--- /dev/null
+From ca6f9d85d5944046a241b325700c1ca395651c28 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Fri, 15 Oct 2021 14:48:39 +0200
+Subject: arm64: dts: imx8mm-kontron: Fix CAN SPI clock frequency
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit ca6f9d85d5944046a241b325700c1ca395651c28 upstream.
+
+The MCP2515 can be used with an SPI clock of up to 10 MHz. Set the
+limit accordingly to prevent any performance issues caused by the
+really low clock speed of 100 kHz.
+
+This removes the arbitrarily low limit on the SPI frequency, that was
+caused by a typo in the original dts.
+
+Without this change, receiving CAN messages on the board beyond a
+certain bitrate will cause overrun errors (see 'ip -det -stat link show
+can0').
+
+With this fix, receiving messages on the bus works without any overrun
+errors for bitrates up to 1 MBit.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -97,7 +97,7 @@
+ clocks = <&osc_can>;
+ interrupt-parent = <&gpio4>;
+ interrupts = <28 IRQ_TYPE_EDGE_FALLING>;
+- spi-max-frequency = <100000>;
++ spi-max-frequency = <10000000>;
+ vdd-supply = <®_vdd_3v3>;
+ xceiver-supply = <®_vdd_5v>;
+ };
--- /dev/null
+From 0b28c41e3c951ea3d4f012cfa9da5ebd6512cf6e Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Fri, 15 Oct 2021 14:48:40 +0200
+Subject: arm64: dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit 0b28c41e3c951ea3d4f012cfa9da5ebd6512cf6e upstream.
+
+Previously we falsely relied on the PHY driver to unconditionally
+enable the internal RX delay. Since the following fix for the PHY
+driver this is not the case anymore:
+
+commit 7b005a1742be ("net: phy: mscc: configure both RX and TX internal
+delays for RGMII")
+
+In order to enable the delay we need to set the connection type to
+"rgmii-rxid". Without the RX delay the ethernet is not functional at
+all.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -113,7 +113,7 @@
+ &fec1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+- phy-connection-type = "rgmii";
++ phy-connection-type = "rgmii-rxid";
+ phy-handle = <ðphy>;
+ status = "okay";
+
--- /dev/null
+From 6562d6e350284307e33ea10c7f46a6661ff22770 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Fri, 15 Oct 2021 14:48:38 +0200
+Subject: arm64: dts: imx8mm-kontron: Fix polarity of reg_rst_eth2
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit 6562d6e350284307e33ea10c7f46a6661ff22770 upstream.
+
+The regulator reg_rst_eth2 should keep the reset signal of the USB ethernet
+adapter deasserted anytime. Fix the polarity and mark it as always-on.
+
+Anyway, using the regulator is only a workaround for the missing support of
+specifying a reset GPIO for USB devices in a generic way. As we don't
+have a solution for this at the moment, at least fix the current
+workaround.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -70,7 +70,9 @@
+ regulator-name = "rst-usb-eth2";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb_eth2>;
+- gpio = <&gpio3 2 GPIO_ACTIVE_LOW>;
++ gpio = <&gpio3 2 GPIO_ACTIVE_HIGH>;
++ enable-active-high;
++ regulator-always-on;
+ };
+
+ reg_vdd_5v: regulator-5v {
--- /dev/null
+From 82a4f329b133ad0de66bee12c0be5c67bb8aa188 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Fri, 15 Oct 2021 14:48:36 +0200
+Subject: arm64: dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are correct
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit 82a4f329b133ad0de66bee12c0be5c67bb8aa188 upstream.
+
+It looks like the voltages for the SOC and DRAM supply weren't properly
+validated before. The datasheet and uboot-imx code tells us that VDD_SOC
+should be 800 mV in suspend and 850 mV in run mode. VDD_DRAM should be
+950 mV for DDR clock frequencies of up to 1.5 GHz.
+
+Let's fix these values to make sure the voltages are within the required
+range.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+@@ -91,10 +91,12 @@
+ reg_vdd_soc: BUCK1 {
+ regulator-name = "buck1";
+ regulator-min-microvolt = <800000>;
+- regulator-max-microvolt = <900000>;
++ regulator-max-microvolt = <850000>;
+ regulator-boot-on;
+ regulator-always-on;
+ regulator-ramp-delay = <3125>;
++ nxp,dvs-run-voltage = <850000>;
++ nxp,dvs-standby-voltage = <800000>;
+ };
+
+ reg_vdd_arm: BUCK2 {
+@@ -111,7 +113,7 @@
+ reg_vdd_dram: BUCK3 {
+ regulator-name = "buck3";
+ regulator-min-microvolt = <850000>;
+- regulator-max-microvolt = <900000>;
++ regulator-max-microvolt = <950000>;
+ regulator-boot-on;
+ regulator-always-on;
+ };
--- /dev/null
+From 256a24eba7f897c817fb0103dac73467d3789202 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Fri, 15 Oct 2021 14:48:37 +0200
+Subject: arm64: dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit 256a24eba7f897c817fb0103dac73467d3789202 upstream.
+
+According to the datasheet the typical value for VDD_SNVS should be
+800 mV, so let's make sure that this is within the range of the
+regulator.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+@@ -150,7 +150,7 @@
+
+ reg_vdd_snvs: LDO2 {
+ regulator-name = "ldo2";
+- regulator-min-microvolt = <850000>;
++ regulator-min-microvolt = <800000>;
+ regulator-max-microvolt = <900000>;
+ regulator-boot-on;
+ regulator-always-on;
--- /dev/null
+From e0c60d0102a5ad3475401e1a2faa3d3623eefce4 Mon Sep 17 00:00:00 2001
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Date: Tue, 26 Oct 2021 15:01:15 +0900
+Subject: block: Fix partition check for host-aware zoned block devices
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+commit e0c60d0102a5ad3475401e1a2faa3d3623eefce4 upstream.
+
+Commit a33df75c6328 ("block: use an xarray for disk->part_tbl") modified
+the method to check partition existence in host-aware zoned block
+devices from disk_has_partitions() helper function call to empty check
+of xarray disk->part_tbl. However, disk->part_tbl always has single
+entry for disk->part0 and never becomes empty. This resulted in the
+host-aware zoned devices always judged to have partitions, and it made
+the sysfs queue/zoned attribute to be "none" instead of "host-aware"
+regardless of partition existence in the devices.
+
+This also caused DEBUG_LOCKS_WARN_ON(lock->magic != lock) for
+sdkp->rev_mutex in scsi layer when the kernel detects host-aware zoned
+device. Since block layer handled the host-aware zoned devices as non-
+zoned devices, scsi layer did not have chance to initialize the mutex
+for zone revalidation. Therefore, the warning was triggered.
+
+To fix the issues, call the helper function disk_has_partitions() in
+place of disk->part_tbl empty check. Since the function was removed with
+the commit a33df75c6328, reimplement it to walk through entries in the
+xarray disk->part_tbl.
+
+Fixes: a33df75c6328 ("block: use an xarray for disk->part_tbl")
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Cc: stable@vger.kernel.org # v5.14+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20211026060115.753746-1-shinichiro.kawasaki@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-settings.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -842,6 +842,24 @@ bool blk_queue_can_use_dma_map_merging(s
+ }
+ EXPORT_SYMBOL_GPL(blk_queue_can_use_dma_map_merging);
+
++static bool disk_has_partitions(struct gendisk *disk)
++{
++ unsigned long idx;
++ struct block_device *part;
++ bool ret = false;
++
++ rcu_read_lock();
++ xa_for_each(&disk->part_tbl, idx, part) {
++ if (bdev_is_partition(part)) {
++ ret = true;
++ break;
++ }
++ }
++ rcu_read_unlock();
++
++ return ret;
++}
++
+ /**
+ * blk_queue_set_zoned - configure a disk queue zoned model.
+ * @disk: the gendisk of the queue to configure
+@@ -876,7 +894,7 @@ void blk_queue_set_zoned(struct gendisk
+ * we do nothing special as far as the block layer is concerned.
+ */
+ if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED) ||
+- !xa_empty(&disk->part_tbl))
++ disk_has_partitions(disk))
+ model = BLK_ZONED_NONE;
+ break;
+ case BLK_ZONED_NONE:
--- /dev/null
+From 09b1d5dc6ce1c9151777f6c4e128a59457704c97 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 25 Oct 2021 13:31:12 +0200
+Subject: cfg80211: fix management registrations locking
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 09b1d5dc6ce1c9151777f6c4e128a59457704c97 upstream.
+
+The management registrations locking was broken, the list was
+locked for each wdev, but cfg80211_mgmt_registrations_update()
+iterated it without holding all the correct spinlocks, causing
+list corruption.
+
+Rather than trying to fix it with fine-grained locking, just
+move the lock to the wiphy/rdev (still need the list on each
+wdev), we already need to hold the wdev lock to change it, so
+there's no contention on the lock in any case. This trivially
+fixes the bug since we hold one wdev's lock already, and now
+will hold the lock that protects all lists.
+
+Cc: stable@vger.kernel.org
+Reported-by: Jouni Malinen <j@w1.fi>
+Fixes: 6cd536fe62ef ("cfg80211: change internal management frame registration API")
+Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/cfg80211.h | 2 --
+ net/wireless/core.c | 2 +-
+ net/wireless/core.h | 2 ++
+ net/wireless/mlme.c | 26 ++++++++++++++------------
+ 4 files changed, 17 insertions(+), 15 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -5350,7 +5350,6 @@ static inline void wiphy_unlock(struct w
+ * netdev and may otherwise be used by driver read-only, will be update
+ * by cfg80211 on change_interface
+ * @mgmt_registrations: list of registrations for management frames
+- * @mgmt_registrations_lock: lock for the list
+ * @mgmt_registrations_need_update: mgmt registrations were updated,
+ * need to propagate the update to the driver
+ * @mtx: mutex used to lock data in this struct, may be used by drivers
+@@ -5397,7 +5396,6 @@ struct wireless_dev {
+ u32 identifier;
+
+ struct list_head mgmt_registrations;
+- spinlock_t mgmt_registrations_lock;
+ u8 mgmt_registrations_need_update:1;
+
+ struct mutex mtx;
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -524,6 +524,7 @@ use_default_name:
+ INIT_WORK(&rdev->propagate_cac_done_wk, cfg80211_propagate_cac_done_wk);
+ INIT_WORK(&rdev->mgmt_registrations_update_wk,
+ cfg80211_mgmt_registrations_update_wk);
++ spin_lock_init(&rdev->mgmt_registrations_lock);
+
+ #ifdef CONFIG_CFG80211_DEFAULT_PS
+ rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+@@ -1279,7 +1280,6 @@ void cfg80211_init_wdev(struct wireless_
+ INIT_LIST_HEAD(&wdev->event_list);
+ spin_lock_init(&wdev->event_lock);
+ INIT_LIST_HEAD(&wdev->mgmt_registrations);
+- spin_lock_init(&wdev->mgmt_registrations_lock);
+ INIT_LIST_HEAD(&wdev->pmsr_list);
+ spin_lock_init(&wdev->pmsr_lock);
+ INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -100,6 +100,8 @@ struct cfg80211_registered_device {
+ struct work_struct propagate_cac_done_wk;
+
+ struct work_struct mgmt_registrations_update_wk;
++ /* lock for all wdev lists */
++ spinlock_t mgmt_registrations_lock;
+
+ /* must be last because of the way we do wiphy_priv(),
+ * and it should at least be aligned to NETDEV_ALIGN */
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -452,9 +452,9 @@ static void cfg80211_mgmt_registrations_
+
+ lockdep_assert_held(&rdev->wiphy.mtx);
+
+- spin_lock_bh(&wdev->mgmt_registrations_lock);
++ spin_lock_bh(&rdev->mgmt_registrations_lock);
+ if (!wdev->mgmt_registrations_need_update) {
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+ return;
+ }
+
+@@ -479,7 +479,7 @@ static void cfg80211_mgmt_registrations_
+ rcu_read_unlock();
+
+ wdev->mgmt_registrations_need_update = 0;
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
+ }
+@@ -503,6 +503,7 @@ int cfg80211_mlme_register_mgmt(struct w
+ int match_len, bool multicast_rx,
+ struct netlink_ext_ack *extack)
+ {
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+ struct cfg80211_mgmt_registration *reg, *nreg;
+ int err = 0;
+ u16 mgmt_type;
+@@ -548,7 +549,7 @@ int cfg80211_mlme_register_mgmt(struct w
+ if (!nreg)
+ return -ENOMEM;
+
+- spin_lock_bh(&wdev->mgmt_registrations_lock);
++ spin_lock_bh(&rdev->mgmt_registrations_lock);
+
+ list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
+ int mlen = min(match_len, reg->match_len);
+@@ -583,7 +584,7 @@ int cfg80211_mlme_register_mgmt(struct w
+ list_add(&nreg->list, &wdev->mgmt_registrations);
+ }
+ wdev->mgmt_registrations_need_update = 1;
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ cfg80211_mgmt_registrations_update(wdev);
+
+@@ -591,7 +592,7 @@ int cfg80211_mlme_register_mgmt(struct w
+
+ out:
+ kfree(nreg);
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ return err;
+ }
+@@ -602,7 +603,7 @@ void cfg80211_mlme_unregister_socket(str
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ struct cfg80211_mgmt_registration *reg, *tmp;
+
+- spin_lock_bh(&wdev->mgmt_registrations_lock);
++ spin_lock_bh(&rdev->mgmt_registrations_lock);
+
+ list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
+ if (reg->nlportid != nlportid)
+@@ -615,7 +616,7 @@ void cfg80211_mlme_unregister_socket(str
+ schedule_work(&rdev->mgmt_registrations_update_wk);
+ }
+
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ if (nlportid && rdev->crit_proto_nlportid == nlportid) {
+ rdev->crit_proto_nlportid = 0;
+@@ -628,15 +629,16 @@ void cfg80211_mlme_unregister_socket(str
+
+ void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
+ {
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+ struct cfg80211_mgmt_registration *reg, *tmp;
+
+- spin_lock_bh(&wdev->mgmt_registrations_lock);
++ spin_lock_bh(&rdev->mgmt_registrations_lock);
+ list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
+ list_del(®->list);
+ kfree(reg);
+ }
+ wdev->mgmt_registrations_need_update = 1;
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ cfg80211_mgmt_registrations_update(wdev);
+ }
+@@ -784,7 +786,7 @@ bool cfg80211_rx_mgmt_khz(struct wireles
+ data = buf + ieee80211_hdrlen(mgmt->frame_control);
+ data_len = len - ieee80211_hdrlen(mgmt->frame_control);
+
+- spin_lock_bh(&wdev->mgmt_registrations_lock);
++ spin_lock_bh(&rdev->mgmt_registrations_lock);
+
+ list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
+ if (reg->frame_type != ftype)
+@@ -808,7 +810,7 @@ bool cfg80211_rx_mgmt_khz(struct wireles
+ break;
+ }
+
+- spin_unlock_bh(&wdev->mgmt_registrations_lock);
++ spin_unlock_bh(&rdev->mgmt_registrations_lock);
+
+ trace_cfg80211_return_bool(result);
+ return result;
--- /dev/null
+From a2083eeb119fb9307258baea9b7c243ca9a2e0b6 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 30 Sep 2021 13:11:21 +0200
+Subject: cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit a2083eeb119fb9307258baea9b7c243ca9a2e0b6 upstream.
+
+The SSID pointer is pointing to RCU protected data, so we
+need to have it under rcu_read_lock() for the entire use.
+Fix this.
+
+Cc: stable@vger.kernel.org
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Link: https://lore.kernel.org/r/20210930131120.6ddfc603aa1d.I2137344c4e2426525b1a8e4ce5fca82f8ecbfe7e@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/scan.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -418,14 +418,17 @@ cfg80211_add_nontrans_list(struct cfg802
+ }
+ ssid_len = ssid[1];
+ ssid = ssid + 2;
+- rcu_read_unlock();
+
+ /* check if nontrans_bss is in the list */
+ list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
+- if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
++ if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
++ rcu_read_unlock();
+ return 0;
++ }
+ }
+
++ rcu_read_unlock();
++
+ /* add to the list */
+ list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
+ return 0;
--- /dev/null
+From 54149d13f369e1ab02f36b91feee02069184c1d8 Mon Sep 17 00:00:00 2001
+From: Michael Strauss <michael.strauss@amd.com>
+Date: Thu, 21 Oct 2021 13:27:16 -0400
+Subject: drm/amd/display: Fallback to clocks which meet requested voltage on DCN31
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+commit 54149d13f369e1ab02f36b91feee02069184c1d8 upstream.
+
+[WHY]
+On certain configs, SMU clock table voltages don't match which cause parser
+to behave incorrectly by leaving dcfclk and socclk table entries unpopulated.
+
+[HOW]
+Currently the function that finds the corresponding clock for a given voltage
+only checks for exact voltage level matches. In the case that no match gets
+found, parser now falls back to searching for the max clock which meets the
+requested voltage (i.e. its corresponding voltage is below requested).
+
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 13 ++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c
+@@ -518,14 +518,21 @@ static unsigned int find_clk_for_voltage
+ unsigned int voltage)
+ {
+ int i;
++ int max_voltage = 0;
++ int clock = 0;
+
+ for (i = 0; i < NUM_SOC_VOLTAGE_LEVELS; i++) {
+- if (clock_table->SocVoltage[i] == voltage)
++ if (clock_table->SocVoltage[i] == voltage) {
+ return clocks[i];
++ } else if (clock_table->SocVoltage[i] >= max_voltage &&
++ clock_table->SocVoltage[i] < voltage) {
++ max_voltage = clock_table->SocVoltage[i];
++ clock = clocks[i];
++ }
+ }
+
+- ASSERT(0);
+- return 0;
++ ASSERT(clock);
++ return clock;
+ }
+
+ void dcn31_clk_mgr_helper_populate_bw_params(
--- /dev/null
+From ad76744b041d8c87ef1c9adbb04fb7eaa20a179e Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Fri, 22 Oct 2021 16:14:24 -0400
+Subject: drm/amd/display: Fix deadlock when falling back to v2 from v3
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit ad76744b041d8c87ef1c9adbb04fb7eaa20a179e upstream.
+
+[Why]
+A deadlock in the kernel occurs when we fallback from the V3 to V2
+add_topology_to_display or remove_topology_to_display because they
+both try to acquire the dtm_mutex but recursive locking isn't
+supported on mutex_lock().
+
+[How]
+Make the mutex_lock/unlock more fine grained and move them up such that
+they're only required for the psp invocation itself.
+
+Fixes: bf62221e9d0e ("drm/amd/display: Add DCN3.1 HDCP support")
+
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c
++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c
+@@ -105,6 +105,7 @@ static enum mod_hdcp_status mod_hdcp_rem
+ dtm_cmd->dtm_status = TA_DTM_STATUS__GENERIC_FAILURE;
+
+ psp_dtm_invoke(psp, dtm_cmd->cmd_id);
++ mutex_unlock(&psp->dtm_context.mutex);
+
+ if (dtm_cmd->dtm_status != TA_DTM_STATUS__SUCCESS) {
+ status = mod_hdcp_remove_display_from_topology_v2(hdcp, index);
+@@ -115,8 +116,6 @@ static enum mod_hdcp_status mod_hdcp_rem
+ HDCP_TOP_REMOVE_DISPLAY_TRACE(hdcp, display->index);
+ }
+
+- mutex_unlock(&psp->dtm_context.mutex);
+-
+ return status;
+ }
+
+@@ -218,6 +217,7 @@ static enum mod_hdcp_status mod_hdcp_add
+ dtm_cmd->dtm_in_message.topology_update_v3.link_hdcp_cap = link->hdcp_supported_informational;
+
+ psp_dtm_invoke(psp, dtm_cmd->cmd_id);
++ mutex_unlock(&psp->dtm_context.mutex);
+
+ if (dtm_cmd->dtm_status != TA_DTM_STATUS__SUCCESS) {
+ status = mod_hdcp_add_display_to_topology_v2(hdcp, display);
+@@ -227,8 +227,6 @@ static enum mod_hdcp_status mod_hdcp_add
+ HDCP_TOP_ADD_DISPLAY_TRACE(hdcp, display->index);
+ }
+
+- mutex_unlock(&psp->dtm_context.mutex);
+-
+ return status;
+ }
+
--- /dev/null
+From c938aed88f8259dc913b717a32319101c66e87a9 Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Wed, 29 Sep 2021 11:37:33 -0400
+Subject: drm/amd/display: Fix prefetch bandwidth calculation for DCN3.1
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit c938aed88f8259dc913b717a32319101c66e87a9 upstream.
+
+[Why]
+Prefetch BW calculated is lower than the DML reference because of a
+porting error that's excluding cursor and row bandwidth from the
+pixel data bandwidth.
+
+[How]
+Change the dml_max4 to dml_max3 and include cursor and row bandwidth
+in the same calculation as the rest of the pixel data during vactive.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c
+@@ -5399,9 +5399,9 @@ void dml31_ModeSupportAndSystemConfigura
+
+ v->MaximumReadBandwidthWithPrefetch =
+ v->MaximumReadBandwidthWithPrefetch
+- + dml_max4(
+- v->VActivePixelBandwidth[i][j][k],
+- v->VActiveCursorBandwidth[i][j][k]
++ + dml_max3(
++ v->VActivePixelBandwidth[i][j][k]
++ + v->VActiveCursorBandwidth[i][j][k]
+ + v->NoOfDPP[i][j][k]
+ * (v->meta_row_bandwidth[i][j][k]
+ + v->dpte_row_bandwidth[i][j][k]),
--- /dev/null
+From dd8cb18906d97b2916fde42d32d915ae363c7e55 Mon Sep 17 00:00:00 2001
+From: Nikola Cornij <nikola.cornij@amd.com>
+Date: Fri, 1 Oct 2021 13:26:05 -0400
+Subject: drm/amd/display: Increase watermark latencies for DCN3.1
+
+From: Nikola Cornij <nikola.cornij@amd.com>
+
+commit dd8cb18906d97b2916fde42d32d915ae363c7e55 upstream.
+
+[why]
+The original latencies were causing underflow in some modes
+
+[how]
+Replace with the up-to-date watermark values based on new measurments
+
+Reviewed-by: Ahmad Othman <ahmad.othman@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 16 +++++------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c
+@@ -366,32 +366,32 @@ static struct wm_table lpddr5_wm_table =
+ .wm_inst = WM_A,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+ .pstate_latency_us = 11.65333,
+- .sr_exit_time_us = 5.32,
+- .sr_enter_plus_exit_time_us = 6.38,
++ .sr_exit_time_us = 11.5,
++ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+ },
+ {
+ .wm_inst = WM_B,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+ .pstate_latency_us = 11.65333,
+- .sr_exit_time_us = 9.82,
+- .sr_enter_plus_exit_time_us = 11.196,
++ .sr_exit_time_us = 11.5,
++ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+ },
+ {
+ .wm_inst = WM_C,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+ .pstate_latency_us = 11.65333,
+- .sr_exit_time_us = 9.89,
+- .sr_enter_plus_exit_time_us = 11.24,
++ .sr_exit_time_us = 11.5,
++ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+ },
+ {
+ .wm_inst = WM_D,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+ .pstate_latency_us = 11.65333,
+- .sr_exit_time_us = 9.748,
+- .sr_enter_plus_exit_time_us = 11.102,
++ .sr_exit_time_us = 11.5,
++ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+ },
+ }
--- /dev/null
+From 4835ea6c173a8d8dfbfdbb21c4cd987d12681610 Mon Sep 17 00:00:00 2001
+From: Eric Yang <Eric.Yang2@amd.com>
+Date: Thu, 30 Sep 2021 13:46:45 -0400
+Subject: drm/amd/display: increase Z9 latency to workaround underflow in Z9
+
+From: Eric Yang <Eric.Yang2@amd.com>
+
+commit 4835ea6c173a8d8dfbfdbb21c4cd987d12681610 upstream.
+
+[Why]
+Z9 latency is higher than when we originally tuned the watermark
+parameters, causing underflow. Increasing the value until the latency
+issues is resolved.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Eric Yang <Eric.Yang2@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+@@ -217,8 +217,8 @@ struct _vcs_dpi_soc_bounding_box_st dcn3
+ .num_states = 5,
+ .sr_exit_time_us = 9.0,
+ .sr_enter_plus_exit_time_us = 11.0,
+- .sr_exit_z8_time_us = 402.0,
+- .sr_enter_plus_exit_z8_time_us = 520.0,
++ .sr_exit_z8_time_us = 442.0,
++ .sr_enter_plus_exit_z8_time_us = 560.0,
+ .writeback_latency_us = 12.0,
+ .dram_channel_width_bytes = 4,
+ .round_trip_ping_latency_dcfclk_cycles = 106,
--- /dev/null
+From c21b105380cf86e829c68586ca1315cfc253ad8c Mon Sep 17 00:00:00 2001
+From: Nikola Cornij <nikola.cornij@amd.com>
+Date: Tue, 28 Sep 2021 22:43:52 -0400
+Subject: drm/amd/display: Limit display scaling to up to true 4k for DCN 3.1
+
+From: Nikola Cornij <nikola.cornij@amd.com>
+
+commit c21b105380cf86e829c68586ca1315cfc253ad8c upstream.
+
+[why]
+The requirement is that image width up to 4096 shall be supported
+
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+@@ -928,7 +928,7 @@ static const struct dc_debug_options deb
+ .disable_dcc = DCC_ENABLE,
+ .vsr_support = true,
+ .performance_trace = false,
+- .max_downscale_src_width = 3840,/*upto 4K*/
++ .max_downscale_src_width = 4096,/*upto true 4K*/
+ .disable_pplib_wm_range = false,
+ .scl_reset_length10 = true,
+ .sanity_checks = false,
--- /dev/null
+From 2ef8ea23942f4c2569930c34e7689a0cb1b232cc Mon Sep 17 00:00:00 2001
+From: Jake Wang <haonan.wang2@amd.com>
+Date: Fri, 1 Oct 2021 17:14:21 -0400
+Subject: drm/amd/display: Moved dccg init to after bios golden init
+
+From: Jake Wang <haonan.wang2@amd.com>
+
+commit 2ef8ea23942f4c2569930c34e7689a0cb1b232cc upstream.
+
+[Why]
+bios_golden_init will override dccg_init during init_hw.
+
+[How]
+Move dccg_init to after bios_golden_init.
+
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Reviewed-by: Eric Yang <eric.yang2@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Jake Wang <haonan.wang2@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
+@@ -76,10 +76,6 @@ void dcn31_init_hw(struct dc *dc)
+ if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks)
+ dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
+
+- // Initialize the dccg
+- if (res_pool->dccg->funcs->dccg_init)
+- res_pool->dccg->funcs->dccg_init(res_pool->dccg);
+-
+ if (IS_FPGA_MAXIMUS_DC(dc->ctx->dce_environment)) {
+
+ REG_WRITE(REFCLK_CNTL, 0);
+@@ -106,6 +102,9 @@ void dcn31_init_hw(struct dc *dc)
+ hws->funcs.bios_golden_init(dc);
+ hws->funcs.disable_vga(dc->hwseq);
+ }
++ // Initialize the dccg
++ if (res_pool->dccg->funcs->dccg_init)
++ res_pool->dccg->funcs->dccg_init(res_pool->dccg);
+
+ if (dc->debug.enable_mem_low_power.bits.dmcu) {
+ // Force ERAM to shutdown if DMCU is not enabled
--- /dev/null
+From 672437486ee9da3ed0e774937e6d0dd570921b39 Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Wed, 29 Sep 2021 16:22:53 -0400
+Subject: drm/amd/display: Require immediate flip support for DCN3.1 planes
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit 672437486ee9da3ed0e774937e6d0dd570921b39 upstream.
+
+[Why]
+Immediate flip can be enabled dynamically and has higher BW requirements
+when validating which voltage mode to use.
+
+If we validate when it's not set then potentially DCFCLK will be too low
+and we will underflow.
+
+[How]
+DM always requires support so always require it as part of DML input
+parameters.
+
+This can't be enabled unconditionally on older ASIC because it blocks
+some expected modes so only target DCN3.1 for now.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Agustin Gutierrez Sanchez <agustin.gutierrez@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+@@ -1591,6 +1591,13 @@ static int dcn31_populate_dml_pipes_from
+ pipe = &res_ctx->pipe_ctx[i];
+ timing = &pipe->stream->timing;
+
++ /*
++ * Immediate flip can be set dynamically after enabling the plane.
++ * We need to require support for immediate flip or underflow can be
++ * intermittently experienced depending on peak b/w requirements.
++ */
++ pipes[pipe_cnt].pipe.src.immediate_flip = true;
++
+ pipes[pipe_cnt].pipe.src.unbounded_req_mode = false;
+ pipes[pipe_cnt].pipe.src.gpuvm = true;
+ pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_luma = 0;
--- /dev/null
+From 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Wed, 27 Oct 2021 16:27:30 +0200
+Subject: drm/amdgpu: Fix even more out of bound writes from debugfs
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream.
+
+CVE-2021-42327 was fixed by:
+
+commit f23750b5b3d98653b31d4469592935ef6364ad67
+Author: Thelford Williams <tdwilliamsiv@gmail.com>
+Date: Wed Oct 13 16:04:13 2021 -0400
+
+ drm/amdgpu: fix out of bounds write
+
+but amdgpu_dm_debugfs.c contains more of the same issue so fix the
+remaining ones.
+
+v2:
+ * Add missing fix in dp_max_bpc_write (Harry Wentland)
+
+Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated")
+Signed-off-by: Patrik Jakobsson <pjakobsson@suse.de>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 18 +++++++-------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -487,7 +487,7 @@ static ssize_t dp_phy_settings_write(str
+ if (!wr_buf)
+ return -ENOSPC;
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -639,7 +639,7 @@ static ssize_t dp_phy_test_pattern_debug
+ if (!wr_buf)
+ return -ENOSPC;
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -914,7 +914,7 @@ static ssize_t dp_dsc_passthrough_set(st
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ ¶m, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -1211,7 +1211,7 @@ static ssize_t trigger_hotplug(struct fi
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -1396,7 +1396,7 @@ static ssize_t dp_dsc_clock_en_write(str
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -1581,7 +1581,7 @@ static ssize_t dp_dsc_slice_width_write(
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -1766,7 +1766,7 @@ static ssize_t dp_dsc_slice_height_write
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -1944,7 +1944,7 @@ static ssize_t dp_dsc_bits_per_pixel_wri
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
+@@ -2382,7 +2382,7 @@ static ssize_t dp_max_bpc_write(struct f
+ return -ENOSPC;
+ }
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
--- /dev/null
+From 5afa7898ab7a0ec9c28556a91df714bf3c2f725e Mon Sep 17 00:00:00 2001
+From: Thelford Williams <tdwilliamsiv@gmail.com>
+Date: Wed, 13 Oct 2021 16:04:13 -0400
+Subject: drm/amdgpu: fix out of bounds write
+
+From: Thelford Williams <tdwilliamsiv@gmail.com>
+
+commit 5afa7898ab7a0ec9c28556a91df714bf3c2f725e upstream.
+
+Size can be any value and is user controlled resulting in overwriting the
+40 byte array wr_buf with an arbitrary length of data from buf.
+
+Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(st
+ if (!wr_buf)
+ return -ENOSPC;
+
+- if (parse_write_buffer_into_params(wr_buf, size,
++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+ (long *)param, buf,
+ max_param_num,
+ ¶m_nums)) {
--- /dev/null
+From 53c2ff8bcb06acd07e24a62e7f5a0247bd7c6f67 Mon Sep 17 00:00:00 2001
+From: Aaron Liu <aaron.liu@amd.com>
+Date: Tue, 19 Oct 2021 11:13:25 +0800
+Subject: drm/amdgpu: support B0&B1 external revision id for yellow carp
+
+From: Aaron Liu <aaron.liu@amd.com>
+
+commit 53c2ff8bcb06acd07e24a62e7f5a0247bd7c6f67 upstream.
+
+B0 internal rev_id is 0x01, B1 internal rev_id is 0x02.
+The external rev_id for B0 and B1 is 0x20.
+The original expression is not suitable for B1.
+
+v2: squash in fix for display code (Alex)
+
+Signed-off-by: Aaron Liu <aaron.liu@amd.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nv.c | 2 +-
+ drivers/gpu/drm/amd/display/include/dal_asic_id.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -1237,7 +1237,7 @@ static int nv_common_early_init(void *ha
+ AMD_PG_SUPPORT_VCN_DPG |
+ AMD_PG_SUPPORT_JPEG;
+ if (adev->pdev->device == 0x1681)
+- adev->external_rev_id = adev->rev_id + 0x19;
++ adev->external_rev_id = 0x20;
+ else
+ adev->external_rev_id = adev->rev_id + 0x01;
+ break;
+--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+@@ -227,7 +227,7 @@ enum {
+ #define FAMILY_YELLOW_CARP 146
+
+ #define YELLOW_CARP_A0 0x01
+-#define YELLOW_CARP_B0 0x1A
++#define YELLOW_CARP_B0 0x20
+ #define YELLOW_CARP_UNKNOWN 0xFF
+
+ #ifndef ASICREV_IS_YELLOW_CARP
--- /dev/null
+From 9761ffb8f1090289b908590039e2c363cc35cf45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Oct 2021 12:09:40 +0300
+Subject: drm/i915: Catch yet another unconditioal clflush
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 9761ffb8f1090289b908590039e2c363cc35cf45 upstream.
+
+Replace the unconditional clflush() with drm_clflush_virt_range()
+which does the wbinvd() fallback when clflush is not available.
+
+This time no justification is given for the clflush in the
+offending commit.
+
+Cc: stable@vger.kernel.org
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Fixes: 2c8ab3339e39 ("drm/i915: Pin timeline map after first timeline pin, v4.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-4-ville.syrjala@linux.intel.com
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+(cherry picked from commit 9ced12182d0d8401d821e9602e56e276459900fc)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_timeline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_timeline.c
++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c
+@@ -64,7 +64,7 @@ intel_timeline_pin_map(struct intel_time
+
+ timeline->hwsp_map = vaddr;
+ timeline->hwsp_seqno = memset(vaddr + ofs, 0, TIMELINE_SEQNO_BYTES);
+- clflush(vaddr + ofs);
++ drm_clflush_virt_range(vaddr + ofs, TIMELINE_SEQNO_BYTES);
+
+ return 0;
+ }
--- /dev/null
+From fcf918ffd3b35e288097036c04af7446b2c6f2f1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 14 Oct 2021 12:09:39 +0300
+Subject: drm/i915: Convert unconditional clflush to drm_clflush_virt_range()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit fcf918ffd3b35e288097036c04af7446b2c6f2f1 upstream.
+
+This one is apparently a "clflush for good measure", so bit more
+justification (if you can call it that) than some of the others.
+Convert to drm_clflush_virt_range() again so that machines without
+clflush will survive the ordeal.
+
+Cc: stable@vger.kernel.org
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@intel.com> #v1
+Fixes: 12ca695d2c1e ("drm/i915: Do not share hwsp across contexts any more, v8.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-3-ville.syrjala@linux.intel.com
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+(cherry picked from commit af7b6d234eefa30c461cc16912bafb32b9e6141c)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_timeline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_timeline.c
++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c
+@@ -225,7 +225,7 @@ void intel_timeline_reset_seqno(const st
+
+ memset(hwsp_seqno + 1, 0, TIMELINE_SEQNO_BYTES - sizeof(*hwsp_seqno));
+ WRITE_ONCE(*hwsp_seqno, tl->seqno);
+- clflush(hwsp_seqno);
++ drm_clflush_virt_range(hwsp_seqno, TIMELINE_SEQNO_BYTES);
+ }
+
+ void intel_timeline_enter(struct intel_timeline *tl)
--- /dev/null
+From 6e6f96630805874fa80b0067e1a57aafc06225f6 Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Mon, 18 Oct 2021 12:41:49 +0300
+Subject: drm/i915/dp: Skip the HW readout of DPCD on disabled encoders
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Imre Deak <imre.deak@intel.com>
+
+commit 6e6f96630805874fa80b0067e1a57aafc06225f6 upstream.
+
+Reading out the DP encoders' DPCD during booting or resume is only
+required for enabled encoders: such encoders may be modesetted during
+the initial commit and the link training this involves depends on an
+initialized DPCD. For DDI encoders reading out the DPCD is skipped, do
+the same on pre-DDI platforms.
+
+Atm, the first DPCD readout without a sink connected - which is a likely
+scneario if the encoder is disabled - leaves intel_dp->num_common_rates
+at 0, which resulted in
+
+intel_dp_sync_state()->intel_dp_max_common_rate()
+
+in a
+
+intel_dp->common_rates[-1]
+
+access. This by definition results in an undefined behaviour, though to
+my best knowledge in all HW/compiler configurations it actually results
+in accessing the array item type value preceding the array. In this
+case the preceding value happens to be intel_dp->num_common_rates,
+which is 0, so this issue - by luck - didn't cause a user visible
+problem.
+
+Nevertheless it's still an undefined behaviour and in CONFIG_UBSAN
+builds leads to a kernel BUG() (which revealed this problem for us),
+hence CC:stable.
+
+A related problem in case the encoder is enabled but the sink is not
+connected or the DPCD readout fails is fixed by the next patch.
+
+v2: Amend the commit message describing the root cause of the
+ CONFIG_UBSAN BUG().
+
+Fixes: a532cde31de3 ("drm/i915/tc: Fix TypeC port init/resume time sanitization")
+References: https://gitlab.freedesktop.org/drm/intel/-/issues/4297
+Reported-and-tested-by: Mat Jonczyk <mat.jonczyk@o2.pl>
+Cc: Mat Jonczyk <mat.jonczyk@o2.pl>
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211018094154.1407705-2-imre.deak@intel.com
+(cherry picked from commit 4ec5ffc341cecbea060739aea1d53398ac2ec3f8)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -1924,6 +1924,9 @@ void intel_dp_sync_state(struct intel_en
+ {
+ struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+
++ if (!crtc_state)
++ return;
++
+ /*
+ * Don't clobber DPCD if it's been already read out during output
+ * setup (eDP) or detect.
--- /dev/null
+From 0db55f9a1bafbe3dac750ea669de9134922389b5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 20 Oct 2021 19:19:46 +0200
+Subject: drm/ttm: fix memleak in ttm_transfered_destroy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream.
+
+We need to cleanup the fences for ghost objects as well.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reported-by: Erhard F. <erhard_f@mailbox.org>
+Tested-by: Erhard F. <erhard_f@mailbox.org>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447
+CC: <stable@vger.kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -190,6 +190,7 @@ static void ttm_transfered_destroy(struc
+ struct ttm_transfer_obj *fbo;
+
+ fbo = container_of(bo, struct ttm_transfer_obj, base);
++ dma_resv_fini(&fbo->base.base._resv);
+ ttm_bo_put(fbo->bo);
+ kfree(fbo);
+ }
--- /dev/null
+From 4e84dc47bb48accbbeeba4e6bb3f31aa7895323c Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Wed, 27 Oct 2021 12:51:01 -0400
+Subject: ftrace/nds32: Update the proto for ftrace_trace_function to match ftrace_stub
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 4e84dc47bb48accbbeeba4e6bb3f31aa7895323c upstream.
+
+The ftrace callback prototype was changed to pass a special ftrace_regs
+instead of pt_regs as the last parameter, but the static ftrace for nds32
+missed updating ftrace_trace_function and this caused a warning when
+compared to ftrace_stub:
+
+../arch/nds32/kernel/ftrace.c: In function '_mcount':
+../arch/nds32/kernel/ftrace.c:24:35: error: comparison of distinct pointer types lacks a cast [-Werror]
+ 24 | if (ftrace_trace_function != ftrace_stub)
+ | ^~
+
+Link: https://lore.kernel.org/all/20211027055554.19372-1-rdunlap@infradead.org/
+Link: https://lkml.kernel.org/r/20211027125101.33449969@gandalf.local.home
+
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Nick Hu <nickhu@andestech.com>
+Cc: Greentime Hu <green.hu@gmail.com>
+Cc: Vincent Chen <deanbo422@gmail.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Fixes: d19ad0775dcd6 ("ftrace: Have the callbacks receive a struct ftrace_regs instead of pt_regs")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/nds32/kernel/ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/nds32/kernel/ftrace.c
++++ b/arch/nds32/kernel/ftrace.c
+@@ -6,7 +6,7 @@
+
+ #ifndef CONFIG_DYNAMIC_FTRACE
+ extern void (*ftrace_trace_function)(unsigned long, unsigned long,
+- struct ftrace_ops*, struct pt_regs*);
++ struct ftrace_ops*, struct ftrace_regs*);
+ extern void ftrace_graph_caller(void);
+
+ noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip,
--- /dev/null
+From 636707e593120c9fa35f6a908c0d052f6154910d Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 30 Sep 2021 13:11:20 +0200
+Subject: mac80211: mesh: fix HE operation element length check
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 636707e593120c9fa35f6a908c0d052f6154910d upstream.
+
+The length check here was bad, if the length doesn't at
+least include the length of the fixed part, we cannot
+call ieee80211_he_oper_size() to determine the total.
+Fix this, and convert to cfg80211_find_ext_elem() while
+at it.
+
+Cc: stable@vger.kernel.org
+Fixes: 70debba3ab7d ("mac80211: save HE oper info in BSS config for mesh")
+Link: https://lore.kernel.org/r/20210930131120.b0f940976c56.I954e1be55e9f87cc303165bff5c906afe1e54648@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/mesh.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -672,7 +672,7 @@ ieee80211_mesh_update_bss_params(struct
+ u8 *ie, u8 ie_len)
+ {
+ struct ieee80211_supported_band *sband;
+- const u8 *cap;
++ const struct element *cap;
+ const struct ieee80211_he_operation *he_oper = NULL;
+
+ sband = ieee80211_get_sband(sdata);
+@@ -687,9 +687,10 @@ ieee80211_mesh_update_bss_params(struct
+
+ sdata->vif.bss_conf.he_support = true;
+
+- cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ie, ie_len);
+- if (cap && cap[1] >= ieee80211_he_oper_size(&cap[3]))
+- he_oper = (void *)(cap + 3);
++ cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ie_len);
++ if (cap && cap->datalen >= 1 + sizeof(*he_oper) &&
++ cap->datalen >= 1 + ieee80211_he_oper_size(cap->data + 1))
++ he_oper = (void *)(cap->data + 1);
+
+ if (he_oper)
+ sdata->vif.bss_conf.he_oper.params =
--- /dev/null
+From eac96c3efdb593df1a57bb5b95dbe037bfa9a522 Mon Sep 17 00:00:00 2001
+From: Yang Shi <shy828301@gmail.com>
+Date: Thu, 28 Oct 2021 14:36:11 -0700
+Subject: mm: filemap: check if THP has hwpoisoned subpage for PMD page fault
+
+From: Yang Shi <shy828301@gmail.com>
+
+commit eac96c3efdb593df1a57bb5b95dbe037bfa9a522 upstream.
+
+When handling shmem page fault the THP with corrupted subpage could be
+PMD mapped if certain conditions are satisfied. But kernel is supposed
+to send SIGBUS when trying to map hwpoisoned page.
+
+There are two paths which may do PMD map: fault around and regular
+fault.
+
+Before commit f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault()
+codepaths") the thing was even worse in fault around path. The THP
+could be PMD mapped as long as the VMA fits regardless what subpage is
+accessed and corrupted. After this commit as long as head page is not
+corrupted the THP could be PMD mapped.
+
+In the regular fault path the THP could be PMD mapped as long as the
+corrupted page is not accessed and the VMA fits.
+
+This loophole could be fixed by iterating every subpage to check if any
+of them is hwpoisoned or not, but it is somewhat costly in page fault
+path.
+
+So introduce a new page flag called HasHWPoisoned on the first tail
+page. It indicates the THP has hwpoisoned subpage(s). It is set if any
+subpage of THP is found hwpoisoned by memory failure and after the
+refcount is bumped successfully, then cleared when the THP is freed or
+split.
+
+The soft offline path doesn't need this since soft offline handler just
+marks a subpage hwpoisoned when the subpage is migrated successfully.
+But shmem THP didn't get split then migrated at all.
+
+Link: https://lkml.kernel.org/r/20211020210755.23964-3-shy828301@gmail.com
+Fixes: 800d8c63b2e9 ("shmem: add huge pages support")
+Signed-off-by: Yang Shi <shy828301@gmail.com>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Suggested-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/page-flags.h | 23 +++++++++++++++++++++++
+ mm/huge_memory.c | 2 ++
+ mm/memory-failure.c | 14 ++++++++++++++
+ mm/memory.c | 9 +++++++++
+ mm/page_alloc.c | 4 +++-
+ 5 files changed, 51 insertions(+), 1 deletion(-)
+
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -171,6 +171,15 @@ enum pageflags {
+ /* Compound pages. Stored in first tail page's flags */
+ PG_double_map = PG_workingset,
+
++#ifdef CONFIG_MEMORY_FAILURE
++ /*
++ * Compound pages. Stored in first tail page's flags.
++ * Indicates that at least one subpage is hwpoisoned in the
++ * THP.
++ */
++ PG_has_hwpoisoned = PG_mappedtodisk,
++#endif
++
+ /* non-lru isolated movable page */
+ PG_isolated = PG_reclaim,
+
+@@ -703,6 +712,20 @@ PAGEFLAG_FALSE(DoubleMap)
+ TESTSCFLAG_FALSE(DoubleMap)
+ #endif
+
++#if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_TRANSPARENT_HUGEPAGE)
++/*
++ * PageHasHWPoisoned indicates that at least one subpage is hwpoisoned in the
++ * compound page.
++ *
++ * This flag is set by hwpoison handler. Cleared by THP split or free page.
++ */
++PAGEFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND)
++ TESTSCFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND)
++#else
++PAGEFLAG_FALSE(HasHWPoisoned)
++ TESTSCFLAG_FALSE(HasHWPoisoned)
++#endif
++
+ /*
+ * Check if a page is currently marked HWPoisoned. Note that this check is
+ * best effort only and inherently racy: there is no way to synchronize with
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2452,6 +2452,8 @@ static void __split_huge_page(struct pag
+ /* lock lru list/PageCompound, ref frozen by page_ref_freeze */
+ lruvec = lock_page_lruvec(head);
+
++ ClearPageHasHWPoisoned(head);
++
+ for (i = nr - 1; i >= 1; i--) {
+ __split_huge_page_tail(head, i, lruvec, list);
+ /* Some pages can be beyond i_size: drop them from page cache */
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1694,6 +1694,20 @@ try_again:
+ }
+
+ if (PageTransHuge(hpage)) {
++ /*
++ * The flag must be set after the refcount is bumped
++ * otherwise it may race with THP split.
++ * And the flag can't be set in get_hwpoison_page() since
++ * it is called by soft offline too and it is just called
++ * for !MF_COUNT_INCREASE. So here seems to be the best
++ * place.
++ *
++ * Don't need care about the above error handling paths for
++ * get_hwpoison_page() since they handle either free page
++ * or unhandlable page. The refcount is bumped iff the
++ * page is a valid handlable page.
++ */
++ SetPageHasHWPoisoned(hpage);
+ if (try_to_split_thp_page(p, "Memory Failure") < 0) {
+ action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED);
+ res = -EBUSY;
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3906,6 +3906,15 @@ vm_fault_t do_set_pmd(struct vm_fault *v
+ return ret;
+
+ /*
++ * Just backoff if any subpage of a THP is corrupted otherwise
++ * the corrupted page may mapped by PMD silently to escape the
++ * check. This kind of THP just can be PTE mapped. Access to
++ * the corrupted subpage should trigger SIGBUS as expected.
++ */
++ if (unlikely(PageHasHWPoisoned(page)))
++ return ret;
++
++ /*
+ * Archs like ppc64 need additional space to store information
+ * related to pte entry. Use the preallocated table for that.
+ */
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1320,8 +1320,10 @@ static __always_inline bool free_pages_p
+
+ VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
+
+- if (compound)
++ if (compound) {
+ ClearPageDoubleMap(page);
++ ClearPageHasHWPoisoned(page);
++ }
+ for (i = 1; i < (1 << order); i++) {
+ if (compound)
+ bad += free_tail_pages_check(page, page + i);
--- /dev/null
+From c7cb42e94473aafe553c0f2a3d8ca904599399ed Mon Sep 17 00:00:00 2001
+From: Yang Shi <shy828301@gmail.com>
+Date: Thu, 28 Oct 2021 14:36:07 -0700
+Subject: mm: hwpoison: remove the unnecessary THP check
+
+From: Yang Shi <shy828301@gmail.com>
+
+commit c7cb42e94473aafe553c0f2a3d8ca904599399ed upstream.
+
+When handling THP hwpoison checked if the THP is in allocation or free
+stage since hwpoison may mistreat it as hugetlb page. After commit
+415c64c1453a ("mm/memory-failure: split thp earlier in memory error
+handling") the problem has been fixed, so this check is no longer
+needed. Remove it. The side effect of the removal is hwpoison may
+report unsplit THP instead of unknown error for shmem THP. It seems not
+like a big deal.
+
+The following patch "mm: filemap: check if THP has hwpoisoned subpage
+for PMD page fault" depends on this, which fixes shmem THP with
+hwpoisoned subpage(s) are mapped PMD wrongly. So this patch needs to be
+backported to -stable as well.
+
+Link: https://lkml.kernel.org/r/20211020210755.23964-2-shy828301@gmail.com
+Signed-off-by: Yang Shi <shy828301@gmail.com>
+Suggested-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory-failure.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1148,20 +1148,6 @@ static int __get_hwpoison_page(struct pa
+ if (!HWPoisonHandlable(head))
+ return -EBUSY;
+
+- if (PageTransHuge(head)) {
+- /*
+- * Non anonymous thp exists only in allocation/free time. We
+- * can't handle such a case correctly, so let's give it up.
+- * This should be better than triggering BUG_ON when kernel
+- * tries to touch the "partially handled" page.
+- */
+- if (!PageAnon(head)) {
+- pr_err("Memory failure: %#lx: non anonymous thp\n",
+- page_to_pfn(page));
+- return 0;
+- }
+- }
+-
+ if (get_page_unless_zero(head)) {
+ if (head == compound_head(page))
+ return 1;
--- /dev/null
+From a4aeaa06d45e90f9b279f0b09de84bd00006e733 Mon Sep 17 00:00:00 2001
+From: Yang Shi <shy828301@gmail.com>
+Date: Thu, 28 Oct 2021 14:36:30 -0700
+Subject: mm: khugepaged: skip huge page collapse for special files
+
+From: Yang Shi <shy828301@gmail.com>
+
+commit a4aeaa06d45e90f9b279f0b09de84bd00006e733 upstream.
+
+The read-only THP for filesystems will collapse THP for files opened
+readonly and mapped with VM_EXEC. The intended usecase is to avoid TLB
+misses for large text segments. But it doesn't restrict the file types
+so a THP could be collapsed for a non-regular file, for example, block
+device, if it is opened readonly and mapped with EXEC permission. This
+may cause bugs, like [1] and [2].
+
+This is definitely not the intended usecase, so just collapse THP for
+regular files in order to close the attack surface.
+
+[shy828301@gmail.com: fix vm_file check [3]]
+
+Link: https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/ [1]
+Link: https://lore.kernel.org/linux-mm/000000000000c6a82505ce284e4c@google.com/ [2]
+Link: https://lkml.kernel.org/r/CAHbLzkqTW9U3VvTu1Ki5v_cLRC9gHW+znBukg_ycergE0JWj-A@mail.gmail.com [3]
+Link: https://lkml.kernel.org/r/20211027195221.3825-1-shy828301@gmail.com
+Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Yang Shi <shy828301@gmail.com>
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Reported-by: syzbot+aae069be1de40fb11825@syzkaller.appspotmail.com
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Andrea Righi <andrea.righi@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/khugepaged.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -445,22 +445,25 @@ static bool hugepage_vma_check(struct vm
+ if (!transhuge_vma_enabled(vma, vm_flags))
+ return false;
+
++ if (vma->vm_file && !IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) -
++ vma->vm_pgoff, HPAGE_PMD_NR))
++ return false;
++
+ /* Enabled via shmem mount options or sysfs settings. */
+- if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
+- return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
+- HPAGE_PMD_NR);
+- }
++ if (shmem_file(vma->vm_file))
++ return shmem_huge_enabled(vma);
+
+ /* THP settings require madvise. */
+ if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
+ return false;
+
+- /* Read-only file mappings need to be aligned for THP to work. */
++ /* Only regular file is valid */
+ if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
+- !inode_is_open_for_write(vma->vm_file->f_inode) &&
+ (vm_flags & VM_EXEC)) {
+- return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
+- HPAGE_PMD_NR);
++ struct inode *inode = vma->vm_file->f_inode;
++
++ return !inode_is_open_for_write(inode) &&
++ S_ISREG(inode->i_mode);
+ }
+
+ if (!vma->anon_vma || vma->vm_ops)
--- /dev/null
+From 74c42e1baacf206338b1dd6b6199ac964512b5bb Mon Sep 17 00:00:00 2001
+From: Rongwei Wang <rongwei.wang@linux.alibaba.com>
+Date: Thu, 28 Oct 2021 14:36:27 -0700
+Subject: mm, thp: bail out early in collapse_file for writeback page
+
+From: Rongwei Wang <rongwei.wang@linux.alibaba.com>
+
+commit 74c42e1baacf206338b1dd6b6199ac964512b5bb upstream.
+
+Currently collapse_file does not explicitly check PG_writeback, instead,
+page_has_private and try_to_release_page are used to filter writeback
+pages. This does not work for xfs with blocksize equal to or larger
+than pagesize, because in such case xfs has no page->private.
+
+This makes collapse_file bail out early for writeback page. Otherwise,
+xfs end_page_writeback will panic as follows.
+
+ page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32
+ aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so"
+ flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback)
+ raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8
+ raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000
+ page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
+ page->mem_cgroup:ffff0000c3e9a000
+ ------------[ cut here ]------------
+ kernel BUG at include/linux/mm.h:1212!
+ Internal error: Oops - BUG: 0 [#1] SMP
+ Modules linked in:
+ BUG: Bad page state in process khugepaged pfn:84ef32
+ xfs(E)
+ page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32
+ libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ...
+ CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ...
+ pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
+ Call trace:
+ end_page_writeback+0x1c0/0x214
+ iomap_finish_page_writeback+0x13c/0x204
+ iomap_finish_ioend+0xe8/0x19c
+ iomap_writepage_end_bio+0x38/0x50
+ bio_endio+0x168/0x1ec
+ blk_update_request+0x278/0x3f0
+ blk_mq_end_request+0x34/0x15c
+ virtblk_request_done+0x38/0x74 [virtio_blk]
+ blk_done_softirq+0xc4/0x110
+ __do_softirq+0x128/0x38c
+ __irq_exit_rcu+0x118/0x150
+ irq_exit+0x1c/0x30
+ __handle_domain_irq+0x8c/0xf0
+ gic_handle_irq+0x84/0x108
+ el1_irq+0xcc/0x180
+ arch_cpu_idle+0x18/0x40
+ default_idle_call+0x4c/0x1a0
+ cpuidle_idle_call+0x168/0x1e0
+ do_idle+0xb4/0x104
+ cpu_startup_entry+0x30/0x9c
+ secondary_start_kernel+0x104/0x180
+ Code: d4210000 b0006161 910c8021 94013f4d (d4210000)
+ ---[ end trace 4a88c6a074082f8c ]---
+ Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt
+
+Link: https://lkml.kernel.org/r/20211022023052.33114-1-rongwei.wang@linux.alibaba.com
+Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
+Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com>
+Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
+Suggested-by: Yang Shi <shy828301@gmail.com>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: Yang Shi <shy828301@gmail.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Song Liu <song@kernel.org>
+Cc: William Kucharski <william.kucharski@oracle.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/khugepaged.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1763,6 +1763,10 @@ static void collapse_file(struct mm_stru
+ filemap_flush(mapping);
+ result = SCAN_FAIL;
+ goto xa_unlocked;
++ } else if (PageWriteback(page)) {
++ xas_unlock_irq(&xas);
++ result = SCAN_FAIL;
++ goto xa_unlocked;
+ } else if (trylock_page(page)) {
+ get_page(page);
+ xas_unlock_irq(&xas);
+@@ -1798,7 +1802,8 @@ static void collapse_file(struct mm_stru
+ goto out_unlock;
+ }
+
+- if (!is_shmem && PageDirty(page)) {
++ if (!is_shmem && (PageDirty(page) ||
++ PageWriteback(page))) {
+ /*
+ * khugepaged only works on read-only fd, so this
+ * page is dirty because it hasn't been flushed
--- /dev/null
+From 92b18252b91de567cd875f2e84722b10ab34ee28 Mon Sep 17 00:00:00 2001
+From: Wenbin Mei <wenbin.mei@mediatek.com>
+Date: Tue, 26 Oct 2021 15:08:12 +0800
+Subject: mmc: cqhci: clear HALT state after CQE enable
+
+From: Wenbin Mei <wenbin.mei@mediatek.com>
+
+commit 92b18252b91de567cd875f2e84722b10ab34ee28 upstream.
+
+While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush
+cache) and disable cqe, for resume back, we enable CQE and not clear HALT
+state.
+In this case MediaTek mmc host controller will keep the value for HALT
+state after CQE disable/enable flow, so the next CQE transfer after resume
+will be timeout due to CQE is in HALT state, the log as below:
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP ===========
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps: 0x100020b6 | Version: 0x00000510
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config: 0x00001103 | Control: 0x00000001
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat: 0x00000000 | Int enab: 0x00000006
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig: 0x00000006 | Int Coal: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base: 0xfd05f000 | TDL up32: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell: 0x8000203c | TCN: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr: 0x00000000 | SSC1: 0x00001000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2: 0x00000001 | DCMD rsp: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask: 0xfdf9a080 | TERRI: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx: 0x00000000 | Resp arg: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP: 0x00000000 | CRNQDUN: 0x00000000
+<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS: 0x00000000 | CRNQIE: 0x00000000
+
+This change check HALT state after CQE enable, if CQE is in HALT state, we
+will clear it.
+
+Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
+Cc: stable@vger.kernel.org
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
+Link: https://lore.kernel.org/r/20211026070812.9359-1-wenbin.mei@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/cqhci-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/host/cqhci-core.c
++++ b/drivers/mmc/host/cqhci-core.c
+@@ -282,6 +282,9 @@ static void __cqhci_enable(struct cqhci_
+
+ cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
+
++ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
++ cqhci_writel(cq_host, 0, CQHCI_CTL);
++
+ mmc->cqe_on = true;
+
+ if (cq_host->ops->enable)
--- /dev/null
+From 697542bceae51f7620af333b065dd09d213629fb Mon Sep 17 00:00:00 2001
+From: Jaehoon Chung <jh80.chung@samsung.com>
+Date: Fri, 22 Oct 2021 17:21:06 +0900
+Subject: mmc: dw_mmc: exynos: fix the finding clock sample value
+
+From: Jaehoon Chung <jh80.chung@samsung.com>
+
+commit 697542bceae51f7620af333b065dd09d213629fb upstream.
+
+Even though there are candiates value if can't find best value, it's
+returned -EIO. It's not proper behavior.
+If there is not best value, use a first candiate value to work eMMC.
+
+Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Christian Hewitt <christianshewitt@gmail.com>
+Cc: stable@vger.kernel.org
+Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence")
+Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/dw_mmc-exynos.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/mmc/host/dw_mmc-exynos.c
++++ b/drivers/mmc/host/dw_mmc-exynos.c
+@@ -464,6 +464,18 @@ static s8 dw_mci_exynos_get_best_clksmpl
+ }
+ }
+
++ /*
++ * If there is no cadiates value, then it needs to return -EIO.
++ * If there are candiates values and don't find bset clk sample value,
++ * then use a first candiates clock sample value.
++ */
++ for (i = 0; i < iter; i++) {
++ __c = ror8(candiates, i);
++ if ((__c & 0x1) == 0x1) {
++ loc = i;
++ goto out;
++ }
++ }
+ out:
+ return loc;
+ }
+@@ -494,6 +506,8 @@ static int dw_mci_exynos_execute_tuning(
+ priv->tuned_sample = found;
+ } else {
+ ret = -EIO;
++ dev_warn(&mmc->class_dev,
++ "There is no candiates value about clksmpl!\n");
+ }
+
+ return ret;
--- /dev/null
+From e8a1ff65927080278e6826f797b7c197fb2611a6 Mon Sep 17 00:00:00 2001
+From: Wenbin Mei <wenbin.mei@mediatek.com>
+Date: Thu, 28 Oct 2021 10:20:49 +0800
+Subject: mmc: mediatek: Move cqhci init behind ungate clock
+
+From: Wenbin Mei <wenbin.mei@mediatek.com>
+
+commit e8a1ff65927080278e6826f797b7c197fb2611a6 upstream.
+
+We must enable clock before cqhci init, because crypto needs read
+information from CQHCI registers, otherwise, it will hang in MediaTek mmc
+host controller.
+
+Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
+Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support")
+Cc: stable@vger.kernel.org
+Acked-by: Chaotian Jing <chaotian.jing@mediatek.com>
+Link: https://lore.kernel.org/r/20211028022049.22129-1-wenbin.mei@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/mtk-sd.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -2577,6 +2577,25 @@ static int msdc_drv_probe(struct platfor
+ host->dma_mask = DMA_BIT_MASK(32);
+ mmc_dev(mmc)->dma_mask = &host->dma_mask;
+
++ host->timeout_clks = 3 * 1048576;
++ host->dma.gpd = dma_alloc_coherent(&pdev->dev,
++ 2 * sizeof(struct mt_gpdma_desc),
++ &host->dma.gpd_addr, GFP_KERNEL);
++ host->dma.bd = dma_alloc_coherent(&pdev->dev,
++ MAX_BD_NUM * sizeof(struct mt_bdma_desc),
++ &host->dma.bd_addr, GFP_KERNEL);
++ if (!host->dma.gpd || !host->dma.bd) {
++ ret = -ENOMEM;
++ goto release_mem;
++ }
++ msdc_init_gpd_bd(host, &host->dma);
++ INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout);
++ spin_lock_init(&host->lock);
++
++ platform_set_drvdata(pdev, mmc);
++ msdc_ungate_clock(host);
++ msdc_init_hw(host);
++
+ if (mmc->caps2 & MMC_CAP2_CQE) {
+ host->cq_host = devm_kzalloc(mmc->parent,
+ sizeof(*host->cq_host),
+@@ -2597,25 +2616,6 @@ static int msdc_drv_probe(struct platfor
+ mmc->max_seg_size = 64 * 1024;
+ }
+
+- host->timeout_clks = 3 * 1048576;
+- host->dma.gpd = dma_alloc_coherent(&pdev->dev,
+- 2 * sizeof(struct mt_gpdma_desc),
+- &host->dma.gpd_addr, GFP_KERNEL);
+- host->dma.bd = dma_alloc_coherent(&pdev->dev,
+- MAX_BD_NUM * sizeof(struct mt_bdma_desc),
+- &host->dma.bd_addr, GFP_KERNEL);
+- if (!host->dma.gpd || !host->dma.bd) {
+- ret = -ENOMEM;
+- goto release_mem;
+- }
+- msdc_init_gpd_bd(host, &host->dma);
+- INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout);
+- spin_lock_init(&host->lock);
+-
+- platform_set_drvdata(pdev, mmc);
+- msdc_ungate_clock(host);
+- msdc_init_hw(host);
+-
+ ret = devm_request_irq(&pdev->dev, host->irq, msdc_irq,
+ IRQF_TRIGGER_NONE, pdev->name, host);
+ if (ret)
--- /dev/null
+From 9af372dc70e9fdcbb70939dac75365e7b88580b4 Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Fri, 15 Oct 2021 10:00:36 +0800
+Subject: mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 9af372dc70e9fdcbb70939dac75365e7b88580b4 upstream.
+
+To reset standard tuning circuit completely, after clear ESDHC_MIX_CTRL_EXE_TUNE,
+also need to clear bit buffer_read_ready, this operation will finally clear the
+USDHC IP internal logic flag execute_tuning_with_clr_buf, make sure the following
+normal data transfer will not be impacted by standard tuning logic used before.
+
+Find this issue when do quick SD card insert/remove stress test. During standard
+tuning prodedure, if remove SD card, USDHC standard tuning logic can't clear the
+internal flag execute_tuning_with_clr_buf. Next time when insert SD card, all
+data related commands can't get any data related interrupts, include data transfer
+complete interrupt, data timeout interrupt, data CRC interrupt, data end bit interrupt.
+Always trigger software timeout issue. Even reset the USDHC through bits in register
+SYS_CTRL (0x2C, bit28 reset tuning, bit26 reset data, bit 25 reset command, bit 24
+reset all) can't recover this. From the user's point of view, USDHC stuck, SD can't
+be recognized any more.
+
+Fixes: d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card")
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1634263236-6111-1-git-send-email-haibo.chen@nxp.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -1133,6 +1133,7 @@ static void esdhc_reset_tuning(struct sd
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+ u32 ctrl;
++ int ret;
+
+ /* Reset the tuning circuit */
+ if (esdhc_is_usdhc(imx_data)) {
+@@ -1145,7 +1146,22 @@ static void esdhc_reset_tuning(struct sd
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+ ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
++ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
+ writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
++ /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
++ ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
++ ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
++ if (ret == -ETIMEDOUT)
++ dev_warn(mmc_dev(host->mmc),
++ "Warning! clear execute tuning bit failed\n");
++ /*
++ * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
++ * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
++ * will finally make sure the normal data transfer logic correct.
++ */
++ ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
++ ctrl |= SDHCI_INT_DATA_AVAIL;
++ writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
+ }
+ }
+ }
--- /dev/null
+From 4217d07b9fb328751f877d3bd9550122014860a2 Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo@linaro.org>
+Date: Mon, 4 Oct 2021 10:49:35 +0800
+Subject: mmc: sdhci: Map more voltage level to SDHCI_POWER_330
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+commit 4217d07b9fb328751f877d3bd9550122014860a2 upstream.
+
+On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V),
+which is being treated as an invalid value by sdhci_set_power_noreg().
+And thus eMMC is totally broken on the platform.
+
+[ 1.436599] ------------[ cut here ]------------
+[ 1.436606] mmc0: Invalid vdd 0x17
+[ 1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4
+[ 1.436655] Modules linked in:
+[ 1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G W 5.15.0-rc1+ #137
+[ 1.436669] Hardware name: Thundercomm TurboX CM2290 (DT)
+[ 1.436674] Workqueue: events_unbound async_run_entry_fn
+[ 1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4
+[ 1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4
+[ 1.436703] sp : ffff800010803a60
+[ 1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70
+[ 1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280
+[ 1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000
+[ 1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020
+[ 1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff
+[ 1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc
+[ 1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60
+[ 1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159
+[ 1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
+[ 1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80
+[ 1.436797] Call trace:
+[ 1.436800] sdhci_set_power_noreg+0x168/0x2b4
+[ 1.436805] sdhci_set_ios+0xa0/0x7fc
+[ 1.436811] mmc_power_up.part.0+0xc4/0x164
+[ 1.436818] mmc_start_host+0xa0/0xb0
+[ 1.436824] mmc_add_host+0x60/0x90
+[ 1.436830] __sdhci_add_host+0x174/0x330
+[ 1.436836] sdhci_msm_probe+0x7c0/0x920
+[ 1.436842] platform_probe+0x68/0xe0
+[ 1.436850] really_probe.part.0+0x9c/0x31c
+[ 1.436857] __driver_probe_device+0x98/0x144
+[ 1.436863] driver_probe_device+0xc8/0x15c
+[ 1.436869] __device_attach_driver+0xb4/0x120
+[ 1.436875] bus_for_each_drv+0x78/0xd0
+[ 1.436881] __device_attach_async_helper+0xac/0xd0
+[ 1.436888] async_run_entry_fn+0x34/0x110
+[ 1.436895] process_one_work+0x1d0/0x354
+[ 1.436903] worker_thread+0x13c/0x470
+[ 1.436910] kthread+0x150/0x160
+[ 1.436915] ret_from_fork+0x10/0x20
+[ 1.436923] ---[ end trace fcfac44cb045c3a8 ]---
+
+Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to
+SDHCI_POWER_330 as well.
+
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2042,6 +2042,12 @@ void sdhci_set_power_noreg(struct sdhci_
+ break;
+ case MMC_VDD_32_33:
+ case MMC_VDD_33_34:
++ /*
++ * 3.4 ~ 3.6V are valid only for those platforms where it's
++ * known that the voltage range is supported by hardware.
++ */
++ case MMC_VDD_34_35:
++ case MMC_VDD_35_36:
+ pwr = SDHCI_POWER_330;
+ break;
+ default:
--- /dev/null
+From 6ab4e2eb5e956a61e4d53cea3ab8c866ba79a830 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 13 Oct 2021 23:17:18 +0300
+Subject: mmc: sdhci-pci: Read card detect from ACPI for Intel Merrifield
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 6ab4e2eb5e956a61e4d53cea3ab8c866ba79a830 upstream.
+
+Intel Merrifield platform had been converted to use ACPI enumeration.
+However, the driver missed an update to retrieve card detect GPIO.
+Fix it here.
+
+Unfortunately we can't rely on CD GPIO state because there are two
+different PCB designs in the wild that are using the opposite card
+detection sense and there is no way to distinguish those platforms,
+that's why ignore CD GPIO completely and use it only as an event.
+
+Fixes: 4590d98f5a4f ("sfi: Remove framework for deprecated firmware")
+BugLink: https://github.com/edison-fw/meta-intel-edison/issues/135
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20211013201723.52212-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -616,16 +616,12 @@ static int intel_select_drive_strength(s
+ return intel_host->drv_strength;
+ }
+
+-static int bxt_get_cd(struct mmc_host *mmc)
++static int sdhci_get_cd_nogpio(struct mmc_host *mmc)
+ {
+- int gpio_cd = mmc_gpio_get_cd(mmc);
+ struct sdhci_host *host = mmc_priv(mmc);
+ unsigned long flags;
+ int ret = 0;
+
+- if (!gpio_cd)
+- return 0;
+-
+ spin_lock_irqsave(&host->lock, flags);
+
+ if (host->flags & SDHCI_DEVICE_DEAD)
+@@ -638,6 +634,21 @@ out:
+ return ret;
+ }
+
++static int bxt_get_cd(struct mmc_host *mmc)
++{
++ int gpio_cd = mmc_gpio_get_cd(mmc);
++
++ if (!gpio_cd)
++ return 0;
++
++ return sdhci_get_cd_nogpio(mmc);
++}
++
++static int mrfld_get_cd(struct mmc_host *mmc)
++{
++ return sdhci_get_cd_nogpio(mmc);
++}
++
+ #define SDHCI_INTEL_PWR_TIMEOUT_CNT 20
+ #define SDHCI_INTEL_PWR_TIMEOUT_UDELAY 100
+
+@@ -1341,6 +1352,14 @@ static int intel_mrfld_mmc_probe_slot(st
+ MMC_CAP_1_8V_DDR;
+ break;
+ case INTEL_MRFLD_SD:
++ slot->cd_idx = 0;
++ slot->cd_override_level = true;
++ /*
++ * There are two PCB designs of SD card slot with the opposite
++ * card detection sense. Quirk this out by ignoring GPIO state
++ * completely in the custom ->get_cd() callback.
++ */
++ slot->host->mmc_host_ops.get_cd = mrfld_get_cd;
+ slot->host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+ break;
+ case INTEL_MRFLD_SDIO:
--- /dev/null
+From 90935eb303e0d12f3d3d0383262e65290321f5f6 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 28 Oct 2021 21:51:49 +0200
+Subject: mmc: tmio: reenable card irqs after the reset callback
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 90935eb303e0d12f3d3d0383262e65290321f5f6 upstream.
+
+The reset callback may clear the internal card detect interrupts, so
+make sure to reenable them if needed.
+
+Fixes: b4d86f37eacb ("mmc: renesas_sdhi: do hard reset if possible")
+Reported-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20211028195149.8003-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/tmio_mmc_core.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -195,6 +195,10 @@ static void tmio_mmc_reset(struct tmio_m
+ sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, host->sdcard_irq_mask_all);
+ host->sdcard_irq_mask = host->sdcard_irq_mask_all;
+
++ if (host->native_hotplug)
++ tmio_mmc_enable_mmc_irqs(host,
++ TMIO_STAT_CARD_REMOVE | TMIO_STAT_CARD_INSERT);
++
+ tmio_mmc_set_bus_width(host, host->mmc->ios.bus_width);
+
+ if (host->pdata->flags & TMIO_MMC_SDIO_IRQ) {
+@@ -956,8 +960,15 @@ static void tmio_mmc_set_ios(struct mmc_
+ case MMC_POWER_OFF:
+ tmio_mmc_power_off(host);
+ /* For R-Car Gen2+, we need to reset SDHI specific SCC */
+- if (host->pdata->flags & TMIO_MMC_MIN_RCAR2)
++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) {
+ host->reset(host);
++
++ if (host->native_hotplug)
++ tmio_mmc_enable_mmc_irqs(host,
++ TMIO_STAT_CARD_REMOVE |
++ TMIO_STAT_CARD_INSERT);
++ }
++
+ host->set_clock(host, 0);
+ break;
+ case MMC_POWER_UP:
+@@ -1185,10 +1196,6 @@ int tmio_mmc_host_probe(struct tmio_mmc_
+ _host->set_clock(_host, 0);
+ tmio_mmc_reset(_host);
+
+- if (_host->native_hotplug)
+- tmio_mmc_enable_mmc_irqs(_host,
+- TMIO_STAT_CARD_REMOVE | TMIO_STAT_CARD_INSERT);
+-
+ spin_lock_init(&_host->lock);
+ mutex_init(&_host->ios_lock);
+
--- /dev/null
+From 8c8171929116cc23f74743d99251eedadf62341a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 25 Oct 2021 13:56:08 +0200
+Subject: mmc: vub300: fix control-message timeouts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8c8171929116cc23f74743d99251eedadf62341a upstream.
+
+USB control-message timeouts are specified in milliseconds and should
+specifically not vary with CONFIG_HZ.
+
+Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
+Cc: stable@vger.kernel.org # 3.0
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/vub300.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -576,7 +576,7 @@ static void check_vub300_port_status(str
+ GET_SYSTEM_PORT_STATUS,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->system_port_status,
+- sizeof(vub300->system_port_status), HZ);
++ sizeof(vub300->system_port_status), 1000);
+ if (sizeof(vub300->system_port_status) == retval)
+ new_system_port_status(vub300);
+ }
+@@ -1241,7 +1241,7 @@ static void __download_offload_pseudocod
+ SET_INTERRUPT_PSEUDOCODE,
+ USB_DIR_OUT | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, 0x0000, 0x0000,
+- xfer_buffer, xfer_length, HZ);
++ xfer_buffer, xfer_length, 1000);
+ kfree(xfer_buffer);
+ if (retval < 0)
+ goto copy_error_message;
+@@ -1284,7 +1284,7 @@ static void __download_offload_pseudocod
+ SET_TRANSFER_PSEUDOCODE,
+ USB_DIR_OUT | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, 0x0000, 0x0000,
+- xfer_buffer, xfer_length, HZ);
++ xfer_buffer, xfer_length, 1000);
+ kfree(xfer_buffer);
+ if (retval < 0)
+ goto copy_error_message;
+@@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_CLOCK_SPEED,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x00, 0x00, buf, buf_array_size, HZ);
++ 0x00, 0x00, buf, buf_array_size, 1000);
+ if (retval != 8) {
+ dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
+ " %dkHz failed with retval=%d\n", kHzClock, retval);
+@@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mm
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_SD_POWER,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0000, 0x0000, NULL, 0, HZ);
++ 0x0000, 0x0000, NULL, 0, 1000);
+ /* must wait for the VUB300 u-proc to boot up */
+ msleep(600);
+ } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_SD_POWER,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0001, 0x0000, NULL, 0, HZ);
++ 0x0001, 0x0000, NULL, 0, 1000);
+ msleep(600);
+ vub300->card_powered = 1;
+ } else if (ios->power_mode == MMC_POWER_ON) {
+@@ -2275,14 +2275,14 @@ static int vub300_probe(struct usb_inter
+ GET_HC_INF0,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->hc_info,
+- sizeof(vub300->hc_info), HZ);
++ sizeof(vub300->hc_info), 1000);
+ if (retval < 0)
+ goto error5;
+ retval =
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_ROM_WAIT_STATES,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
+ if (retval < 0)
+ goto error5;
+ dev_info(&vub300->udev->dev,
+@@ -2297,7 +2297,7 @@ static int vub300_probe(struct usb_inter
+ GET_SYSTEM_PORT_STATUS,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->system_port_status,
+- sizeof(vub300->system_port_status), HZ);
++ sizeof(vub300->system_port_status), 1000);
+ if (retval < 0) {
+ goto error4;
+ } else if (sizeof(vub300->system_port_status) == retval) {
--- /dev/null
+From db6c3c064f5d55fa9969f33eafca3cdbefbb3541 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 26 Oct 2021 12:36:17 +0200
+Subject: net: lan78xx: fix division by zero in send path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream.
+
+Add the missing endpoint max-packet sanity check to probe() to avoid
+division by zero in lan78xx_tx_bh() in case a malicious device has
+broken descriptors (or when doing descriptor fuzz testing).
+
+Note that USB core will reject URBs submitted for endpoints with zero
+wMaxPacketSize but that drivers doing packet-size calculations still
+need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
+endpoint descriptors with maxpacket=0")).
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Cc: stable@vger.kernel.org # 4.3
+Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/lan78xx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3734,6 +3734,12 @@ static int lan78xx_probe(struct usb_inte
+
+ dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
+
++ /* Reject broken descriptors. */
++ if (dev->maxpacket == 0) {
++ ret = -ENODEV;
++ goto out4;
++ }
++
+ /* driver requires remote-wakeup capability during autosuspend. */
+ intf->needs_remote_wakeup = 1;
+
--- /dev/null
+From 25e1f67eda4a19c91dc05c84d6d413c53efb447b Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Sun, 24 Oct 2021 10:43:31 +0300
+Subject: nvme-tcp: fix H2CData PDU send accounting (again)
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+commit 25e1f67eda4a19c91dc05c84d6d413c53efb447b upstream.
+
+We should not access request members after the last send, even to
+determine if indeed it was the last data payload send. The reason is
+that a completion could have arrived and trigger a new execution of the
+request which overridden these members. This was fixed by commit
+825619b09ad3 ("nvme-tcp: fix possible use-after-completion").
+
+Commit e371af033c56 broke that assumption again to address cases where
+multiple r2t pdus are sent per request. To fix it, we need to record the
+request data_sent and data_len and after the payload network send we
+reference these counters to determine weather we should advance the
+request iterator.
+
+Fixes: e371af033c56 ("nvme-tcp: fix incorrect h2cdata pdu offset accounting")
+Reported-by: Keith Busch <kbusch@kernel.org>
+Cc: stable@vger.kernel.org # 5.10+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/tcp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -913,12 +913,14 @@ static void nvme_tcp_fail_request(struct
+ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
+ {
+ struct nvme_tcp_queue *queue = req->queue;
++ int req_data_len = req->data_len;
+
+ while (true) {
+ struct page *page = nvme_tcp_req_cur_page(req);
+ size_t offset = nvme_tcp_req_cur_offset(req);
+ size_t len = nvme_tcp_req_cur_length(req);
+ bool last = nvme_tcp_pdu_last_send(req, len);
++ int req_data_sent = req->data_sent;
+ int ret, flags = MSG_DONTWAIT;
+
+ if (last && !queue->data_digest && !nvme_tcp_queue_more(queue))
+@@ -945,7 +947,7 @@ static int nvme_tcp_try_send_data(struct
+ * in the request where we don't want to modify it as we may
+ * compete with the RX path completing the request.
+ */
+- if (req->data_sent + ret < req->data_len)
++ if (req_data_sent + ret < req_data_len)
+ nvme_tcp_advance_req(req, ret);
+
+ /* fully successful last send in current PDU */
--- /dev/null
+From 6f1b228529ae49b0f85ab89bcdb6c365df401558 Mon Sep 17 00:00:00 2001
+From: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+Date: Thu, 28 Oct 2021 14:36:17 -0700
+Subject: ocfs2: fix race between searching chunks and release journal_head from buffer_head
+
+From: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+
+commit 6f1b228529ae49b0f85ab89bcdb6c365df401558 upstream.
+
+Encountered a race between ocfs2_test_bg_bit_allocatable() and
+jbd2_journal_put_journal_head() resulting in the below vmcore.
+
+ PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3"
+ Call trace:
+ panic
+ oops_end
+ no_context
+ __bad_area_nosemaphore
+ bad_area_nosemaphore
+ __do_page_fault
+ do_page_fault
+ page_fault
+ [exception RIP: ocfs2_block_group_find_clear_bits+316]
+ ocfs2_block_group_find_clear_bits [ocfs2]
+ ocfs2_cluster_group_search [ocfs2]
+ ocfs2_search_chain [ocfs2]
+ ocfs2_claim_suballoc_bits [ocfs2]
+ __ocfs2_claim_clusters [ocfs2]
+ ocfs2_claim_clusters [ocfs2]
+ ocfs2_local_alloc_slide_window [ocfs2]
+ ocfs2_reserve_local_alloc_bits [ocfs2]
+ ocfs2_reserve_clusters_with_limit [ocfs2]
+ ocfs2_reserve_clusters [ocfs2]
+ ocfs2_lock_refcount_allocators [ocfs2]
+ ocfs2_make_clusters_writable [ocfs2]
+ ocfs2_replace_cow [ocfs2]
+ ocfs2_refcount_cow [ocfs2]
+ ocfs2_file_write_iter [ocfs2]
+ lo_rw_aio
+ loop_queue_work
+ kthread_worker_fn
+ kthread
+ ret_from_fork
+
+When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the
+bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and
+released the jounal head from the buffer head. Needed to take bit lock
+for the bit 'BH_JournalHead' to fix this race.
+
+Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com
+Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: <rajesh.sivaramasubramaniom@oracle.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ocfs2/suballoc.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -1251,7 +1251,7 @@ static int ocfs2_test_bg_bit_allocatable
+ {
+ struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data;
+ struct journal_head *jh;
+- int ret;
++ int ret = 1;
+
+ if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap))
+ return 0;
+@@ -1259,14 +1259,18 @@ static int ocfs2_test_bg_bit_allocatable
+ if (!buffer_jbd(bg_bh))
+ return 1;
+
+- jh = bh2jh(bg_bh);
+- spin_lock(&jh->b_state_lock);
+- bg = (struct ocfs2_group_desc *) jh->b_committed_data;
+- if (bg)
+- ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
+- else
+- ret = 1;
+- spin_unlock(&jh->b_state_lock);
++ jbd_lock_bh_journal_head(bg_bh);
++ if (buffer_jbd(bg_bh)) {
++ jh = bh2jh(bg_bh);
++ spin_lock(&jh->b_state_lock);
++ bg = (struct ocfs2_group_desc *) jh->b_committed_data;
++ if (bg)
++ ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
++ else
++ ret = 1;
++ spin_unlock(&jh->b_state_lock);
++ }
++ jbd_unlock_bh_journal_head(bg_bh);
+
+ return ret;
+ }
nfc-port100-fix-using-errno-as-command-type-mask.patch
revert-net-mdiobus-fix-memory-leak-in-__mdiobus_register.patch
net-tls-fix-flipped-sign-in-tls_err_abort-calls.patch
+mmc-vub300-fix-control-message-timeouts.patch
+mmc-cqhci-clear-halt-state-after-cqe-enable.patch
+mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch
+mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch
+mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch
+mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch
+mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch
+mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch
+block-fix-partition-check-for-host-aware-zoned-block-devices.patch
+ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch
+nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch
+ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch
+cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch
+cfg80211-fix-management-registrations-locking.patch
+net-lan78xx-fix-division-by-zero-in-send-path.patch
+drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch
+mm-hwpoison-remove-the-unnecessary-thp-check.patch
+mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch
+mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch
+mm-khugepaged-skip-huge-page-collapse-for-special-files.patch
+arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch
+arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch
+arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch
+arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch
+arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch
+mac80211-mesh-fix-he-operation-element-length-check.patch
+drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch
+drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch
+drm-i915-catch-yet-another-unconditioal-clflush.patch
+drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch
+drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch
+drm-amdgpu-fix-out-of-bounds-write.patch
+drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch
+drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch
+drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch
+drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch
+drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch
+drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch
+drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch
+drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
