct mu3h_sch_tt {
+ * struct mu3h_sch_bw_info: schedule information for bandwidth domain
+ *
+ * @bus_bw: array to keep track of bandwidth already used at each uframes
+- * @bw_ep_list: eps in the bandwidth domain
+ *
+ * treat a HS root port as a bandwidth domain, but treat a SS root port as
+ * two bandwidth domains, one for IN eps and another for OUT eps.
+ */
+ struct mu3h_sch_bw_info {
+ u32 bus_bw[XHCI_MTK_MAX_ESIT];
+- struct list_head bw_ep_list;
+ };
+
+ /**
+@@ -53,8 +55,10 @@ struct mu3h_sch_bw_info {
+ * @num_budget_microframes: number of continuous uframes
+ * (@repeat==1) scheduled within the interval
+ * @bw_cost_per_microframe: bandwidth cost per microframe
++ * @hentry: hash table entry
+ * @endpoint: linked into bandwidth domain which it belongs to
+ * @tt_endpoint: linked into mu3h_sch_tt's list which it belongs to
++ * @bw_info: bandwidth domain which this endpoint belongs
+ * @sch_tt: mu3h_sch_tt linked into
+ * @ep_type: endpoint type
+ * @maxpkt: max packet size of endpoint
+@@ -82,7 +86,9 @@ struct mu3h_sch_ep_info {
+ u32 num_budget_microframes;
+ u32 bw_cost_per_microframe;
+ struct list_head endpoint;
++ struct hlist_node hentry;
+ struct list_head tt_endpoint;
++ struct mu3h_sch_bw_info *bw_info;
+ struct mu3h_sch_tt *sch_tt;
+ u32 ep_type;
+ u32 maxpkt;
+@@ -135,6 +141,7 @@ struct xhci_hcd_mtk {
+ struct usb_hcd *hcd;
+ struct mu3h_sch_bw_info *sch_array;
+ struct list_head bw_ep_chk_list;
++ DECLARE_HASHTABLE(sch_ep_hash, SCH_EP_HASH_BITS);
+ struct mu3c_ippc_regs __iomem *ippc_regs;
+ int num_u2_ports;
+ int num_u3_ports;
+--
+2.30.2
+
--- /dev/null
+From 6be2286cd19c77184c242e0fb7236985a48b11f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 16:36:23 +0800
+Subject: usb: xhci-mtk: fix use-after-free of mtk->hcd
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 7f85c16f40d8be5656fb3476909db5c3a5a9c6ea ]
+
+ BUG: KASAN: use-after-free in usb_hcd_is_primary_hcd+0x38/0x60
+ Call trace:
+ dump_backtrace+0x0/0x3dc
+ show_stack+0x20/0x2c
+ dump_stack+0x15c/0x1d4
+ print_address_description+0x7c/0x510
+ kasan_report+0x164/0x1ac
+ __asan_report_load8_noabort+0x44/0x50
+ usb_hcd_is_primary_hcd+0x38/0x60
+ xhci_mtk_runtime_suspend+0x68/0x148
+ pm_generic_runtime_suspend+0x90/0xac
+ __rpm_callback+0xb8/0x1f4
+ rpm_callback+0x54/0x1d0
+ rpm_suspend+0x4e0/0xc84
+ __pm_runtime_suspend+0xc4/0x114
+ xhci_mtk_probe+0xa58/0xd00
+
+This may happen when probe fails, needn't suspend it synchronously,
+fix it by using pm_runtime_put_noidle().
+
+Reported-by: Pi Hsun <pihsun@google.com>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1629189389-18779-3-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mtk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 2548976bcf05..cb27569186a0 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -569,7 +569,7 @@ static int xhci_mtk_probe(struct platform_device *pdev)
+ xhci_mtk_ldos_disable(mtk);
+
+ disable_pm:
+- pm_runtime_put_sync_autosuspend(dev);
++ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 6d94827aa2caceb341953fa89603491749f66ca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 00:31:21 +0530
+Subject: usbip: give back URBs for unsent unlink requests during cleanup
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+[ Upstream commit 258c81b341c8025d79073ce2d6ce19dcdc7d10d2 ]
+
+In vhci_device_unlink_cleanup(), the URBs for unsent unlink requests are
+not given back. This sometimes causes usb_kill_urb to wait indefinitely
+for that urb to be given back. syzbot has reported a hung task issue [1]
+for this.
+
+To fix this, give back the urbs corresponding to unsent unlink requests
+(unlink_tx list) similar to how urbs corresponding to unanswered unlink
+requests (unlink_rx list) are given back.
+
+[1]: https://syzkaller.appspot.com/bug?id=08f12df95ae7da69814e64eb5515d5a85ed06b76
+
+Reported-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com
+Tested-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com
+Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
+Link: https://lore.kernel.org/r/20210820190122.16379-2-mail@anirudhrb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 4ba6bcdaa8e9..190bd3d1c1f0 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -957,8 +957,32 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
+ spin_lock(&vdev->priv_lock);
+
+ list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
++ struct urb *urb;
++
++ /* give back urb of unsent unlink request */
+ pr_info("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
++
++ urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
++ if (!urb) {
++ list_del(&unlink->list);
++ kfree(unlink);
++ continue;
++ }
++
++ urb->status = -ENODEV;
++
++ usb_hcd_unlink_urb_from_ep(hcd, urb);
++
+ list_del(&unlink->list);
++
++ spin_unlock(&vdev->priv_lock);
++ spin_unlock_irqrestore(&vhci->lock, flags);
++
++ usb_hcd_giveback_urb(hcd, urb, urb->status);
++
++ spin_lock_irqsave(&vhci->lock, flags);
++ spin_lock(&vdev->priv_lock);
++
+ kfree(unlink);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From fa76d3659767a41e08ec626468e50aaa1559571f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 16:59:37 -0600
+Subject: usbip:vhci_hcd USB port can get stuck in the disabled state
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 66cce9e73ec61967ed1f97f30cee79bd9a2bb7ee ]
+
+When a remote usb device is attached to the local Virtual USB
+Host Controller Root Hub port, the bound device driver may send
+a port reset command.
+
+vhci_hcd accepts port resets only when the device doesn't have
+port address assigned to it. When reset happens device is in
+assigned/used state and vhci_hcd rejects it leaving the port in
+a stuck state.
+
+This problem was found when a blue-tooth or xbox wireless dongle
+was passed through using usbip.
+
+A few drivers reset the port during probe including mt76 driver
+specific to this bug report. Fix the problem with a change to
+honor reset requests when device is in used state (VDEV_ST_USED).
+
+Reported-and-tested-by: Michael <msbroadf@gmail.com>
+Suggested-by: Michael <msbroadf@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20210819225937.41037-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 190bd3d1c1f0..b07b2925ff78 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -455,8 +455,14 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET);
+ vhci_hcd->re_timeout = 0;
+
++ /*
++ * A few drivers do usb reset during probe when
++ * the device could be in VDEV_ST_USED state
++ */
+ if (vhci_hcd->vdev[rhport].ud.status ==
+- VDEV_ST_NOTASSIGNED) {
++ VDEV_ST_NOTASSIGNED ||
++ vhci_hcd->vdev[rhport].ud.status ==
++ VDEV_ST_USED) {
+ usbip_dbg_vhci_rh(
+ " enable rhport %d (status %u)\n",
+ rhport,
+--
+2.30.2
+
--- /dev/null
+From 8754222838308c2c128854873d1074782e48a81d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 14:58:59 -0700
+Subject: userfaultfd: prevent concurrent API initialization
+
+From: Nadav Amit <namit@vmware.com>
+
+[ Upstream commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 ]
+
+userfaultfd assumes that the enabled features are set once and never
+changed after UFFDIO_API ioctl succeeded.
+
+However, currently, UFFDIO_API can be called concurrently from two
+different threads, succeed on both threads and leave userfaultfd's
+features in non-deterministic state. Theoretically, other uffd operations
+(ioctl's and page-faults) can be dispatched while adversely affected by
+such changes of features.
+
+Moreover, the writes to ctx->state and ctx->features are not ordered,
+which can - theoretically, again - let userfaultfd_ioctl() think that
+userfaultfd API completed, while the features are still not initialized.
+
+To avoid races, it is arguably best to get rid of ctx->state. Since there
+are only 2 states, record the API initialization in ctx->features as the
+uppermost bit and remove ctx->state.
+
+Link: https://lkml.kernel.org/r/20210808020724.1022515-3-namit@vmware.com
+Fixes: 9cd75c3cd4c3d ("userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor")
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Axel Rasmussen <axelrasmussen@google.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
+Cc: Peter Xu <peterx@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/userfaultfd.c | 91 +++++++++++++++++++++++-------------------------
+ 1 file changed, 44 insertions(+), 47 deletions(-)
+
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 5c2d806e6ae5..c830cc4ea60f 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -33,11 +33,6 @@ int sysctl_unprivileged_userfaultfd __read_mostly;
+
+ static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
+
+-enum userfaultfd_state {
+- UFFD_STATE_WAIT_API,
+- UFFD_STATE_RUNNING,
+-};
+-
+ /*
+ * Start with fault_pending_wqh and fault_wqh so they're more likely
+ * to be in the same cacheline.
+@@ -69,8 +64,6 @@ struct userfaultfd_ctx {
+ unsigned int flags;
+ /* features requested from the userspace */
+ unsigned int features;
+- /* state machine */
+- enum userfaultfd_state state;
+ /* released */
+ bool released;
+ /* memory mappings are changing because of non-cooperative event */
+@@ -104,6 +97,14 @@ struct userfaultfd_wake_range {
+ unsigned long len;
+ };
+
++/* internal indication that UFFD_API ioctl was successfully executed */
++#define UFFD_FEATURE_INITIALIZED (1u << 31)
++
++static bool userfaultfd_is_initialized(struct userfaultfd_ctx *ctx)
++{
++ return ctx->features & UFFD_FEATURE_INITIALIZED;
++}
++
+ static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode,
+ int wake_flags, void *key)
+ {
+@@ -666,7 +667,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
+
+ refcount_set(&ctx->refcount, 1);
+ ctx->flags = octx->flags;
+- ctx->state = UFFD_STATE_RUNNING;
+ ctx->features = octx->features;
+ ctx->released = false;
+ ctx->mmap_changing = false;
+@@ -943,38 +943,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)
+
+ poll_wait(file, &ctx->fd_wqh, wait);
+
+- switch (ctx->state) {
+- case UFFD_STATE_WAIT_API:
++ if (!userfaultfd_is_initialized(ctx))
+ return EPOLLERR;
+- case UFFD_STATE_RUNNING:
+- /*
+- * poll() never guarantees that read won't block.
+- * userfaults can be waken before they're read().
+- */
+- if (unlikely(!(file->f_flags & O_NONBLOCK)))
+- return EPOLLERR;
+- /*
+- * lockless access to see if there are pending faults
+- * __pollwait last action is the add_wait_queue but
+- * the spin_unlock would allow the waitqueue_active to
+- * pass above the actual list_add inside
+- * add_wait_queue critical section. So use a full
+- * memory barrier to serialize the list_add write of
+- * add_wait_queue() with the waitqueue_active read
+- * below.
+- */
+- ret = 0;
+- smp_mb();
+- if (waitqueue_active(&ctx->fault_pending_wqh))
+- ret = EPOLLIN;
+- else if (waitqueue_active(&ctx->event_wqh))
+- ret = EPOLLIN;
+
+- return ret;
+- default:
+- WARN_ON_ONCE(1);
++ /*
++ * poll() never guarantees that read won't block.
++ * userfaults can be waken before they're read().
++ */
++ if (unlikely(!(file->f_flags & O_NONBLOCK)))
+ return EPOLLERR;
+- }
++ /*
++ * lockless access to see if there are pending faults
++ * __pollwait last action is the add_wait_queue but
++ * the spin_unlock would allow the waitqueue_active to
++ * pass above the actual list_add inside
++ * add_wait_queue critical section. So use a full
++ * memory barrier to serialize the list_add write of
++ * add_wait_queue() with the waitqueue_active read
++ * below.
++ */
++ ret = 0;
++ smp_mb();
++ if (waitqueue_active(&ctx->fault_pending_wqh))
++ ret = EPOLLIN;
++ else if (waitqueue_active(&ctx->event_wqh))
++ ret = EPOLLIN;
++
++ return ret;
+ }
+
+ static const struct file_operations userfaultfd_fops;
+@@ -1169,7 +1164,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
+ int no_wait = file->f_flags & O_NONBLOCK;
+ struct inode *inode = file_inode(file);
+
+- if (ctx->state == UFFD_STATE_WAIT_API)
++ if (!userfaultfd_is_initialized(ctx))
+ return -EINVAL;
+
+ for (;;) {
+@@ -1908,9 +1903,10 @@ static int userfaultfd_continue(struct userfaultfd_ctx *ctx, unsigned long arg)
+ static inline unsigned int uffd_ctx_features(__u64 user_features)
+ {
+ /*
+- * For the current set of features the bits just coincide
++ * For the current set of features the bits just coincide. Set
++ * UFFD_FEATURE_INITIALIZED to mark the features as enabled.
+ */
+- return (unsigned int)user_features;
++ return (unsigned int)user_features | UFFD_FEATURE_INITIALIZED;
+ }
+
+ /*
+@@ -1923,12 +1919,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ {
+ struct uffdio_api uffdio_api;
+ void __user *buf = (void __user *)arg;
++ unsigned int ctx_features;
+ int ret;
+ __u64 features;
+
+- ret = -EINVAL;
+- if (ctx->state != UFFD_STATE_WAIT_API)
+- goto out;
+ ret = -EFAULT;
+ if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
+ goto out;
+@@ -1952,9 +1946,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ ret = -EFAULT;
+ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
+ goto out;
+- ctx->state = UFFD_STATE_RUNNING;
++
+ /* only enable the requested features for this uffd context */
+- ctx->features = uffd_ctx_features(features);
++ ctx_features = uffd_ctx_features(features);
++ ret = -EINVAL;
++ if (cmpxchg(&ctx->features, 0, ctx_features) != 0)
++ goto err_out;
++
+ ret = 0;
+ out:
+ return ret;
+@@ -1971,7 +1969,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,
+ int ret = -EINVAL;
+ struct userfaultfd_ctx *ctx = file->private_data;
+
+- if (cmd != UFFDIO_API && ctx->state == UFFD_STATE_WAIT_API)
++ if (cmd != UFFDIO_API && !userfaultfd_is_initialized(ctx))
+ return -EINVAL;
+
+ switch(cmd) {
+@@ -2085,7 +2083,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
+ refcount_set(&ctx->refcount, 1);
+ ctx->flags = flags;
+ ctx->features = 0;
+- ctx->state = UFFD_STATE_WAIT_API;
+ ctx->released = false;
+ ctx->mmap_changing = false;
+ ctx->mm = current->mm;
+--
+2.30.2
+
--- /dev/null
+From c66d33ab0fae551ec493c5148336b77e81a8a401 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 22:18:58 -0300
+Subject: vfio/mbochs: Fix missing error unwind of mbochs_used_mbytes
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit de5494af4815a4c9328536c72741229b7de88e7f ]
+
+Convert mbochs to use an atomic scheme for this like mtty was changed
+into. The atomic fixes various race conditions with probing. Add the
+missing error unwind. Also add the missing kfree of mdev_state->pages.
+
+Fixes: 681c1615f891 ("vfio/mbochs: Convert to use vfio_register_group_dev()")
+Reported-by: Cornelia Huck <cohuck@redhat.com>
+Co-developed-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Link: https://lore.kernel.org/r/2-v4-9ea22c5e6afb+1adf-vfio_reflck_jgg@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfio-mdev/mbochs.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
+index 6c0f229db36a..b4aaeab37754 100644
+--- a/samples/vfio-mdev/mbochs.c
++++ b/samples/vfio-mdev/mbochs.c
+@@ -129,7 +129,7 @@ static dev_t mbochs_devt;
+ static struct class *mbochs_class;
+ static struct cdev mbochs_cdev;
+ static struct device mbochs_dev;
+-static int mbochs_used_mbytes;
++static atomic_t mbochs_avail_mbytes;
+ static const struct vfio_device_ops mbochs_dev_ops;
+
+ struct vfio_region_info_ext {
+@@ -507,18 +507,22 @@ static int mbochs_reset(struct mdev_state *mdev_state)
+
+ static int mbochs_probe(struct mdev_device *mdev)
+ {
++ int avail_mbytes = atomic_read(&mbochs_avail_mbytes);
+ const struct mbochs_type *type =
+ &mbochs_types[mdev_get_type_group_id(mdev)];
+ struct device *dev = mdev_dev(mdev);
+ struct mdev_state *mdev_state;
+ int ret = -ENOMEM;
+
+- if (type->mbytes + mbochs_used_mbytes > max_mbytes)
+- return -ENOMEM;
++ do {
++ if (avail_mbytes < type->mbytes)
++ return -ENOSPC;
++ } while (!atomic_try_cmpxchg(&mbochs_avail_mbytes, &avail_mbytes,
++ avail_mbytes - type->mbytes));
+
+ mdev_state = kzalloc(sizeof(struct mdev_state), GFP_KERNEL);
+ if (mdev_state == NULL)
+- return -ENOMEM;
++ goto err_avail;
+ vfio_init_group_dev(&mdev_state->vdev, &mdev->dev, &mbochs_dev_ops);
+
+ mdev_state->vconfig = kzalloc(MBOCHS_CONFIG_SPACE_SIZE, GFP_KERNEL);
+@@ -549,17 +553,17 @@ static int mbochs_probe(struct mdev_device *mdev)
+ mbochs_create_config_space(mdev_state);
+ mbochs_reset(mdev_state);
+
+- mbochs_used_mbytes += type->mbytes;
+-
+ ret = vfio_register_group_dev(&mdev_state->vdev);
+ if (ret)
+ goto err_mem;
+ dev_set_drvdata(&mdev->dev, mdev_state);
+ return 0;
+-
+ err_mem:
++ kfree(mdev_state->pages);
+ kfree(mdev_state->vconfig);
+ kfree(mdev_state);
++err_avail:
++ atomic_add(type->mbytes, &mbochs_avail_mbytes);
+ return ret;
+ }
+
+@@ -567,8 +571,8 @@ static void mbochs_remove(struct mdev_device *mdev)
+ {
+ struct mdev_state *mdev_state = dev_get_drvdata(&mdev->dev);
+
+- mbochs_used_mbytes -= mdev_state->type->mbytes;
+ vfio_unregister_group_dev(&mdev_state->vdev);
++ atomic_add(mdev_state->type->mbytes, &mbochs_avail_mbytes);
+ kfree(mdev_state->pages);
+ kfree(mdev_state->vconfig);
+ kfree(mdev_state);
+@@ -1355,7 +1359,7 @@ static ssize_t available_instances_show(struct mdev_type *mtype,
+ {
+ const struct mbochs_type *type =
+ &mbochs_types[mtype_get_type_group_id(mtype)];
+- int count = (max_mbytes - mbochs_used_mbytes) / type->mbytes;
++ int count = atomic_read(&mbochs_avail_mbytes) / type->mbytes;
+
+ return sprintf(buf, "%d\n", count);
+ }
+@@ -1437,6 +1441,8 @@ static int __init mbochs_dev_init(void)
+ {
+ int ret = 0;
+
++ atomic_set(&mbochs_avail_mbytes, max_mbytes);
++
+ ret = alloc_chrdev_region(&mbochs_devt, 0, MINORMASK + 1, MBOCHS_NAME);
+ if (ret < 0) {
+ pr_err("Error: failed to register mbochs_dev, err: %d\n", ret);
+--
+2.30.2
+
--- /dev/null
+From 9c94d23856dc8405058920b5c8874bcd79a5ba1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 15:39:12 -0300
+Subject: vfio: Use config not menuconfig for VFIO_NOIOMMU
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 26c22cfde5dd6e63f25c48458b0185dcb0fbb2fd ]
+
+VFIO_NOIOMMU is supposed to be an element in the VFIO menu, not start
+a new menu. Correct this copy-paste mistake.
+
+Fixes: 03a76b60f8ba ("vfio: Include No-IOMMU mode")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Link: https://lore.kernel.org/r/0-v1-3f0b685c3679+478-vfio_menuconfig_jgg@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
+index 67d0bf4efa16..e44bf736e2b2 100644
+--- a/drivers/vfio/Kconfig
++++ b/drivers/vfio/Kconfig
+@@ -29,7 +29,7 @@ menuconfig VFIO
+
+ If you don't know what to do here, say N.
+
+-menuconfig VFIO_NOIOMMU
++config VFIO_NOIOMMU
+ bool "VFIO No-IOMMU support"
+ depends on VFIO
+ help
+--
+2.30.2
+
--- /dev/null
+From 795d13c75e505fa4d22c2460df33bae03c538362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 10:03:53 +0000
+Subject: video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]
+
+The userspace program could pass any values to the driver through
+ioctl() interface. If the driver doesn't check the value of 'pixclock',
+it may cause divide error.
+
+Fix this by checking whether 'pixclock' is zero first.
+
+The following log reveals it:
+
+[ 43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
+[ 43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
+[ 43.861843] Call Trace:
+[ 43.861848] ? asiliantfb_remove+0x190/0x190
+[ 43.861858] fb_set_var+0x2e4/0xeb0
+[ 43.861866] ? fb_blank+0x1a0/0x1a0
+[ 43.861873] ? lock_acquire+0x1ef/0x530
+[ 43.861884] ? lock_release+0x810/0x810
+[ 43.861892] ? lock_is_held_type+0x100/0x140
+[ 43.861903] ? ___might_sleep+0x1ee/0x2d0
+[ 43.861914] ? __mutex_lock+0x620/0x1190
+[ 43.861921] ? do_fb_ioctl+0x313/0x700
+[ 43.861929] ? mutex_lock_io_nested+0xfa0/0xfa0
+[ 43.861936] ? __this_cpu_preempt_check+0x1d/0x30
+[ 43.861944] ? _raw_spin_unlock_irqrestore+0x46/0x60
+[ 43.861952] ? lockdep_hardirqs_on+0x59/0x100
+[ 43.861959] ? _raw_spin_unlock_irqrestore+0x46/0x60
+[ 43.861967] ? trace_hardirqs_on+0x6a/0x1c0
+[ 43.861978] do_fb_ioctl+0x31e/0x700
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyuma97@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/asiliantfb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
+index 3e006da47752..84c56f525889 100644
+--- a/drivers/video/fbdev/asiliantfb.c
++++ b/drivers/video/fbdev/asiliantfb.c
+@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var,
+ {
+ unsigned long Ftarget, ratio, remainder;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ ratio = 1000000 / var->pixclock;
+ remainder = 1000000 % var->pixclock;
+ Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock;
+--
+2.30.2
+
--- /dev/null
+From 03275c6c986f1fa3ffd61a0e405451f3855240ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 10:03:54 +0000
+Subject: video: fbdev: kyro: Error out if 'pixclock' equals zero
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]
+
+The userspace program could pass any values to the driver through
+ioctl() interface. if the driver doesn't check the value of 'pixclock',
+it may cause divide error because the value of 'lineclock' and
+'frameclock' will be zero.
+
+Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().
+
+The following log reveals it:
+
+[ 103.073930] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118
+[ 103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80
+[ 103.074045] Call Trace:
+[ 103.074048] ? ___might_sleep+0x1ee/0x2d0
+[ 103.074060] ? kyrofb_ioctl+0x330/0x330
+[ 103.074069] fb_set_var+0x5bf/0xeb0
+[ 103.074078] ? fb_blank+0x1a0/0x1a0
+[ 103.074085] ? lock_acquire+0x3bd/0x530
+[ 103.074094] ? lock_release+0x810/0x810
+[ 103.074103] ? ___might_sleep+0x1ee/0x2d0
+[ 103.074114] ? __mutex_lock+0x620/0x1190
+[ 103.074126] ? trace_hardirqs_on+0x6a/0x1c0
+[ 103.074137] do_fb_ioctl+0x31e/0x700
+[ 103.074144] ? fb_getput_cmap+0x280/0x280
+[ 103.074152] ? rcu_read_lock_sched_held+0x11/0x80
+[ 103.074162] ? rcu_read_lock_sched_held+0x11/0x80
+[ 103.074171] ? __sanitizer_cov_trace_switch+0x67/0xf0
+[ 103.074181] ? __sanitizer_cov_trace_const_cmp2+0x20/0x80
+[ 103.074191] ? do_vfs_ioctl+0x14b/0x16c0
+[ 103.074199] ? vfs_fileattr_set+0xb60/0xb60
+[ 103.074207] ? rcu_read_lock_sched_held+0x11/0x80
+[ 103.074216] ? lock_release+0x483/0x810
+[ 103.074224] ? __fget_files+0x217/0x3d0
+[ 103.074234] ? __fget_files+0x239/0x3d0
+[ 103.074243] ? do_fb_ioctl+0x700/0x700
+[ 103.074250] fb_ioctl+0xe6/0x130
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-3-git-send-email-zheyuma97@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/kyro/fbdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
+index 4b8c7c16b1df..25801e8e3f74 100644
+--- a/drivers/video/fbdev/kyro/fbdev.c
++++ b/drivers/video/fbdev/kyro/fbdev.c
+@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
+ struct kyrofb_info *par = info->par;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
+ printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel);
+ return -EINVAL;
+--
+2.30.2
+
--- /dev/null
+From 05b7d8927df22b71fb70f34ea0b682cd3d96f746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 04:09:22 +0000
+Subject: video: fbdev: kyro: fix a DoS bug by restricting user input
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]
+
+The user can pass in any value to the driver through the 'ioctl'
+interface. The driver dost not check, which may cause DoS bugs.
+
+The following log reveals it:
+
+divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+RIP: 0010:SetOverlayViewPort+0x133/0x5f0 drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476
+Call Trace:
+ kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline]
+ kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603
+ do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171
+ fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185
+ vfs_ioctl fs/ioctl.c:48 [inline]
+ __do_sys_ioctl fs/ioctl.c:753 [inline]
+ __se_sys_ioctl fs/ioctl.c:739 [inline]
+ __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739
+ do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1626235762-2590-1-git-send-email-zheyuma97@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/kyro/fbdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
+index 8fbde92ae8b9..4b8c7c16b1df 100644
+--- a/drivers/video/fbdev/kyro/fbdev.c
++++ b/drivers/video/fbdev/kyro/fbdev.c
+@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight
+ /* probably haven't called CreateOverlay yet */
+ return -EINVAL;
+
++ if (ulWidth == 0 || ulWidth == 0xffffffff ||
++ ulHeight == 0 || ulHeight == 0xffffffff ||
++ (x < 2 && ulWidth + 2 == 0))
++ return -EINVAL;
++
+ /* Stop Ramdac Output */
+ DisableRamdacOutput(deviceInfo.pSTGReg);
+
+--
+2.30.2
+
--- /dev/null
+From 6fa75c9a8153b1ca844a1aae5ecd72ad70115bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 10:03:55 +0000
+Subject: video: fbdev: riva: Error out if 'pixclock' equals zero
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit f92763cb0feba247e0939ed137b495601fd072a5 ]
+
+The userspace program could pass any values to the driver through
+ioctl() interface. If the driver doesn't check the value of 'pixclock',
+it may cause divide error.
+
+Fix this by checking whether 'pixclock' is zero first.
+
+The following log reveals it:
+
+[ 33.396850] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 33.396864] CPU: 5 PID: 11754 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #222
+[ 33.396883] RIP: 0010:riva_load_video_mode+0x417/0xf70
+[ 33.396969] Call Trace:
+[ 33.396973] ? debug_smp_processor_id+0x1c/0x20
+[ 33.396984] ? tick_nohz_tick_stopped+0x1a/0x90
+[ 33.396996] ? rivafb_copyarea+0x3c0/0x3c0
+[ 33.397003] ? wake_up_klogd.part.0+0x99/0xd0
+[ 33.397014] ? vprintk_emit+0x110/0x4b0
+[ 33.397024] ? vprintk_default+0x26/0x30
+[ 33.397033] ? vprintk+0x9c/0x1f0
+[ 33.397041] ? printk+0xba/0xed
+[ 33.397054] ? record_print_text.cold+0x16/0x16
+[ 33.397063] ? __kasan_check_read+0x11/0x20
+[ 33.397074] ? profile_tick+0xc0/0x100
+[ 33.397084] ? __sanitizer_cov_trace_const_cmp4+0x24/0x80
+[ 33.397094] ? riva_set_rop_solid+0x2a0/0x2a0
+[ 33.397102] rivafb_set_par+0xbe/0x610
+[ 33.397111] ? riva_set_rop_solid+0x2a0/0x2a0
+[ 33.397119] fb_set_var+0x5bf/0xeb0
+[ 33.397127] ? fb_blank+0x1a0/0x1a0
+[ 33.397134] ? lock_acquire+0x1ef/0x530
+[ 33.397143] ? lock_release+0x810/0x810
+[ 33.397151] ? lock_is_held_type+0x100/0x140
+[ 33.397159] ? ___might_sleep+0x1ee/0x2d0
+[ 33.397170] ? __mutex_lock+0x620/0x1190
+[ 33.397180] ? trace_hardirqs_on+0x6a/0x1c0
+[ 33.397190] do_fb_ioctl+0x31e/0x700
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-4-git-send-email-zheyuma97@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/riva/fbdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
+index 55554b0433cb..84d5e23ad7d3 100644
+--- a/drivers/video/fbdev/riva/fbdev.c
++++ b/drivers/video/fbdev/riva/fbdev.c
+@@ -1084,6 +1084,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ int mode_valid = 0;
+
+ NVTRACE_ENTER();
++ if (!var->pixclock)
++ return -EINVAL;
++
+ switch (var->bits_per_pixel) {
+ case 1 ... 8:
+ var->red.offset = var->green.offset = var->blue.offset = 0;
+--
+2.30.2
+
--- /dev/null
+From ef0a73f0519be23b5fa3526c86d7f11705b37c2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 15:43:22 +0200
+Subject: vt: keyboard.c: make console an unsigned int
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 3df15d6f37246d2f12f53d915c41d806289d3d46 ]
+
+The console variable is used everywhere in some fun pointer path and
+array indexes and for some reason isn't always declared as unsigned.
+This plays havoc with some static analysis tools so mark the variable as
+unsigned so we "know" we can not wrap the arrays backwards here.
+
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reported-by: Jordy Zomer <jordy@pwning.systems>
+Link: https://lore.kernel.org/r/20210726134322.2274919-2-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/keyboard.c | 30 +++++++++++++++---------------
+ include/linux/vt_kern.h | 30 +++++++++++++++---------------
+ 2 files changed, 30 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 4b0d69042ceb..bf6efebeb4bd 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1171,7 +1171,7 @@ static inline unsigned char getleds(void)
+ *
+ * Check the status of a keyboard led flag and report it back
+ */
+-int vt_get_leds(int console, int flag)
++int vt_get_leds(unsigned int console, int flag)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ int ret;
+@@ -1193,7 +1193,7 @@ EXPORT_SYMBOL_GPL(vt_get_leds);
+ * Set the LEDs on a console. This is a wrapper for the VT layer
+ * so that we can keep kbd knowledge internal
+ */
+-void vt_set_led_state(int console, int leds)
++void vt_set_led_state(unsigned int console, int leds)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ setledstate(kb, leds);
+@@ -1212,7 +1212,7 @@ void vt_set_led_state(int console, int leds)
+ * don't hold the lock. We probably need to split out an LED lock
+ * but not during an -rc release!
+ */
+-void vt_kbd_con_start(int console)
++void vt_kbd_con_start(unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+@@ -1229,7 +1229,7 @@ void vt_kbd_con_start(int console)
+ * Handle console stop. This is a wrapper for the VT layer
+ * so that we can keep kbd knowledge internal
+ */
+-void vt_kbd_con_stop(int console)
++void vt_kbd_con_stop(unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+@@ -1825,7 +1825,7 @@ int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
+ * Update the keyboard mode bits while holding the correct locks.
+ * Return 0 for success or an error code.
+ */
+-int vt_do_kdskbmode(int console, unsigned int arg)
++int vt_do_kdskbmode(unsigned int console, unsigned int arg)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ int ret = 0;
+@@ -1865,7 +1865,7 @@ int vt_do_kdskbmode(int console, unsigned int arg)
+ * Update the keyboard meta bits while holding the correct locks.
+ * Return 0 for success or an error code.
+ */
+-int vt_do_kdskbmeta(int console, unsigned int arg)
++int vt_do_kdskbmeta(unsigned int console, unsigned int arg)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ int ret = 0;
+@@ -2008,7 +2008,7 @@ static int vt_kdskbent(unsigned char kbdmode, unsigned char idx,
+ }
+
+ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
+- int console)
++ unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ struct kbentry kbe;
+@@ -2097,7 +2097,7 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ return ret;
+ }
+
+-int vt_do_kdskled(int console, int cmd, unsigned long arg, int perm)
++int vt_do_kdskled(unsigned int console, int cmd, unsigned long arg, int perm)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+@@ -2139,7 +2139,7 @@ int vt_do_kdskled(int console, int cmd, unsigned long arg, int perm)
+ return -ENOIOCTLCMD;
+ }
+
+-int vt_do_kdgkbmode(int console)
++int vt_do_kdgkbmode(unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ /* This is a spot read so needs no locking */
+@@ -2163,7 +2163,7 @@ int vt_do_kdgkbmode(int console)
+ *
+ * Report the meta flag status of this console
+ */
+-int vt_do_kdgkbmeta(int console)
++int vt_do_kdgkbmeta(unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ /* Again a spot read so no locking */
+@@ -2176,7 +2176,7 @@ int vt_do_kdgkbmeta(int console)
+ *
+ * Restore the unicode console state to its default
+ */
+-void vt_reset_unicode(int console)
++void vt_reset_unicode(unsigned int console)
+ {
+ unsigned long flags;
+
+@@ -2204,7 +2204,7 @@ int vt_get_shift_state(void)
+ * Reset the keyboard bits for a console as part of a general console
+ * reset event
+ */
+-void vt_reset_keyboard(int console)
++void vt_reset_keyboard(unsigned int console)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+@@ -2234,7 +2234,7 @@ void vt_reset_keyboard(int console)
+ * caller must be sure that there are no synchronization needs
+ */
+
+-int vt_get_kbd_mode_bit(int console, int bit)
++int vt_get_kbd_mode_bit(unsigned int console, int bit)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ return vc_kbd_mode(kb, bit);
+@@ -2249,7 +2249,7 @@ int vt_get_kbd_mode_bit(int console, int bit)
+ * caller must be sure that there are no synchronization needs
+ */
+
+-void vt_set_kbd_mode_bit(int console, int bit)
++void vt_set_kbd_mode_bit(unsigned int console, int bit)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+@@ -2268,7 +2268,7 @@ void vt_set_kbd_mode_bit(int console, int bit)
+ * caller must be sure that there are no synchronization needs
+ */
+
+-void vt_clr_kbd_mode_bit(int console, int bit)
++void vt_clr_kbd_mode_bit(unsigned int console, int bit)
+ {
+ struct kbd_struct *kb = kbd_table + console;
+ unsigned long flags;
+diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
+index 0da94a6dee15..b5ab452fca5b 100644
+--- a/include/linux/vt_kern.h
++++ b/include/linux/vt_kern.h
+@@ -148,26 +148,26 @@ void hide_boot_cursor(bool hide);
+
+ /* keyboard provided interfaces */
+ int vt_do_diacrit(unsigned int cmd, void __user *up, int eperm);
+-int vt_do_kdskbmode(int console, unsigned int arg);
+-int vt_do_kdskbmeta(int console, unsigned int arg);
++int vt_do_kdskbmode(unsigned int console, unsigned int arg);
++int vt_do_kdskbmeta(unsigned int console, unsigned int arg);
+ int vt_do_kbkeycode_ioctl(int cmd, struct kbkeycode __user *user_kbkc,
+ int perm);
+ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
+- int console);
++ unsigned int console);
+ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm);
+-int vt_do_kdskled(int console, int cmd, unsigned long arg, int perm);
+-int vt_do_kdgkbmode(int console);
+-int vt_do_kdgkbmeta(int console);
+-void vt_reset_unicode(int console);
++int vt_do_kdskled(unsigned int console, int cmd, unsigned long arg, int perm);
++int vt_do_kdgkbmode(unsigned int console);
++int vt_do_kdgkbmeta(unsigned int console);
++void vt_reset_unicode(unsigned int console);
+ int vt_get_shift_state(void);
+-void vt_reset_keyboard(int console);
+-int vt_get_leds(int console, int flag);
+-int vt_get_kbd_mode_bit(int console, int bit);
+-void vt_set_kbd_mode_bit(int console, int bit);
+-void vt_clr_kbd_mode_bit(int console, int bit);
+-void vt_set_led_state(int console, int leds);
+-void vt_kbd_con_start(int console);
+-void vt_kbd_con_stop(int console);
++void vt_reset_keyboard(unsigned int console);
++int vt_get_leds(unsigned int console, int flag);
++int vt_get_kbd_mode_bit(unsigned int console, int bit);
++void vt_set_kbd_mode_bit(unsigned int console, int bit);
++void vt_clr_kbd_mode_bit(unsigned int console, int bit);
++void vt_set_led_state(unsigned int console, int leds);
++void vt_kbd_con_start(unsigned int console);
++void vt_kbd_con_stop(unsigned int console);
+
+ void vc_scrolldelta_helper(struct vc_data *c, int lines,
+ unsigned int rolled_over, void *_base, unsigned int size);
+--
+2.30.2
+
--- /dev/null
+From ea28454d481dff4bfb8df29d5e8479eb33193105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 17:46:08 +0200
+Subject: wcn36xx: Fix missing frame timestamp for beacon/probe-resp
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 8678fd31f2d3eb14f2b8b39c9bc266f16fa24b22 ]
+
+When receiving a beacon or probe response, we should update the
+boottime_ns field which is the timestamp the frame was received at.
+(cf mac80211.h)
+
+This fixes a scanning issue with Android since it relies on this
+timestamp to determine when the AP has been seen for the last time
+(via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter).
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1629992768-23785-1-git-send-email-loic.poulain@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wcn36xx/txrx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
+index 1b831157ede1..cab196bb38cd 100644
+--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
++++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
+@@ -287,6 +287,10 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
+ status.rate_idx = 0;
+ }
+
++ if (ieee80211_is_beacon(hdr->frame_control) ||
++ ieee80211_is_probe_resp(hdr->frame_control))
++ status.boottime_ns = ktime_get_boottime_ns();
++
+ memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+ if (ieee80211_is_beacon(hdr->frame_control)) {
+--
+2.30.2
+
--- /dev/null
+From 879a02c269b20ae2c8cea69739d8aefcece8b4f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 11:03:52 +0800
+Subject: workqueue: Fix possible memory leaks in wq_numa_init()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit f728c4a9e8405caae69d4bc1232c54ff57b5d20f ]
+
+In error handling branch "if (WARN_ON(node == NUMA_NO_NODE))", the
+previously allocated memories are not released. Doing this before
+allocating memory eliminates memory leaks.
+
+tj: Note that the condition only occurs when the arch code is pretty broken
+and the WARN_ON might as well be BUG_ON().
+
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index f148eacda55a..542c2d03dab6 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -5902,6 +5902,13 @@ static void __init wq_numa_init(void)
+ return;
+ }
+
++ for_each_possible_cpu(cpu) {
++ if (WARN_ON(cpu_to_node(cpu) == NUMA_NO_NODE)) {
++ pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
++ return;
++ }
++ }
++
+ wq_update_unbound_numa_attrs_buf = alloc_workqueue_attrs();
+ BUG_ON(!wq_update_unbound_numa_attrs_buf);
+
+@@ -5919,11 +5926,6 @@ static void __init wq_numa_init(void)
+
+ for_each_possible_cpu(cpu) {
+ node = cpu_to_node(cpu);
+- if (WARN_ON(node == NUMA_NO_NODE)) {
+- pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
+- /* happens iff arch is bonkers, let's just proceed */
+- return;
+- }
+ cpumask_set_cpu(cpu, tbl[node]);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4c2660e95e3c916c7d231a31b73af1a7287cf5ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 08:35:21 +0530
+Subject: x86/hyperv: fix for unwanted manipulation of sched_clock when TSC
+ marked unstable
+
+From: Ani Sinha <ani@anisinha.ca>
+
+[ Upstream commit c445535c3efbfb8cb42d098e624d46ab149664b7 ]
+
+Marking TSC as unstable has a side effect of marking sched_clock as
+unstable when TSC is still being used as the sched_clock. This is not
+desirable. Hyper-V ultimately uses a paravirtualized clock source that
+provides a stable scheduler clock even on systems without TscInvariant
+CPU capability. Hence, mark_tsc_unstable() call should be called _after_
+scheduler clock has been changed to the paravirtualized clocksource. This
+will prevent any unwanted manipulation of the sched_clock. Only TSC will
+be correctly marked as unstable.
+
+Signed-off-by: Ani Sinha <ani@anisinha.ca>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Tested-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20210713030522.1714803-1-ani@anisinha.ca
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mshyperv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index c890d67a64ad..ba54c44a64e2 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -375,8 +375,6 @@ static void __init ms_hyperv_init_platform(void)
+ if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) {
+ wrmsrl(HV_X64_MSR_TSC_INVARIANT_CONTROL, 0x1);
+ setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
+- } else {
+- mark_tsc_unstable("running on Hyper-V");
+ }
+
+ /*
+@@ -437,6 +435,13 @@ static void __init ms_hyperv_init_platform(void)
+ /* Register Hyper-V specific clocksource */
+ hv_init_clocksource();
+ #endif
++ /*
++ * TSC should be marked as unstable only after Hyper-V
++ * clocksource has been initialized. This ensures that the
++ * stability of the sched_clock is not altered.
++ */
++ if (!(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT))
++ mark_tsc_unstable("running on Hyper-V");
+ }
+
+ static bool __init ms_hyperv_x2apic_available(void)
+--
+2.30.2
+
--- /dev/null
+From d77d824161473eb3d16b28ad5d34f6d0ef1da921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 14:44:24 -0400
+Subject: xprtrdma: Put rpcrdma_reps before waking the tear-down completion
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 97480cae13ca3a9c1de3eb6fd66cf9650a60db42 ]
+
+Ensure the tear-down completion is awoken only /after/ we've stopped
+fiddling with rpcrdma_rep objects in rpcrdma_post_recvs().
+
+Fixes: 15788d1d1077 ("xprtrdma: Do not refresh Receive Queue while it is draining")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 649c23518ec0..5a11e318a0d9 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1416,11 +1416,6 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp)
+
+ rc = ib_post_recv(ep->re_id->qp, wr,
+ (const struct ib_recv_wr **)&bad_wr);
+- if (atomic_dec_return(&ep->re_receiving) > 0)
+- complete(&ep->re_done);
+-
+-out:
+- trace_xprtrdma_post_recvs(r_xprt, count, rc);
+ if (rc) {
+ for (wr = bad_wr; wr;) {
+ struct rpcrdma_rep *rep;
+@@ -1431,6 +1426,11 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp)
+ --count;
+ }
+ }
++ if (atomic_dec_return(&ep->re_receiving) > 0)
++ complete(&ep->re_done);
++
++out:
++ trace_xprtrdma_post_recvs(r_xprt, count, rc);
+ ep->re_receive_count += count;
+ return;
+ }
+--
+2.30.2
+
--- /dev/null
+From a223d866c86fe9e79a46154171807d1c40d1adfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 09:43:10 +0200
+Subject: xtensa: ISS: don't panic in rs_init
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit 23411c720052ad860b3e579ee4873511e367130a ]
+
+While alloc_tty_driver failure in rs_init would mean we have much bigger
+problem, there is no reason to panic when tty_register_driver fails
+there. It can fail for various reasons.
+
+So handle the failure gracefully. Actually handle them both while at it.
+This will make at least the console functional as it was enabled earlier
+by console_initcall in iss_console_init. Instead of shooting down the
+whole system.
+
+We move tty_port_init() after alloc_tty_driver(), so that we don't need
+to destroy the port in case the latter function fails.
+
+Cc: Chris Zankel <chris@zankel.net>
+Cc: Max Filippov <jcmvbkbc@gmail.com>
+Cc: linux-xtensa@linux-xtensa.org
+Acked-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20210723074317.32690-2-jslaby@suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/platforms/iss/console.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
+index 21184488c277..0108504dfb45 100644
+--- a/arch/xtensa/platforms/iss/console.c
++++ b/arch/xtensa/platforms/iss/console.c
+@@ -136,9 +136,13 @@ static const struct tty_operations serial_ops = {
+
+ static int __init rs_init(void)
+ {
+- tty_port_init(&serial_port);
++ int ret;
+
+ serial_driver = alloc_tty_driver(SERIAL_MAX_NUM_LINES);
++ if (!serial_driver)
++ return -ENOMEM;
++
++ tty_port_init(&serial_port);
+
+ /* Initialize the tty_driver structure */
+
+@@ -156,8 +160,15 @@ static int __init rs_init(void)
+ tty_set_operations(serial_driver, &serial_ops);
+ tty_port_link_device(&serial_port, serial_driver, 0);
+
+- if (tty_register_driver(serial_driver))
+- panic("Couldn't register serial driver\n");
++ ret = tty_register_driver(serial_driver);
++ if (ret) {
++ pr_err("Couldn't register serial driver\n");
++ tty_driver_kref_put(serial_driver);
++ tty_port_destroy(&serial_port);
++
++ return ret;
++ }
++
+ return 0;
+ }
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
