--- /dev/null
+From e83c67e6a43aa5567e43db3280fb49f9441bc19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 19:27:48 +0800
+Subject: ACPI: AMBA: Fix resource name in /proc/iomem
+
+From: Liguang Zhang <zhangliguang@linux.alibaba.com>
+
+[ Upstream commit 7718629432676b5ebd9a32940782fe297a0abf8d ]
+
+In function amba_handler_attach(), dev->res.name is initialized by
+amba_device_alloc. But when address_found is false, dev->res.name is
+assigned to null value, which leads to wrong resource name display in
+/proc/iomem, "<BAD>" is seen for those resources.
+
+Signed-off-by: Liguang Zhang <zhangliguang@linux.alibaba.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_amba.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/acpi/acpi_amba.c b/drivers/acpi/acpi_amba.c
+index 7f77c071709a..eb09ee71ceb2 100644
+--- a/drivers/acpi/acpi_amba.c
++++ b/drivers/acpi/acpi_amba.c
+@@ -70,6 +70,7 @@ static int amba_handler_attach(struct acpi_device *adev,
+ case IORESOURCE_MEM:
+ if (!address_found) {
+ dev->res = *rentry->res;
++ dev->res.name = dev_name(&dev->dev);
+ address_found = true;
+ }
+ break;
+--
+2.30.2
+
--- /dev/null
+From fcc3a661e7473674638b555fc40ea29be047ec5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 17:23:16 +0200
+Subject: ACPI: video: Add quirk for the Dell Vostro 3350
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 9249c32ec9197e8d34fe5179c9e31668a205db04 ]
+
+The Dell Vostro 3350 ACPI video-bus device reports spurious
+ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE
+events being reported to userspace (and causing trouble there).
+
+Add a quirk setting the report_key_events mask to
+REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE
+events will be ignored, while still reporting brightness up/down
+hotkey-presses to userspace normally.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1911763
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_video.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 1a23e7aa74df..ac54fc03cf81 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -556,6 +556,15 @@ static const struct dmi_system_id video_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
+ },
+ },
++ {
++ .callback = video_set_report_key_events,
++ .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS),
++ .ident = "Dell Vostro 3350",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"),
++ },
++ },
+ /*
+ * Some machines change the brightness themselves when a brightness
+ * hotkey gets pressed, despite us telling them not to. In this case
+--
+2.30.2
+
--- /dev/null
+From 4bc8154b94156988adee5c20697bb3ae0a73a6d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 May 2021 05:38:11 -0400
+Subject: ALSA: ac97: fix PM reference leak in ac97_bus_remove()
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit a38e93302ee25b2ca6f4ee76c6c974cf3637985e ]
+
+pm_runtime_get_sync will increment pm usage counter even it failed.
+Forgetting to putting operation will result in reference leak here.
+Fix it by replacing it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Link: https://lore.kernel.org/r/20210524093811.612302-1-yuyufen@huawei.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/ac97/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
+index ca50ff444796..d8b227e6d4cf 100644
+--- a/sound/ac97/bus.c
++++ b/sound/ac97/bus.c
+@@ -523,7 +523,7 @@ static int ac97_bus_remove(struct device *dev)
+ struct ac97_codec_driver *adrv = to_ac97_driver(dev->driver);
+ int ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 58d3cda0719abd83f5d3d82606abd87a2a2f80bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jun 2021 17:39:22 +0900
+Subject: ALSA: bebob: add support for ToneWeal FW66
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 50ebe56222bfa0911a932930f9229ee5995508d9 ]
+
+A user of FFADO project reported the issue of ToneWeal FW66. As a result,
+the device is identified as one of applications of BeBoB solution.
+
+I note that in the report the device returns contradictory result in plug
+discovery process for audio subunit. Fortunately ALSA BeBoB driver doesn't
+perform it thus it's likely to handle the device without issues.
+
+I receive no reaction to test request for this patch yet, however it would
+be worth to add support for it.
+
+daniel@gibbonmoon:/sys/bus/firewire/devices/fw1$ grep -r . *
+Binary file config_rom matches
+dev:244:1
+guid:0x0023270002000000
+hardware_version:0x000002
+is_local:0
+model:0x020002
+model_name:FW66
+power/runtime_active_time:0
+power/runtime_active_kids:0
+power/runtime_usage:0
+power/runtime_status:unsupported
+power/async:disabled
+power/runtime_suspended_time:0
+power/runtime_enabled:disabled
+power/control:auto
+subsystem/drivers_autoprobe:1
+uevent:MAJOR=244
+uevent:MINOR=1
+uevent:DEVNAME=fw1
+units:0x00a02d:0x010001
+vendor:0x002327
+vendor_name:ToneWeal
+fw1.0/uevent:MODALIAS=ieee1394:ven00002327mo00020002sp0000A02Dver00010001
+fw1.0/power/runtime_active_time:0
+fw1.0/power/runtime_active_kids:0
+fw1.0/power/runtime_usage:0
+fw1.0/power/runtime_status:unsupported
+fw1.0/power/async:disabled
+fw1.0/power/runtime_suspended_time:0
+fw1.0/power/runtime_enabled:disabled
+fw1.0/power/control:auto
+fw1.0/model:0x020002
+fw1.0/rom_index:15
+fw1.0/specifier_id:0x00a02d
+fw1.0/model_name:FW66
+fw1.0/version:0x010001
+fw1.0/modalias:ieee1394:ven00002327mo00020002sp0000A02Dver00010001
+
+Cc: Daniel Jozsef <daniel.jozsef@gmail.com>
+Reference: https://lore.kernel.org/alsa-devel/20200119164335.GA11974@workstation/
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210619083922.16060-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/Kconfig | 1 +
+ sound/firewire/bebob/bebob.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
+index 4e0e320b77d8..f7b26b1d7084 100644
+--- a/sound/firewire/Kconfig
++++ b/sound/firewire/Kconfig
+@@ -109,6 +109,7 @@ config SND_BEBOB
+ * M-Audio Ozonic/NRV10/ProfireLightBridge
+ * M-Audio FireWire 1814/ProjectMix IO
+ * Digidesign Mbox 2 Pro
++ * ToneWeal FW66
+
+ To compile this driver as a module, choose M here: the module
+ will be called snd-bebob.
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 8073360581f4..eac3ff24e55d 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -60,6 +60,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS);
+ #define VEN_MAUDIO1 0x00000d6c
+ #define VEN_MAUDIO2 0x000007f5
+ #define VEN_DIGIDESIGN 0x00a07e
++#define OUI_SHOUYO 0x002327
+
+ #define MODEL_FOCUSRITE_SAFFIRE_BOTH 0x00000000
+ #define MODEL_MAUDIO_AUDIOPHILE_BOTH 0x00010060
+@@ -513,6 +514,8 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ &maudio_special_spec),
+ /* Digidesign Mbox 2 Pro */
+ SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal),
++ // Toneweal FW66.
++ SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal),
+ /* IDs are unknown but able to be supported */
+ /* Apogee, Mini-ME Firewire */
+ /* Apogee, Mini-DAC Firewire */
+--
+2.30.2
+
--- /dev/null
+From 77eac8b390404115bc2d714121299e132aec3969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 21:19:42 +0800
+Subject: ALSA: hda: Add IRQ check for platform_get_irq()
+
+From: Jiajun Cao <jjcao20@fudan.edu.cn>
+
+[ Upstream commit 8c13212443230d03ff25014514ec0d53498c0912 ]
+
+The function hda_tegra_first_init() neglects to check the return
+value after executing platform_get_irq().
+
+hda_tegra_first_init() should check the return value (if negative
+error number) for errors so as to not pass a negative value to
+the devm_request_irq().
+
+Fix it by adding a check for the return value irq_id.
+
+Signed-off-by: Jiajun Cao <jjcao20@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20210622131947.94346-1-jjcao20@fudan.edu.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_tegra.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index e85fb04ec7be..b567c4bdae00 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -363,6 +363,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev)
+ unsigned short gcap;
+ int irq_id = platform_get_irq(pdev, 0);
+
++ if (irq_id < 0)
++ return irq_id;
++
+ err = hda_tegra_init_chip(chip, pdev);
+ if (err)
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 0e291de5103353bc058518b952a0770ed6798047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 15:40:51 +0800
+Subject: ALSA: isa: Fix error return code in snd_cmi8330_probe()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 31028cbed26a8afa25533a10425ffa2ab794c76c ]
+
+When 'SB_HW_16' check fails, the error code -ENODEV instead of 0 should be
+returned, which is the same as that returned when 'WSS_HW_CMI8330' check
+fails.
+
+Fixes: 43bcd973d6d0 ("[ALSA] Add snd_card_set_generic_dev() call to ISA drivers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210707074051.2663-1-thunder.leizhen@huawei.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/cmi8330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
+index 6b8c46942efb..75b3d76eb852 100644
+--- a/sound/isa/cmi8330.c
++++ b/sound/isa/cmi8330.c
+@@ -564,7 +564,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev)
+ }
+ if (acard->sb->hardware != SB_HW_16) {
+ snd_printk(KERN_ERR PFX "SB16 not found during probe\n");
+- return err;
++ return -ENODEV;
+ }
+
+ snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */
+--
+2.30.2
+
--- /dev/null
+From 973d22e9cd25ddcca2a707cf9eb4c482fa111eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jun 2021 10:11:21 +0800
+Subject: ALSA: ppc: fix error return code in snd_pmac_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 80b9c1be567c3c6bbe0d4b290af578e630485b5d ]
+
+If snd_pmac_tumbler_init() or snd_pmac_tumbler_post_init() fails,
+snd_pmac_probe() need return error code.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210616021121.1991502-1-yangyingliang@huawei.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/ppc/powermac.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
+index 33c6be9fb388..7c70ba5e2540 100644
+--- a/sound/ppc/powermac.c
++++ b/sound/ppc/powermac.c
+@@ -90,7 +90,11 @@ static int snd_pmac_probe(struct platform_device *devptr)
+ sprintf(card->shortname, "PowerMac %s", name_ext);
+ sprintf(card->longname, "%s (Dev %d) Sub-frame %d",
+ card->shortname, chip->device_id, chip->subframe);
+- if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0)
++ err = snd_pmac_tumbler_init(chip);
++ if (err < 0)
++ goto __error;
++ err = snd_pmac_tumbler_post_init();
++ if (err < 0)
+ goto __error;
+ break;
+ case PMAC_AWACS:
+--
+2.30.2
+
--- /dev/null
+From b33b92f52be986f4df9258fa20722913a9880912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 16:04:37 +0200
+Subject: ALSA: sb: Fix potential double-free of CSP mixer elements
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit c305366a37441c2ac90b08711cb6f032b43672f2 ]
+
+snd_sb_qsound_destroy() contains the calls of removing the previously
+created mixer controls, but it doesn't clear the pointers. As
+snd_sb_qsound_destroy() itself may be repeatedly called via ioctl,
+this could lead to double-free potentially.
+
+Fix it by clearing the struct fields properly afterwards.
+
+Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/sb/sb16_csp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
+index 2e00b64ef13b..b3eecde0b612 100644
+--- a/sound/isa/sb/sb16_csp.c
++++ b/sound/isa/sb/sb16_csp.c
+@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p)
+ card = p->chip->card;
+
+ down_write(&card->controls_rwsem);
+- if (p->qsound_switch)
++ if (p->qsound_switch) {
+ snd_ctl_remove(card, p->qsound_switch);
+- if (p->qsound_space)
++ p->qsound_switch = NULL;
++ }
++ if (p->qsound_space) {
+ snd_ctl_remove(card, p->qsound_space);
++ p->qsound_space = NULL;
++ }
+ up_write(&card->controls_rwsem);
+
+ /* cancel pending transfer of QSound parameters */
+--
+2.30.2
+
--- /dev/null
+From e4ee31fc6506a62b40c68315466c549d8eb343e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jun 2021 20:29:26 +0100
+Subject: ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 8b95a7d90ce8160ac5cffd5bace6e2eba01a871e ]
+
+There's a few instructions that GAS infers operands but Clang doesn't;
+from what I can tell the Arm ARM doesn't say these are optional.
+
+F5.1.257 TBB, TBH T1 Halfword variant
+F5.1.238 STREXD T1 variant
+F5.1.84 LDREXD T1 variant
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/1309
+
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Jian Cai <jiancai@google.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/probes/kprobes/test-thumb.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c
+index b683b4517458..4254391f3906 100644
+--- a/arch/arm/probes/kprobes/test-thumb.c
++++ b/arch/arm/probes/kprobes/test-thumb.c
+@@ -444,21 +444,21 @@ void kprobe_thumb32_test_cases(void)
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,"]",
++ TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,"]",
++ TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RRX("tbh [r",1,9f, ", r",14,1,"]",
++ TEST_RRX("tbh [r",1,9f, ", r",14,1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+@@ -471,10 +471,10 @@ void kprobe_thumb32_test_cases(void)
+
+ TEST_UNSUPPORTED("strexb r0, r1, [r2]")
+ TEST_UNSUPPORTED("strexh r0, r1, [r2]")
+- TEST_UNSUPPORTED("strexd r0, r1, [r2]")
++ TEST_UNSUPPORTED("strexd r0, r1, r2, [r2]")
+ TEST_UNSUPPORTED("ldrexb r0, [r1]")
+ TEST_UNSUPPORTED("ldrexh r0, [r1]")
+- TEST_UNSUPPORTED("ldrexd r0, [r1]")
++ TEST_UNSUPPORTED("ldrexd r0, r1, [r1]")
+
+ TEST_GROUP("Data-processing (shifted register) and (modified immediate)")
+
+--
+2.30.2
+
--- /dev/null
+From 02a3aa7f5ac42f780c4c7cfbfbc51e1c812f6adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 10:39:51 +0530
+Subject: ARM: dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 414bfe1d26b60ef20b58e36efd5363188a694bab ]
+
+ti,pindir-d0-out-d1-in property is expected to be of type boolean.
+Therefore, fix the property accordingly.
+
+Fixes: 444d66fafab8 ("ARM: dts: add spi wifi support to cm-t335")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-cm-t335.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/am335x-cm-t335.dts b/arch/arm/boot/dts/am335x-cm-t335.dts
+index 947c81b7aaaf..56a04d3086c3 100644
+--- a/arch/arm/boot/dts/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/am335x-cm-t335.dts
+@@ -552,7 +552,7 @@ status = "okay";
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&spi0_pins>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ /* WLS1271 WiFi */
+ wlcore: wlcore@1 {
+ compatible = "ti,wl1271";
+--
+2.30.2
+
--- /dev/null
+From da2f43a48cafbda2916a451cb910359060402671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 10:39:52 +0530
+Subject: ARM: dts: am437x: align ti,pindir-d0-out-d1-in property with dt-shema
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 9b11fec7345f21995f4ea4bafb0e108b9a620238 ]
+
+ti,pindir-d0-out-d1-in property is expected to be of type boolean.
+Therefore, fix the property accordingly.
+
+Fixes: b0b039515445 ("ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am43x-epos-evm.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index b6950eee550b..02bbdfb3f258 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -839,7 +839,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi0_pins_default>;
+ pinctrl-1 = <&spi0_pins_sleep>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ };
+
+ &spi1 {
+@@ -847,7 +847,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi1_pins_default>;
+ pinctrl-1 = <&spi1_pins_sleep>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ };
+
+ &usb2_phy1 {
+--
+2.30.2
+
--- /dev/null
+From 46fbf6ebb159c9d271241c6391115636ad92daf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 15:07:09 +0200
+Subject: ARM: dts: BCM5301X: Fixup SPI binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit d5aede3e6dd1b8ca574600a1ecafe1e580c53f2f ]
+
+1. Reorder interrupts
+2. Fix typo: s/spi_lr_overhead/spi_lr_overread/
+3. Rename node: s/spi-nor@0/flash@0/
+
+This fixes:
+arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dt.yaml: spi@18029200: interrupt-names: 'oneOf' conditional failed, one must be fixed:
+ ['spi_lr_fullness_reached', 'spi_lr_session_aborted', 'spi_lr_impatient', 'spi_lr_session_done', 'spi_lr_overhead', 'mspi_done', 'mspi_halted'] is too long
+ Additional items are not allowed ('spi_lr_session_aborted', 'spi_lr_impatient', 'spi_lr_session_done', 'spi_lr_overhead', 'mspi_done', 'mspi_halted' were unexpected)
+ 'mspi_done' was expected
+ 'spi_l1_intr' was expected
+ 'mspi_halted' was expected
+ 'spi_lr_fullness_reached' was expected
+ 'spi_lr_session_aborted' was expected
+ 'spi_lr_impatient' was expected
+ 'spi_lr_session_done' was expected
+ 'spi_lr_overread' was expected
+ From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml
+arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dt.yaml: spi-nor@0: $nodename:0: 'spi-nor@0' does not match '^flash(@.*)?$'
+ From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index c91716d5980c..fa3422c4caec 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -451,27 +451,27 @@
+ <0x1811b408 0x004>,
+ <0x180293a0 0x01c>;
+ reg-names = "mspi", "bspi", "intr_regs", "intr_status_reg";
+- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>,
++ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "spi_lr_fullness_reached",
++ <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "mspi_done",
++ "mspi_halted",
++ "spi_lr_fullness_reached",
+ "spi_lr_session_aborted",
+ "spi_lr_impatient",
+ "spi_lr_session_done",
+- "spi_lr_overhead",
+- "mspi_done",
+- "mspi_halted";
++ "spi_lr_overread";
+ clocks = <&iprocmed>;
+ clock-names = "iprocmed";
+ num-cs = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- spi_nor: spi-nor@0 {
++ spi_nor: flash@0 {
+ compatible = "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <20000000>;
+--
+2.30.2
+
--- /dev/null
+From bb374552505ea9134db0417dff2e40d2870fe009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 May 2021 09:59:39 -0400
+Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU/XU3
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 75121e1dc9fe4def41e63d57f6a53749b88006ed ]
+
+There is no "max_brightness" property. This brings the intentional
+brightness reduce of green LED and dtschema checks as well:
+
+ arch/arm/boot/dts/exynos5410-odroidxu.dt.yaml: led-controller-1: led-1: 'max-brightness' is a required property
+
+Fixes: 719f39fec586 ("ARM: dts: exynos5422-odroidxu3: Hook up PWM and use it for LEDs")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210505135941.59898-3-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
+index 56acd832f0b3..16e1087ec717 100644
+--- a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
++++ b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
+@@ -22,7 +22,7 @@
+ * Green LED is much brighter than the others
+ * so limit its max brightness
+ */
+- max_brightness = <127>;
++ max-brightness = <127>;
+ linux,default-trigger = "mmc0";
+ };
+
+@@ -30,7 +30,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 091035785181a149bf4c5f716eaf402b202b1ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 May 2021 09:59:40 -0400
+Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid HC1
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit a7e59c84cf2055a1894f45855c8319191f2fa59e ]
+
+There is no "max_brightness" property as pointed out by dtschema:
+
+ arch/arm/boot/dts/exynos5422-odroidhc1.dt.yaml: led-controller: led-1: 'max-brightness' is a required property
+
+Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210505135941.59898-4-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroidhc1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+index 8f332be143f7..abc6fb7d2725 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+@@ -22,7 +22,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 0f13034015dcc3ad340c04b9ebb1934d45dd1b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 May 2021 09:59:41 -0400
+Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit fd2f1717966535b7d0b6fe45cf0d79e94330da5f ]
+
+There is no "max_brightness" property as pointed out by dtschema:
+
+ arch/arm/boot/dts/exynos5422-odroidxu4.dt.yaml: led-controller: led-1: 'max-brightness' is a required property
+
+Fixes: 6658356014cb ("ARM: dts: Add support Odroid XU4 board for exynos5422-odroidxu4")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210505135941.59898-5-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroidxu4.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+index 122174ea9e0a..cb00513b9dd7 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+@@ -24,7 +24,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 30d6506fb0af9dbd4d11b4392b081cf648ae1e31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 May 2021 12:54:00 +0200
+Subject: ARM: dts: imx6q-dhcom: Add gpios pinctrl for i2c bus recovery
+
+From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+
+[ Upstream commit ddc873cd3c0af4faad6a00bffda21c3f775126dd ]
+
+The i2c bus can freeze at the end of transaction so the bus can no longer work.
+This scenario is improved by adding scl/sda gpios definitions to implement the
+i2c bus recovery mechanism.
+
+Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2")
+Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Marek Vasut <marex@denx.de>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Cc: kernel@dh-electronics.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 36 +++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index 6c08ef354a39..d5161c34a4b1 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -106,22 +106,31 @@
+
+ &i2c1 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c1>;
++ pinctrl-1 = <&pinctrl_i2c1_gpio>;
++ scl-gpios = <&gpio3 21 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio3 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+ };
+
+ &i2c2 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c2>;
++ pinctrl-1 = <&pinctrl_i2c2_gpio>;
++ scl-gpios = <&gpio4 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio4 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+ };
+
+ &i2c3 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c3>;
++ pinctrl-1 = <&pinctrl_i2c3_gpio>;
++ scl-gpios = <&gpio1 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+
+ ltc3676: pmic@3c {
+@@ -287,6 +296,13 @@
+ >;
+ };
+
++ pinctrl_i2c1_gpio: i2c1-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_EIM_D21__GPIO3_IO21 0x4001b8b1
++ MX6QDL_PAD_EIM_D28__GPIO3_IO28 0x4001b8b1
++ >;
++ };
++
+ pinctrl_i2c2: i2c2-grp {
+ fsl,pins = <
+ MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1
+@@ -294,6 +310,13 @@
+ >;
+ };
+
++ pinctrl_i2c2_gpio: i2c2-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_KEY_COL3__GPIO4_IO12 0x4001b8b1
++ MX6QDL_PAD_KEY_ROW3__GPIO4_IO13 0x4001b8b1
++ >;
++ };
++
+ pinctrl_i2c3: i2c3-grp {
+ fsl,pins = <
+ MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1
+@@ -301,6 +324,13 @@
+ >;
+ };
+
++ pinctrl_i2c3_gpio: i2c3-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_GPIO_3__GPIO1_IO03 0x4001b8b1
++ MX6QDL_PAD_GPIO_6__GPIO1_IO06 0x4001b8b1
++ >;
++ };
++
+ pinctrl_pmic_hw300: pmic-hw300-grp {
+ fsl,pins = <
+ MX6QDL_PAD_EIM_A25__GPIO5_IO02 0x1B0B0
+--
+2.30.2
+
--- /dev/null
+From 177227ca2e0b76638de05d0e874b3e24d64fe1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 May 2021 12:53:59 +0200
+Subject: ARM: dts: imx6q-dhcom: Fix ethernet plugin detection problems
+
+From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+
+[ Upstream commit e2bdd3484890441b9cc2560413a86e8f2aa04157 ]
+
+To make the ethernet cable plugin detection reliable the
+power detection of the smsc phy has been disabled.
+
+Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2")
+Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Marek Vasut <marex@denx.de>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Cc: kernel@dh-electronics.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index b158e530a796..6c08ef354a39 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -99,6 +99,7 @@
+ reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
+ reset-assert-us = <1000>;
+ reset-deassert-us = <1000>;
++ smsc,disable-energy-detect; /* Make plugin detection reliable */
+ };
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 085caf9c4dddf5680246750da87caabf1b291028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 May 2021 12:53:58 +0200
+Subject: ARM: dts: imx6q-dhcom: Fix ethernet reset time properties
+
+From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+
+[ Upstream commit c016c26c1631f539c652b5d82242a3ca402545c1 ]
+
+Fix ethernet reset time properties as described in
+Documentation/devicetree/bindings/net/ethernet-phy.yaml
+
+Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2")
+Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Marek Vasut <marex@denx.de>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Cc: kernel@dh-electronics.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index 8d4a4cd01e07..b158e530a796 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -97,8 +97,8 @@
+ reg = <0>;
+ max-speed = <100>;
+ reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
+- reset-delay-us = <1000>;
+- reset-post-delay-us = <1000>;
++ reset-assert-us = <1000>;
++ reset-deassert-us = <1000>;
+ };
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 2f46f8ac41fa5c472e2a61ccd2f793e64f97b897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 14:41:15 +0200
+Subject: ARM: dts: r8a7779, marzen: Fix DU clock names
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6ab8c23096a29b69044209a5925758a6f88bd450 ]
+
+"make dtbs_check" complains:
+
+ arch/arm/boot/dts/r8a7779-marzen.dt.yaml: display@fff80000: clock-names:0: 'du.0' was expected
+
+Change the first clock name to match the DT bindings.
+This has no effect on actual operation, as the Display Unit driver in
+Linux does not use the first clock name on R-Car H1, but just grabs the
+first clock.
+
+Fixes: 665d79aa47cb3983 ("ARM: shmobile: marzen: Add DU external pixel clock to DT")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/9d5e1b371121883b3b3e10a3df43802a29c6a9da.1619699965.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7779-marzen.dts | 2 +-
+ arch/arm/boot/dts/r8a7779.dtsi | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/r8a7779-marzen.dts b/arch/arm/boot/dts/r8a7779-marzen.dts
+index a4d0038363f0..84e30ed235b5 100644
+--- a/arch/arm/boot/dts/r8a7779-marzen.dts
++++ b/arch/arm/boot/dts/r8a7779-marzen.dts
+@@ -146,7 +146,7 @@
+ status = "okay";
+
+ clocks = <&mstp1_clks R8A7779_CLK_DU>, <&x3_clk>;
+- clock-names = "du", "dclkin.0";
++ clock-names = "du.0", "dclkin.0";
+
+ ports {
+ port@0 {
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index f1c9b2bc542c..c9695f31002a 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -437,6 +437,7 @@
+ reg = <0xfff80000 0x40000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp1_clks R8A7779_CLK_DU>;
++ clock-names = "du.0";
+ power-domains = <&sysc R8A7779_PD_ALWAYS_ON>;
+ status = "disabled";
+
+--
+2.30.2
+
--- /dev/null
+From 0fce088c411253c31186d8975f267a884a05e324 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 21:39:13 +0200
+Subject: arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit f890f89d9a80fffbfa7ca791b78927e5b8aba869 ]
+
+Reserve GPIO pins 85-88 as these aren't meant to be accessible from the
+application CPUs (causes reboot). Yet another fix similar to
+9134586715e3, 5f8d3ab136d0, which is needed to allow angler to boot after
+3edfb7bd76bd ("gpiolib: Show correct direction from the beginning").
+
+Fixes: feeaf56ac78d ("arm64: dts: msm8994 SoC and Huawei Angler (Nexus 6P) support")
+
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20210415193913.1836153-1-petr.vorel@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
+index dfa08f513dc4..e5850c4d3334 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
+@@ -38,3 +38,7 @@
+ };
+ };
+ };
++
++&tlmm {
++ gpio-reserved-ranges = <85 4>;
++};
+--
+2.30.2
+
--- /dev/null
+From 3509285005d6c387c74fb8c1917c26d09364f916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 13:10:50 +0100
+Subject: arm64: dts: renesas: v3msk: Fix memory size
+
+From: Valentine Barshak <valentine.barshak@cogentembedded.com>
+
+[ Upstream commit a422ec20caef6a50cf3c1efa93538888ebd576a6 ]
+
+The V3MSK board has 2 GiB RAM according to the datasheet and schematics.
+
+Signed-off-by: Valentine Barshak <valentine.barshak@cogentembedded.com>
+[geert: Verified schematics]
+Fixes: cc3e267e9bb0ce7f ("arm64: dts: renesas: initial V3MSK board device tree")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210326121050.1578460-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
+index 8eac8ca6550b..d8768c6bdfee 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
+@@ -24,7 +24,7 @@
+ memory@48000000 {
+ device_type = "memory";
+ /* first 128MB is reserved for secure area. */
+- reg = <0x0 0x48000000 0x0 0x38000000>;
++ reg = <0x0 0x48000000 0x0 0x78000000>;
+ };
+
+ osc5_clk: osc5-clock {
+--
+2.30.2
+
--- /dev/null
+From e47740dd4f0f59a1bf175d970f2b119622212ad1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 18:37:29 +0800
+Subject: ASoC: soc-core: Fix the error return code in
+ snd_soc_of_parse_audio_routing()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 7d3865a10b9ff2669c531d5ddd60bf46b3d48f1e ]
+
+When devm_kcalloc() fails, the error code -ENOMEM should be returned
+instead of -EINVAL.
+
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210617103729.1918-1-thunder.leizhen@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 595fe20bbc6d..8531b490f6f6 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3510,7 +3510,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
+ if (!routes) {
+ dev_err(card->dev,
+ "ASoC: Could not allocate DAPM route table\n");
+- return -EINVAL;
++ return -ENOMEM;
+ }
+
+ for (i = 0; i < num_routes; i++) {
+--
+2.30.2
+
--- /dev/null
+From 1a0fe8e9a08b94ccf4cb94b98520c90dbaa4c621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 14:21:47 +0200
+Subject: backlight: lm3630a: Fix return code of .update_status() callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit b9481a667a90ec739995e85f91f3672ca44d6ffa ]
+
+According to <linux/backlight.h> .update_status() is supposed to
+return 0 on success and a negative error code otherwise. Adapt
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status() to
+actually do it.
+
+While touching that also add the error code to the failure message.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index ef2553f452ca..f17e5a8860fa 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -184,7 +184,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) {
+ lm3630a_pwm_ctrl(pchip, bl->props.brightness,
+ bl->props.max_brightness);
+- return bl->props.brightness;
++ return 0;
+ }
+
+ /* disable sleep */
+@@ -204,8 +204,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ return 0;
+
+ out_i2c_err:
+- dev_err(pchip->dev, "i2c failed to access\n");
+- return bl->props.brightness;
++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+@@ -261,7 +261,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) {
+ lm3630a_pwm_ctrl(pchip, bl->props.brightness,
+ bl->props.max_brightness);
+- return bl->props.brightness;
++ return 0;
+ }
+
+ /* disable sleep */
+@@ -281,8 +281,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ return 0;
+
+ out_i2c_err:
+- dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+- return bl->props.brightness;
++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+--
+2.30.2
+
--- /dev/null
+From 10cba594d8b31826f0e0fc8dc9f969c8d4f228e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 May 2021 10:08:30 -0400
+Subject: ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 22d41cdcd3cfd467a4af074165357fcbea1c37f5 ]
+
+The checks for page->mapping are odd, as set_page_dirty is an
+address_space operation, and I don't see where it would be called on a
+non-pagecache page.
+
+The warning about the page lock also seems bogus. The comment over
+set_page_dirty() says that it can be called without the page lock in
+some rare cases. I don't think we want to warn if that's the case.
+
+Reported-by: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index e59b2f53a81f..de10899da837 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -75,10 +75,6 @@ static int ceph_set_page_dirty(struct page *page)
+ struct inode *inode;
+ struct ceph_inode_info *ci;
+ struct ceph_snap_context *snapc;
+- int ret;
+-
+- if (unlikely(!mapping))
+- return !TestSetPageDirty(page);
+
+ if (PageDirty(page)) {
+ dout("%p set_page_dirty %p idx %lu -- already dirty\n",
+@@ -124,11 +120,7 @@ static int ceph_set_page_dirty(struct page *page)
+ page->private = (unsigned long)snapc;
+ SetPagePrivate(page);
+
+- ret = __set_page_dirty_nobuffers(page);
+- WARN_ON(!PageLocked(page));
+- WARN_ON(!page->mapping);
+-
+- return ret;
++ return __set_page_dirty_nobuffers(page);
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From b32026164b1e505435a7c1afac905640050e0cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 09:57:54 +0800
+Subject: f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 0dd571785d61528d62cdd8aa49d76bc6085152fe ]
+
+As marcosfrm reported in bugzilla:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=213089
+
+Initramfs generators rely on "pre" softdeps (and "depends") to include
+additional required modules.
+
+F2FS does not declare "pre: crc32" softdep. Then every generator (dracut,
+mkinitcpio...) has to maintain a hardcoded list for this purpose.
+
+Hence let's use MODULE_SOFTDEP("pre: crc32") in f2fs code.
+
+Fixes: 43b6573bac95 ("f2fs: use cryptoapi crc32 functions")
+Reported-by: marcosfrm <marcosfrm@gmail.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 161ce0eb8891..89fc8a4ce149 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3373,4 +3373,5 @@ module_exit(exit_f2fs_fs)
+ MODULE_AUTHOR("Samsung Electronics's Praesto Team");
+ MODULE_DESCRIPTION("Flash Friendly File System");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: crc32");
+
+--
+2.30.2
+
--- /dev/null
+From 5fa555d5fae2098db27008eed512528acac24847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jun 2021 19:07:10 +0800
+Subject: fs/jfs: Fix missing error code in lmLogInit()
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit 492109333c29e1bb16d8732e1d597b02e8e0bf2e ]
+
+The error code is missing in this code scenario, add the error code
+'-EINVAL' to the return value 'rc.
+
+Eliminate the follow smatch warning:
+
+fs/jfs/jfs_logmgr.c:1327 lmLogInit() warn: missing error code 'rc'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 6b68df395892..356d1fcf7119 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -1338,6 +1338,7 @@ int lmLogInit(struct jfs_log * log)
+ } else {
+ if (memcmp(logsuper->uuid, log->uuid, 16)) {
+ jfs_warn("wrong uuid on JFS log device");
++ rc = -EINVAL;
+ goto errout20;
+ }
+ log->size = le32_to_cpu(logsuper->size);
+--
+2.30.2
+
--- /dev/null
+From c6e62419b09ec8607f0bf610f3c2e2c68602af13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Jun 2021 23:03:26 +0100
+Subject: gpio: pca953x: Add support for the On Semi pca9655
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 6d49b3a0f351925b5ea5047166c112b7590b918a ]
+
+The On Semi pca9655 is a 16 bit variant of the On Semi pca9654 GPIO
+expander, with 16 GPIOs and interrupt functionality.
+
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+[Bartosz: fixed indentation as noted by Andy]
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 0232c25a1586..dc4088a47ab2 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -980,6 +980,7 @@ static const struct of_device_id pca953x_dt_ids[] = {
+ { .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), },
+
+ { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
++ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), },
+
+ { .compatible = "exar,xra1202", .data = OF_953X( 8, 0), },
+ { }
+--
+2.30.2
+
--- /dev/null
+From a0aa934f38029e8473164567b2153e224a4c1d5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 19:38:05 +0530
+Subject: gpio: zynq: Check return value of pm_runtime_get_sync
+
+From: Srinivas Neeli <srinivas.neeli@xilinx.com>
+
+[ Upstream commit a51b2fb94b04ab71e53a71b9fad03fa826941254 ]
+
+Return value of "pm_runtime_get_sync" API was neither captured nor checked.
+Fixed it by capturing the return value and then checking for any warning.
+
+Addresses-Coverity: "check_return"
+Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-zynq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
+index 5dec96155814..c2279b28bcb9 100644
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -919,8 +919,11 @@ err_pm_dis:
+ static int zynq_gpio_remove(struct platform_device *pdev)
+ {
+ struct zynq_gpio *gpio = platform_get_drvdata(pdev);
++ int ret;
+
+- pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0)
++ dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n");
+ gpiochip_remove(&gpio->chip);
+ clk_disable_unprepare(gpio->clk);
+ device_set_wakeup_capable(&pdev->dev, 0);
+--
+2.30.2
+
--- /dev/null
+From 7436306155019ab251724fb0490dd8f96f350c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 18:07:41 -0700
+Subject: hexagon: use common DISCARDS macro
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 681ba73c72302214686401e707e2087ed11a6556 ]
+
+ld.lld warns that the '.modinfo' section is not currently handled:
+
+ld.lld: warning: kernel/built-in.a(workqueue.o):(.modinfo) is being placed in '.modinfo'
+ld.lld: warning: kernel/built-in.a(printk/printk.o):(.modinfo) is being placed in '.modinfo'
+ld.lld: warning: kernel/built-in.a(irq/spurious.o):(.modinfo) is being placed in '.modinfo'
+ld.lld: warning: kernel/built-in.a(rcu/update.o):(.modinfo) is being placed in '.modinfo'
+
+The '.modinfo' section was added in commit 898490c010b5 ("moduleparam:
+Save information about built-in modules in separate file") to the DISCARDS
+macro but Hexagon has never used that macro. The unification of DISCARDS
+happened in commit 023bf6f1b8bf ("linker script: unify usage of discard
+definition") in 2009, prior to Hexagon being added in 2011.
+
+Switch Hexagon over to the DISCARDS macro so that anything that is
+expected to be discarded gets discarded.
+
+Link: https://lkml.kernel.org/r/20210521011239.1332345-3-nathan@kernel.org
+Fixes: e95bf452a9e2 ("Hexagon: Add configuration and makefiles for the Hexagon architecture.")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Brian Cain <bcain@codeaurora.org>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Oliver Glitta <glittao@gmail.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/hexagon/kernel/vmlinux.lds.S | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S
+index ad69d181c939..757f9554118e 100644
+--- a/arch/hexagon/kernel/vmlinux.lds.S
++++ b/arch/hexagon/kernel/vmlinux.lds.S
+@@ -73,13 +73,8 @@ SECTIONS
+
+ _end = .;
+
+- /DISCARD/ : {
+- EXIT_TEXT
+- EXIT_DATA
+- EXIT_CALL
+- }
+-
+ STABS_DEBUG
+ DWARF_DEBUG
+
++ DISCARDS
+ }
+--
+2.30.2
+
--- /dev/null
+From 9620e95594413f1f53921075be426317dc3821c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jun 2021 16:27:44 -0700
+Subject: i2c: core: Disable client irq on reboot/shutdown
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit b64210f2f7c11c757432ba3701d88241b2b98fb1 ]
+
+If an i2c client receives an interrupt during reboot or shutdown it may
+be too late to service it by making an i2c transaction on the bus
+because the i2c controller has already been shutdown. This can lead to
+system hangs if the i2c controller tries to make a transfer that is
+doomed to fail because the access to the i2c pins is already shut down,
+or an iommu translation has been torn down so i2c controller register
+access doesn't work.
+
+Let's simply disable the irq if there isn't a shutdown callback for an
+i2c client when there is an irq associated with the device. This will
+make sure that irqs don't come in later than the time that we can handle
+it. We don't do this if the i2c client device already has a shutdown
+callback because presumably they're doing the right thing and quieting
+the device so irqs don't come in after the shutdown callback returns.
+
+Reported-by: kernel test robot <lkp@intel.com>
+[swboyd@chromium.org: Dropped newline, added commit text, added
+interrupt.h for robot build error]
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 39be53b6f983..2a43f4e46af0 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -32,6 +32,7 @@
+ #include <linux/i2c-smbus.h>
+ #include <linux/idr.h>
+ #include <linux/init.h>
++#include <linux/interrupt.h>
+ #include <linux/irqflags.h>
+ #include <linux/jump_label.h>
+ #include <linux/kernel.h>
+@@ -457,6 +458,8 @@ static void i2c_device_shutdown(struct device *dev)
+ driver = to_i2c_driver(dev->driver);
+ if (driver->shutdown)
+ driver->shutdown(client);
++ else if (client->irq > 0)
++ disable_irq(client->irq);
+ }
+
+ static void i2c_client_dev_release(struct device *dev)
+--
+2.30.2
+
--- /dev/null
+From 9bf9a1e04efad2d72a020bb35873f917d5a52991 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jun 2021 22:26:50 -0700
+Subject: Input: hideep - fix the uninitialized use in hideep_nvm_unlock()
+
+From: Yizhuo Zhai <yzhai003@ucr.edu>
+
+[ Upstream commit cac7100d4c51c04979dacdfe6c9a5e400d3f0a27 ]
+
+Inside function hideep_nvm_unlock(), variable "unmask_code" could
+be uninitialized if hideep_pgm_r_reg() returns error, however, it
+is used in the later if statement after an "and" operation, which
+is potentially unsafe.
+
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/hideep.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c
+index f1cd4dd9a4a3..d7775db0b711 100644
+--- a/drivers/input/touchscreen/hideep.c
++++ b/drivers/input/touchscreen/hideep.c
+@@ -364,13 +364,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts)
+ return -EIO;
+ }
+
+-static void hideep_nvm_unlock(struct hideep_ts *ts)
++static int hideep_nvm_unlock(struct hideep_ts *ts)
+ {
+ u32 unmask_code;
++ int error;
+
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE);
+- hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
++ error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
++ if (error)
++ return error;
+
+ /* make it unprotected code */
+ unmask_code &= ~HIDEEP_PROT_MODE;
+@@ -387,6 +390,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts)
+ NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask);
+ SET_FLASH_HWCONTROL();
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
++
++ return 0;
+ }
+
+ static int hideep_check_status(struct hideep_ts *ts)
+@@ -465,7 +470,9 @@ static int hideep_program_nvm(struct hideep_ts *ts,
+ u32 addr = 0;
+ int error;
+
+- hideep_nvm_unlock(ts);
++ error = hideep_nvm_unlock(ts);
++ if (error)
++ return error;
+
+ while (ucode_len > 0) {
+ xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE);
+--
+2.30.2
+
--- /dev/null
+From de8aa9829833c20e2d78f1c818ec10069e89f11f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 18:12:46 +0300
+Subject: intel_th: Wait until port is in reset before programming it
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit ab1afed701d2db7eb35c1a2526a29067a38e93d1 ]
+
+Some devices don't drain their pipelines if we don't make sure that
+the corresponding output port is in reset before programming it for
+a new trace capture, resulting in bits of old trace appearing in the
+new trace capture. Fix that by explicitly making sure the reset is
+asserted before programming new trace capture.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Link: https://lore.kernel.org/r/20210621151246.31891-5-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/intel_th/core.c | 17 +++++++++++++++++
+ drivers/hwtracing/intel_th/gth.c | 16 ++++++++++++++++
+ drivers/hwtracing/intel_th/intel_th.h | 3 +++
+ 3 files changed, 36 insertions(+)
+
+diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
+index 6c723b57dfc0..be2f02e35067 100644
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -215,6 +215,22 @@ static ssize_t port_show(struct device *dev, struct device_attribute *attr,
+
+ static DEVICE_ATTR_RO(port);
+
++static void intel_th_trace_prepare(struct intel_th_device *thdev)
++{
++ struct intel_th_device *hub = to_intel_th_hub(thdev);
++ struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver);
++
++ if (hub->type != INTEL_TH_SWITCH)
++ return;
++
++ if (thdev->type != INTEL_TH_OUTPUT)
++ return;
++
++ pm_runtime_get_sync(&thdev->dev);
++ hubdrv->prepare(hub, &thdev->output);
++ pm_runtime_put(&thdev->dev);
++}
++
+ static int intel_th_output_activate(struct intel_th_device *thdev)
+ {
+ struct intel_th_driver *thdrv =
+@@ -235,6 +251,7 @@ static int intel_th_output_activate(struct intel_th_device *thdev)
+ if (ret)
+ goto fail_put;
+
++ intel_th_trace_prepare(thdev);
+ if (thdrv->activate)
+ ret = thdrv->activate(thdev);
+ else
+diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
+index 5041fe7fee9e..ef2751556fd7 100644
+--- a/drivers/hwtracing/intel_th/gth.c
++++ b/drivers/hwtracing/intel_th/gth.c
+@@ -513,6 +513,21 @@ static void gth_tscu_resync(struct gth_device *gth)
+ iowrite32(reg, gth->base + REG_TSCU_TSUCTRL);
+ }
+
++static void intel_th_gth_prepare(struct intel_th_device *thdev,
++ struct intel_th_output *output)
++{
++ struct gth_device *gth = dev_get_drvdata(&thdev->dev);
++ int count;
++
++ /*
++ * Wait until the output port is in reset before we start
++ * programming it.
++ */
++ for (count = GTH_PLE_WAITLOOP_DEPTH;
++ count && !(gth_output_get(gth, output->port) & BIT(5)); count--)
++ cpu_relax();
++}
++
+ /**
+ * intel_th_gth_enable() - enable tracing to an output device
+ * @thdev: GTH device
+@@ -734,6 +749,7 @@ static struct intel_th_driver intel_th_gth_driver = {
+ .assign = intel_th_gth_assign,
+ .unassign = intel_th_gth_unassign,
+ .set_output = intel_th_gth_set_output,
++ .prepare = intel_th_gth_prepare,
+ .enable = intel_th_gth_enable,
+ .disable = intel_th_gth_disable,
+ .driver = {
+diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h
+index 780206dc9012..6b5473f3c16f 100644
+--- a/drivers/hwtracing/intel_th/intel_th.h
++++ b/drivers/hwtracing/intel_th/intel_th.h
+@@ -134,6 +134,7 @@ intel_th_output_assigned(struct intel_th_device *thdev)
+ * @remove: remove method
+ * @assign: match a given output type device against available outputs
+ * @unassign: deassociate an output type device from an output port
++ * @prepare: prepare output port for tracing
+ * @enable: enable tracing for a given output device
+ * @disable: disable tracing for a given output device
+ * @irq: interrupt callback
+@@ -155,6 +156,8 @@ struct intel_th_driver {
+ struct intel_th_device *othdev);
+ void (*unassign)(struct intel_th_device *thdev,
+ struct intel_th_device *othdev);
++ void (*prepare)(struct intel_th_device *thdev,
++ struct intel_th_output *output);
+ void (*enable)(struct intel_th_device *thdev,
+ struct intel_th_output *output);
+ void (*disable)(struct intel_th_device *thdev,
+--
+2.30.2
+
--- /dev/null
+From 946110979f168bb80b823e0bc04436ea934dab7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 18:56:16 -0700
+Subject: lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
+
+From: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+
+[ Upstream commit 2c484419efc09e7234c667aa72698cb79ba8d8ed ]
+
+lz4 compatible decompressor is simple. The format is underspecified and
+relies on EOF notification to determine when to stop. Initramfs buffer
+format[1] explicitly states that it can have arbitrary number of zero
+padding. Thus when operating without a fill function, be extra careful to
+ensure that sizes less than 4, or apperantly empty chunksizes are treated
+as EOF.
+
+To test this I have created two cpio initrds, first a normal one,
+main.cpio. And second one with just a single /test-file with content
+"second" second.cpio. Then i compressed both of them with gzip, and with
+lz4 -l. Then I created a padding of 4 bytes (dd if=/dev/zero of=pad4 bs=1
+count=4). To create four testcase initrds:
+
+ 1) main.cpio.gzip + extra.cpio.gzip = pad0.gzip
+ 2) main.cpio.lz4 + extra.cpio.lz4 = pad0.lz4
+ 3) main.cpio.gzip + pad4 + extra.cpio.gzip = pad4.gzip
+ 4) main.cpio.lz4 + pad4 + extra.cpio.lz4 = pad4.lz4
+
+The pad4 test-cases replicate the initrd load by grub, as it pads and
+aligns every initrd it loads.
+
+All of the above boot, however /test-file was not accessible in the initrd
+for the testcase #4, as decoding in lz4 decompressor failed. Also an
+error message printed which usually is harmless.
+
+Whith a patched kernel, all of the above testcases now pass, and
+/test-file is accessible.
+
+This fixes lz4 initrd decompress warning on every boot with grub. And
+more importantly this fixes inability to load multiple lz4 compressed
+initrds with grub. This patch has been shipping in Ubuntu kernels since
+January 2021.
+
+[1] ./Documentation/driver-api/early-userspace/buffer-format.rst
+
+BugLink: https://bugs.launchpad.net/bugs/1835660
+Link: https://lore.kernel.org/lkml/20210114200256.196589-1-xnox@ubuntu.com/ # v0
+Link: https://lkml.kernel.org/r/20210513104831.432975-1-dimitri.ledkov@canonical.com
+Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+Cc: Kyungsik Lee <kyungsik.lee@lge.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Bongkyu Kim <bongkyu.kim@lge.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Sven Schmidt <4sschmid@informatik.uni-hamburg.de>
+Cc: Rajat Asthana <thisisrast7@gmail.com>
+Cc: Nick Terrell <terrelln@fb.com>
+Cc: Gao Xiang <hsiangkao@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/decompress_unlz4.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
+index 1b0baf3008ea..b202aa864c48 100644
+--- a/lib/decompress_unlz4.c
++++ b/lib/decompress_unlz4.c
+@@ -115,6 +115,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ error("data corrupted");
+ goto exit_2;
+ }
++ } else if (size < 4) {
++ /* empty or end-of-file */
++ goto exit_3;
+ }
+
+ chunksize = get_unaligned_le32(inp);
+@@ -128,6 +131,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ continue;
+ }
+
++ if (!fill && chunksize == 0) {
++ /* empty or end-of-file */
++ goto exit_3;
++ }
+
+ if (posp)
+ *posp += 4;
+@@ -187,6 +194,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ }
+ }
+
++exit_3:
+ ret = 0;
+ exit_2:
+ if (!input)
+--
+2.30.2
+
--- /dev/null
+From 88e4629ac85657f1338c3f20d418f680085a1ea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 12:18:15 +0200
+Subject: memory: atmel-ebi: add missing of_node_put for loop iteration
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 907c5bbb514a4676160e79764522fff56ce3448e ]
+
+Early exits from for_each_available_child_of_node() should decrement the
+node reference counter. Reported by Coccinelle:
+
+ drivers/memory/atmel-ebi.c:593:1-33: WARNING:
+ Function "for_each_available_child_of_node" should have of_node_put() before return around line 604.
+
+Fixes: 6a4ec4cd0888 ("memory: add Atmel EBI (External Bus Interface) driver")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210423101815.119341-2-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/atmel-ebi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
+index b907865d4664..2b9283d4fcb1 100644
+--- a/drivers/memory/atmel-ebi.c
++++ b/drivers/memory/atmel-ebi.c
+@@ -579,8 +579,10 @@ static int atmel_ebi_probe(struct platform_device *pdev)
+ child);
+
+ ret = atmel_ebi_dev_disable(ebi, child);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ return ret;
++ }
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 2515e01e2f2b31a271f6fc0846a79cf5be9127a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 May 2021 11:43:21 -0400
+Subject: memory: fsl_ifc: fix leak of IO mapping on probe failure
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 3b132ab67fc7a358fff35e808fa65d4bea452521 ]
+
+On probe error the driver should unmap the IO memory. Smatch reports:
+
+ drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.
+
+Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210527154322.81253-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/fsl_ifc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
+index 1b182b117f9c..74bbbdc584f4 100644
+--- a/drivers/memory/fsl_ifc.c
++++ b/drivers/memory/fsl_ifc.c
+@@ -231,8 +231,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+ fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0);
+ if (!fsl_ifc_ctrl_dev->gregs) {
+ dev_err(&dev->dev, "failed to get memory region\n");
+- ret = -ENODEV;
+- goto err;
++ return -ENODEV;
+ }
+
+ if (of_property_read_bool(dev->dev.of_node, "little-endian")) {
+@@ -308,6 +307,7 @@ err_irq:
+ free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
+ irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
+ err:
++ iounmap(fsl_ifc_ctrl_dev->gregs);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0e5ed5d10a41b511dddaa81c8ebb7591e2665138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 May 2021 11:43:22 -0400
+Subject: memory: fsl_ifc: fix leak of private memory on probe failure
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 8e0d09b1232d0538066c40ed4c13086faccbdff6 ]
+
+On probe error the driver should free the memory allocated for private
+structure. Fix this by using resource-managed allocation.
+
+Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210527154322.81253-2-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/fsl_ifc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
+index 74bbbdc584f4..38b945eb410f 100644
+--- a/drivers/memory/fsl_ifc.c
++++ b/drivers/memory/fsl_ifc.c
+@@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev)
+ iounmap(ctrl->gregs);
+
+ dev_set_drvdata(&dev->dev, NULL);
+- kfree(ctrl);
+
+ return 0;
+ }
+@@ -221,7 +220,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+
+ dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
+
+- fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
++ fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
++ GFP_KERNEL);
+ if (!fsl_ifc_ctrl_dev)
+ return -ENOMEM;
+
+--
+2.30.2
+
--- /dev/null
+From cbbe994acd7e1c3df29cc2a027382b640df583b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 14:33:46 +0800
+Subject: mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit 4700ef326556ed74aba188f12396740a8c1c21dd ]
+
+This patch adds/modifies MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-i2c.c | 1 +
+ drivers/mfd/stmpe-i2c.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c
+index 578e881067a5..4094f97ec7dc 100644
+--- a/drivers/mfd/da9052-i2c.c
++++ b/drivers/mfd/da9052-i2c.c
+@@ -118,6 +118,7 @@ static const struct i2c_device_id da9052_i2c_id[] = {
+ {"da9053-bc", DA9053_BC},
+ {}
+ };
++MODULE_DEVICE_TABLE(i2c, da9052_i2c_id);
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id dialog_dt_ids[] = {
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index 863c39a3353c..d284df25c76b 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -109,7 +109,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = {
+ { "stmpe2403", STMPE2403 },
+ { }
+ };
+-MODULE_DEVICE_TABLE(i2c, stmpe_id);
++MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id);
+
+ static struct i2c_driver stmpe_i2c_driver = {
+ .driver = {
+--
+2.30.2
+
--- /dev/null
+From 84c189be3196d276f121c12c559e0c64a85a164a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 16:28:37 +0200
+Subject: mips: always link byteswap helpers into decompressor
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit cddc40f5617e53f97ef019d5b29c1bd6cbb031ec ]
+
+My series to clean up the unaligned access implementation
+across architectures caused some mips randconfig builds to
+fail with:
+
+ mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `decompress_kernel':
+ decompress.c:(.text.decompress_kernel+0x54): undefined reference to `__bswapsi2'
+
+It turns out that this problem has already been fixed for the XZ
+decompressor but now it also shows up in (at least) LZO and LZ4. From my
+analysis I concluded that the compiler could always have emitted those
+calls, but the different implementation allowed it to make otherwise
+better decisions about not inlining the byteswap, which results in the
+link error when the out-of-line code is missing.
+
+While it could be addressed by adding it to the two decompressor
+implementations that are known to be affected, but as this only adds
+112 bytes to the kernel, the safer choice is to always add them.
+
+Fixes: c50ec6787536 ("MIPS: zboot: Fix the build with XZ compression on older GCC versions")
+Fixes: 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers")
+Link: https://lore.kernel.org/linux-mm/202106301304.gz2wVY9w-lkp@intel.com/
+Link: https://lore.kernel.org/linux-mm/202106260659.TyMe8mjr-lkp@intel.com/
+Link: https://lore.kernel.org/linux-mm/202106172016.onWT6Tza-lkp@intel.com/
+Link: https://lore.kernel.org/linux-mm/202105231743.JJcALnhS-lkp@intel.com/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/compressed/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index 378cbfb31ee7..1d6ebbc2a5d0 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -33,7 +33,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \
+ KCOV_INSTRUMENT := n
+
+ # decompressor objects (linked with vmlinuz)
+-vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
++vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o $(obj)/bswapsi.o
+
+ ifdef CONFIG_DEBUG_ZBOOT
+ vmlinuzobjs-$(CONFIG_DEBUG_ZBOOT) += $(obj)/dbg.o
+@@ -47,7 +47,7 @@ extra-y += uart-ath79.c
+ $(obj)/uart-ath79.c: $(srctree)/arch/mips/ath79/early_printk.c
+ $(call cmd,shipped)
+
+-vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o $(obj)/bswapsi.o
++vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o
+
+ extra-y += ashldi3.c
+ $(obj)/ashldi3.c: $(obj)/%.c: $(srctree)/lib/%.c FORCE
+--
+2.30.2
+
--- /dev/null
+From feaea341b2d105bde7b4ff1c24b7e4be8248544d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 16:02:11 -0700
+Subject: mips: disable branch profiling in boot/decompress.o
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 97e488073cfca0eea84450169ca4cbfcc64e33e3 ]
+
+Use DISABLE_BRANCH_PROFILING for arch/mips/boot/compressed/decompress.o
+to prevent linkage errors.
+
+mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `LZ4_decompress_fast_extDict':
+decompress.c:(.text+0x8c): undefined reference to `ftrace_likely_update'
+mips64-linux-ld: decompress.c:(.text+0xf4): undefined reference to `ftrace_likely_update'
+mips64-linux-ld: decompress.c:(.text+0x200): undefined reference to `ftrace_likely_update'
+mips64-linux-ld: decompress.c:(.text+0x230): undefined reference to `ftrace_likely_update'
+mips64-linux-ld: decompress.c:(.text+0x320): undefined reference to `ftrace_likely_update'
+mips64-linux-ld: arch/mips/boot/compressed/decompress.o:decompress.c:(.text+0x3f4): more undefined references to `ftrace_likely_update' follow
+
+Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Kyungsik Lee <kyungsik.lee@lge.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/compressed/decompress.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 40218be0b7ce..6403a65f30b9 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -11,6 +11,8 @@
+ * option) any later version.
+ */
+
++#define DISABLE_BRANCH_PROFILING
++
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/string.h>
+--
+2.30.2
+
--- /dev/null
+From d85577700f94c73a437919a6b5cff07ce26529fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 02:03:54 +0200
+Subject: MIPS: vdso: Invalid GIC access through VDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Fäcknitz <faecknitz@hotsplots.de>
+
+[ Upstream commit 47ce8527fbba145a7723685bc9a27d9855e06491 ]
+
+Accessing raw timers (currently only CLOCK_MONOTONIC_RAW) through VDSO
+doesn't return the correct time when using the GIC as clock source.
+The address of the GIC mapped page is in this case not calculated
+correctly. The GIC mapped page is calculated from the VDSO data by
+subtracting PAGE_SIZE:
+
+ void *get_gic(const struct vdso_data *data) {
+ return (void __iomem *)data - PAGE_SIZE;
+ }
+
+However, the data pointer is not page aligned for raw clock sources.
+This is because the VDSO data for raw clock sources (CS_RAW = 1) is
+stored after the VDSO data for coarse clock sources (CS_HRES_COARSE = 0).
+Therefore, only the VDSO data for CS_HRES_COARSE is page aligned:
+
+ +--------------------+
+ | |
+ | vd[CS_RAW] | ---+
+ | vd[CS_HRES_COARSE] | |
+ +--------------------+ | -PAGE_SIZE
+ | | |
+ | GIC mapped page | <--+
+ | |
+ +--------------------+
+
+When __arch_get_hw_counter() is called with &vd[CS_RAW], get_gic returns
+the wrong address (somewhere inside the GIC mapped page). The GIC counter
+values are not returned which results in an invalid time.
+
+Fixes: a7f4df4e21dd ("MIPS: VDSO: Add implementations of gettimeofday() and clock_gettime()")
+Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/vdso/vdso.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/vdso/vdso.h b/arch/mips/vdso/vdso.h
+index cfb1be441dec..921589b45bc2 100644
+--- a/arch/mips/vdso/vdso.h
++++ b/arch/mips/vdso/vdso.h
+@@ -81,7 +81,7 @@ static inline const union mips_vdso_data *get_vdso_data(void)
+
+ static inline void __iomem *get_gic(const union mips_vdso_data *data)
+ {
+- return (void __iomem *)data - PAGE_SIZE;
++ return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE;
+ }
+
+ #endif /* CONFIG_CLKSRC_MIPS_GIC */
+--
+2.30.2
+
--- /dev/null
+From ca1bdaa86f82d0be6932055030a698a732db37b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 10:06:20 -0700
+Subject: misc/libmasm/module: Fix two use after free in ibmasm_init_one
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ]
+
+In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
+Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
+allocated by input_allocate_device(), and assigned to
+sp->remote.mouse_dev and sp->remote.keybd_dev respectively.
+
+In the err_free_devices error branch of ibmasm_init_one,
+mouse_dev and keybd_dev are freed by input_free_device(), and return
+error. Then the execution runs into error_send_message error branch
+of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
+to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.
+
+My patch add a "error_init_remote" label to handle the error of
+ibmasm_init_remote_input_dev(), to avoid the uaf bugs.
+
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/ibmasm/module.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
+index e914b8c80943..9f8344169845 100644
+--- a/drivers/misc/ibmasm/module.c
++++ b/drivers/misc/ibmasm/module.c
+@@ -125,7 +125,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ result = ibmasm_init_remote_input_dev(sp);
+ if (result) {
+ dev_err(sp->dev, "Failed to initialize remote queue\n");
+- goto error_send_message;
++ goto error_init_remote;
+ }
+
+ result = ibmasm_send_driver_vpd(sp);
+@@ -145,8 +145,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+
+ error_send_message:
+- disable_sp_interrupts(sp->base_address);
+ ibmasm_free_remote_input_dev(sp);
++error_init_remote:
++ disable_sp_interrupts(sp->base_address);
+ free_irq(sp->irq, (void *)sp);
+ error_request_irq:
+ iounmap(sp->base_address);
+--
+2.30.2
+
--- /dev/null
+From 18a402fd5e1dcb33b45764814795287361544542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 12:20:55 +0800
+Subject: nfs: fix acl memory leak of posix_acl_create()
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 1fcb6fcd74a222d9ead54d405842fc763bb86262 ]
+
+When looking into another nfs xfstests report, I found acl and
+default_acl in nfs3_proc_create() and nfs3_proc_mknod() error
+paths are possibly leaked. Fix them in advance.
+
+Fixes: 013cdf1088d7 ("nfs: use generic posix ACL infrastructure for v3 Posix ACLs")
+Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
+Cc: Anna Schumaker <anna.schumaker@netapp.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs3proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
+index ec8a9efa268f..e302f8370b9b 100644
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -346,7 +346,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
+ break;
+
+ case NFS3_CREATE_UNCHECKED:
+- goto out;
++ goto out_release_acls;
+ }
+ nfs_fattr_init(data->res.dir_attr);
+ nfs_fattr_init(data->res.fattr);
+@@ -695,7 +695,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
+ break;
+ default:
+ status = -EINVAL;
+- goto out;
++ goto out_release_acls;
+ }
+
+ status = nfs3_do_create(dir, dentry, data);
+--
+2.30.2
+
--- /dev/null
+From 9311ba180fc9162c261d67524ee4431eb4de9e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 23:41:10 -0400
+Subject: NFS: nfs_find_open_context() may only select open files
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit e97bc66377bca097e1f3349ca18ca17f202ff659 ]
+
+If a file has already been closed, then it should not be selected to
+support further I/O.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+[Trond: Fix an invalid pointer deref reported by Colin Ian King]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/inode.c | 4 ++++
+ include/linux/nfs_fs.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index dc55ecc3bec4..2cdd8883b7c5 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1038,6 +1038,7 @@ EXPORT_SYMBOL_GPL(nfs_inode_attach_open_context);
+ void nfs_file_set_open_context(struct file *filp, struct nfs_open_context *ctx)
+ {
+ filp->private_data = get_nfs_open_context(ctx);
++ set_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags);
+ if (list_empty(&ctx->list))
+ nfs_inode_attach_open_context(ctx);
+ }
+@@ -1057,6 +1058,8 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
+ continue;
+ if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
+ continue;
++ if (!test_bit(NFS_CONTEXT_FILE_OPEN, &pos->flags))
++ continue;
+ ctx = get_nfs_open_context(pos);
+ break;
+ }
+@@ -1071,6 +1074,7 @@ void nfs_file_clear_open_context(struct file *filp)
+ if (ctx) {
+ struct inode *inode = d_inode(ctx->dentry);
+
++ clear_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags);
+ /*
+ * We fatal error on write before. Try to writeback
+ * every page again.
+diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
+index a0831e9d19c9..0ff7dd2bf8a4 100644
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -78,6 +78,7 @@ struct nfs_open_context {
+ #define NFS_CONTEXT_RESEND_WRITES (1)
+ #define NFS_CONTEXT_BAD (2)
+ #define NFS_CONTEXT_UNLOCK (3)
++#define NFS_CONTEXT_FILE_OPEN (4)
+ int error;
+
+ struct list_head list;
+--
+2.30.2
+
--- /dev/null
+From 6b955b1405d1c92b741b927482465253f92cd8c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jun 2021 10:04:46 -0400
+Subject: NFSv4: Initialise connection to the server in nfs4_alloc_client()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit dd99e9f98fbf423ff6d365b37a98e8879170f17c ]
+
+Set up the connection to the NFSv4 server in nfs4_alloc_client(), before
+we've added the struct nfs_client to the net-namespace's nfs_client_list
+so that a downed server won't cause other mounts to hang in the trunking
+detection code.
+
+Reported-by: Michael Wakabayashi <mwakabayashi@vmware.com>
+Fixes: 5c6e5b60aae4 ("NFS: Fix an Oops in the pNFS files and flexfiles connection setup to the DS")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 82 +++++++++++++++++++++++----------------------
+ 1 file changed, 42 insertions(+), 40 deletions(-)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index b5ce70c4ec87..43659326b519 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -191,8 +191,11 @@ void nfs40_shutdown_client(struct nfs_client *clp)
+
+ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ {
+- int err;
++ char buf[INET6_ADDRSTRLEN + 1];
++ const char *ip_addr = cl_init->ip_addr;
+ struct nfs_client *clp = nfs_alloc_client(cl_init);
++ int err;
++
+ if (IS_ERR(clp))
+ return clp;
+
+@@ -216,6 +219,44 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+ INIT_LIST_HEAD(&clp->pending_cb_stateids);
++
++ if (cl_init->minorversion != 0)
++ __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
++ __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
++ __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
++
++ /*
++ * Set up the connection to the server before we add add to the
++ * global list.
++ */
++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
++ if (err == -EINVAL)
++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
++ if (err < 0)
++ goto error;
++
++ /* If no clientaddr= option was specified, find a usable cb address */
++ if (ip_addr == NULL) {
++ struct sockaddr_storage cb_addr;
++ struct sockaddr *sap = (struct sockaddr *)&cb_addr;
++
++ err = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
++ if (err < 0)
++ goto error;
++ err = rpc_ntop(sap, buf, sizeof(buf));
++ if (err < 0)
++ goto error;
++ ip_addr = (const char *)buf;
++ }
++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
++
++ err = nfs_idmap_new(clp);
++ if (err < 0) {
++ dprintk("%s: failed to create idmapper. Error = %d\n",
++ __func__, err);
++ goto error;
++ }
++ __set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+ return clp;
+
+ error:
+@@ -368,8 +409,6 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp)
+ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ const struct nfs_client_initdata *cl_init)
+ {
+- char buf[INET6_ADDRSTRLEN + 1];
+- const char *ip_addr = cl_init->ip_addr;
+ struct nfs_client *old;
+ int error;
+
+@@ -377,43 +416,6 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ /* the client is initialised already */
+ return clp;
+
+- /* Check NFS protocol revision and initialize RPC op vector */
+- clp->rpc_ops = &nfs_v4_clientops;
+-
+- if (clp->cl_minorversion != 0)
+- __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
+- __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
+- __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
+-
+- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
+- if (error == -EINVAL)
+- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
+- if (error < 0)
+- goto error;
+-
+- /* If no clientaddr= option was specified, find a usable cb address */
+- if (ip_addr == NULL) {
+- struct sockaddr_storage cb_addr;
+- struct sockaddr *sap = (struct sockaddr *)&cb_addr;
+-
+- error = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
+- if (error < 0)
+- goto error;
+- error = rpc_ntop(sap, buf, sizeof(buf));
+- if (error < 0)
+- goto error;
+- ip_addr = (const char *)buf;
+- }
+- strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+-
+- error = nfs_idmap_new(clp);
+- if (error < 0) {
+- dprintk("%s: failed to create idmapper. Error = %d\n",
+- __func__, error);
+- goto error;
+- }
+- __set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+-
+ error = nfs4_init_client_minor_version(clp);
+ if (error < 0)
+ goto error;
+--
+2.30.2
+
--- /dev/null
+From fbb4d9d8561fe96af94def2437ca95918c424fea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jul 2021 14:34:20 -0400
+Subject: NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit f46f84931a0aa344678efe412d4b071d84d8a805 ]
+
+After we grab the lock in nfs4_pnfs_ds_connect(), there is no check for
+whether or not ds->ds_clp has already been initialised, so we can end up
+adding the same transports multiple times.
+
+Fixes: fc821d59209d ("pnfs/NFSv4.1: Add multipath capabilities to pNFS flexfiles servers over NFSv3")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs_nfs.c | 52 +++++++++++++++++++++++------------------------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index acfb52bc0007..3f0c2436254a 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -555,19 +555,16 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_add);
+
+-static void nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds)
++static int nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds)
+ {
+ might_sleep();
+- wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING,
+- TASK_KILLABLE);
++ return wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, TASK_KILLABLE);
+ }
+
+ static void nfs4_clear_ds_conn_bit(struct nfs4_pnfs_ds *ds)
+ {
+ smp_mb__before_atomic();
+- clear_bit(NFS4DS_CONNECTING, &ds->ds_state);
+- smp_mb__after_atomic();
+- wake_up_bit(&ds->ds_state, NFS4DS_CONNECTING);
++ clear_and_wake_up_bit(NFS4DS_CONNECTING, &ds->ds_state);
+ }
+
+ static struct nfs_client *(*get_v3_ds_connect)(
+@@ -728,30 +725,33 @@ int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+ {
+ int err;
+
+-again:
+- err = 0;
+- if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
+- if (version == 3) {
+- err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo,
+- retrans);
+- } else if (version == 4) {
+- err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo,
+- retrans, minor_version);
+- } else {
+- dprintk("%s: unsupported DS version %d\n", __func__,
+- version);
+- err = -EPROTONOSUPPORT;
+- }
++ do {
++ err = nfs4_wait_ds_connect(ds);
++ if (err || ds->ds_clp)
++ goto out;
++ if (nfs4_test_deviceid_unavailable(devid))
++ return -ENODEV;
++ } while (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) != 0);
+
+- nfs4_clear_ds_conn_bit(ds);
+- } else {
+- nfs4_wait_ds_connect(ds);
++ if (ds->ds_clp)
++ goto connect_done;
+
+- /* what was waited on didn't connect AND didn't mark unavail */
+- if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid))
+- goto again;
++ switch (version) {
++ case 3:
++ err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, retrans);
++ break;
++ case 4:
++ err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, retrans,
++ minor_version);
++ break;
++ default:
++ dprintk("%s: unsupported DS version %d\n", __func__, version);
++ err = -EPROTONOSUPPORT;
+ }
+
++connect_done:
++ nfs4_clear_ds_conn_bit(ds);
++out:
+ /*
+ * At this point the ds->ds_clp should be ready, but it might have
+ * hit an error.
+--
+2.30.2
+
--- /dev/null
+From a5b73cf5b4d4a713f00328ea9d0cb351645afed5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 08:09:13 -0400
+Subject: orangefs: fix orangefs df output.
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 0fdec1b3c9fbb5e856a40db5993c9eaf91c74a83 ]
+
+Orangefs df output is whacky. Walt Ligon suggested this might fix it.
+It seems way more in line with reality now...
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
+index dfaee90d30bd..524fd95173b3 100644
+--- a/fs/orangefs/super.c
++++ b/fs/orangefs/super.c
+@@ -195,7 +195,7 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ buf->f_bavail = (sector_t) new_op->downcall.resp.statfs.blocks_avail;
+ buf->f_files = (sector_t) new_op->downcall.resp.statfs.files_total;
+ buf->f_ffree = (sector_t) new_op->downcall.resp.statfs.files_avail;
+- buf->f_frsize = sb->s_blocksize;
++ buf->f_frsize = 0;
+
+ out_op_release:
+ op_release(new_op);
+--
+2.30.2
+
--- /dev/null
+From d7911d1c1d0dbda23d38e113f50c5fdf90aa7679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 17:26:29 +0200
+Subject: PCI: iproc: Fix multi-MSI base vector number allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sandor Bodo-Merle <sbodomerle@gmail.com>
+
+[ Upstream commit e673d697b9a234fc3544ac240e173cef8c82b349 ]
+
+Commit fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs")
+introduced multi-MSI support with a broken allocation mechanism (it failed
+to reserve the proper number of bits from the inner domain). Natural
+alignment of the base vector number was also not guaranteed.
+
+Link: https://lore.kernel.org/r/20210622152630.40842-1-sbodomerle@gmail.com
+Fixes: fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs")
+Reported-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Sandor Bodo-Merle <sbodomerle@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc-msi.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c
+index dc953c73cb56..b43ae4c06f30 100644
+--- a/drivers/pci/controller/pcie-iproc-msi.c
++++ b/drivers/pci/controller/pcie-iproc-msi.c
+@@ -252,18 +252,18 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain,
+
+ mutex_lock(&msi->bitmap_lock);
+
+- /* Allocate 'nr_cpus' number of MSI vectors each time */
+- hwirq = bitmap_find_next_zero_area(msi->bitmap, msi->nr_msi_vecs, 0,
+- msi->nr_cpus, 0);
+- if (hwirq < msi->nr_msi_vecs) {
+- bitmap_set(msi->bitmap, hwirq, msi->nr_cpus);
+- } else {
+- mutex_unlock(&msi->bitmap_lock);
+- return -ENOSPC;
+- }
++ /*
++ * Allocate 'nr_irqs' multiplied by 'nr_cpus' number of MSI vectors
++ * each time
++ */
++ hwirq = bitmap_find_free_region(msi->bitmap, msi->nr_msi_vecs,
++ order_base_2(msi->nr_cpus * nr_irqs));
+
+ mutex_unlock(&msi->bitmap_lock);
+
++ if (hwirq < 0)
++ return -ENOSPC;
++
+ for (i = 0; i < nr_irqs; i++) {
+ irq_domain_set_info(domain, virq + i, hwirq + i,
+ &iproc_msi_bottom_irq_chip,
+@@ -284,7 +284,8 @@ static void iproc_msi_irq_domain_free(struct irq_domain *domain,
+ mutex_lock(&msi->bitmap_lock);
+
+ hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq);
+- bitmap_clear(msi->bitmap, hwirq, msi->nr_cpus);
++ bitmap_release_region(msi->bitmap, hwirq,
++ order_base_2(msi->nr_cpus * nr_irqs));
+
+ mutex_unlock(&msi->bitmap_lock);
+
+--
+2.30.2
+
--- /dev/null
+From e1e04447cdc589c109416c0e827bff063fafe94a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 17:26:30 +0200
+Subject: PCI: iproc: Support multi-MSI only on uniprocessor kernel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sandor Bodo-Merle <sbodomerle@gmail.com>
+
+[ Upstream commit 2dc0a201d0f59e6818ef443609f0850a32910844 ]
+
+The interrupt affinity scheme used by this driver is incompatible with
+multi-MSI as it implies moving the doorbell address to that of another MSI
+group. This isn't possible for multi-MSI, as all the MSIs must have the
+same doorbell address. As such it is restricted to systems with a single
+CPU.
+
+Link: https://lore.kernel.org/r/20210622152630.40842-2-sbodomerle@gmail.com
+Fixes: fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs")
+Reported-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sandor Bodo-Merle <sbodomerle@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc-msi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c
+index b43ae4c06f30..dc4d5a590795 100644
+--- a/drivers/pci/controller/pcie-iproc-msi.c
++++ b/drivers/pci/controller/pcie-iproc-msi.c
+@@ -171,7 +171,7 @@ static struct irq_chip iproc_msi_irq_chip = {
+
+ static struct msi_domain_info iproc_msi_domain_info = {
+ .flags = MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+- MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX,
++ MSI_FLAG_PCI_MSIX,
+ .chip = &iproc_msi_irq_chip,
+ };
+
+@@ -250,6 +250,9 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain,
+ struct iproc_msi *msi = domain->host_data;
+ int hwirq, i;
+
++ if (msi->nr_cpus > 1 && nr_irqs > 1)
++ return -EINVAL;
++
+ mutex_lock(&msi->bitmap_lock);
+
+ /*
+@@ -539,6 +542,9 @@ int iproc_msi_init(struct iproc_pcie *pcie, struct device_node *node)
+ mutex_init(&msi->bitmap_lock);
+ msi->nr_cpus = num_possible_cpus();
+
++ if (msi->nr_cpus == 1)
++ iproc_msi_domain_info.flags |= MSI_FLAG_MULTI_PCI_MSI;
++
+ msi->nr_irqs = of_irq_count(node);
+ if (!msi->nr_irqs) {
+ dev_err(pcie->dev, "found no MSI GIC interrupt\n");
+--
+2.30.2
+
--- /dev/null
+From e00f735b9a373675a33e3af40db2b8228fdedaf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jun 2021 00:01:12 +0000
+Subject: PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczyński <kw@linux.com>
+
+[ Upstream commit bdcdaa13ad96f1a530711c29e6d4b8311eff767c ]
+
+"utf16s_to_utf8s(..., buf, PAGE_SIZE)" puts up to PAGE_SIZE bytes into
+"buf" and returns the number of bytes it actually put there. If it wrote
+PAGE_SIZE bytes, the newline added by dsm_label_utf16s_to_utf8s() would
+overrun "buf".
+
+Reduce the size available for utf16s_to_utf8s() to use so there is always
+space for the newline.
+
+[bhelgaas: reorder patch in series, commit log]
+Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
+Link: https://lore.kernel.org/r/20210603000112.703037-7-kw@linux.com
+Reported-by: Joe Perches <joe@perches.com>
+Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-label.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
+index a5910f942857..9fb4ef568f40 100644
+--- a/drivers/pci/pci-label.c
++++ b/drivers/pci/pci-label.c
+@@ -162,7 +162,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
+ len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
+ obj->buffer.length,
+ UTF16_LITTLE_ENDIAN,
+- buf, PAGE_SIZE);
++ buf, PAGE_SIZE - 1);
+ buf[len] = '\n';
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c404797f6ea53d1c0769b4cf383b412ab024f3a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 12:07:02 +0800
+Subject: PCI: tegra: Add missing MODULE_DEVICE_TABLE
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit 7bf475a4614a9722b9b989e53184a02596cf16d1 ]
+
+Add missing MODULE_DEVICE_TABLE definition so we generate correct modalias
+for automatic loading of this driver when it is built as a module.
+
+Link: https://lore.kernel.org/r/1620792422-16535-1-git-send-email-zou_wei@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Vidya Sagar <vidyas@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 097c02197ec8..1f8dd5ca02a9 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -2245,6 +2245,7 @@ static const struct of_device_id tegra_pcie_of_match[] = {
+ { .compatible = "nvidia,tegra20-pcie", .data = &tegra20_pcie },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, tegra_pcie_of_match);
+
+ static void *tegra_pcie_ports_seq_start(struct seq_file *s, loff_t *pos)
+ {
+--
+2.30.2
+
--- /dev/null
+From 2cb07609c8da3a223f308779ebad3072d825dce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 21:30:58 -0700
+Subject: perf report: Fix --task and --stat with pipe input
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 892ba7f18621a02af4428c58d97451f64685dba4 ]
+
+Current 'perf report' fails to process a pipe input when --task or
+--stat options are used. This is because they reset all the tool
+callbacks and fails to find a matching event for a sample.
+
+When pipe input is used, the event info is passed via ATTR records so it
+needs to handle that operation. Otherwise the following error occurs.
+Note, -14 (= -EFAULT) comes from evlist__parse_sample():
+
+ # perf record -a -o- sleep 1 | perf report -i- --stat
+ Can't parse sample, err = -14
+ 0x271044 [0x38]: failed to process type: 9
+ Error:
+ failed to process sample
+ #
+
+Committer testing:
+
+Before:
+
+ $ perf record -o- sleep 1 | perf report -i- --stat
+ Can't parse sample, err = -14
+ [ perf record: Woken up 1 times to write data ]
+ 0x1350 [0x30]: failed to process type: 9
+ Error:
+ failed to process sample
+ [ perf record: Captured and wrote 0.000 MB - ]
+ $
+
+After:
+
+ $ perf record -o- sleep 1 | perf report -i- --stat
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.000 MB - ]
+
+ Aggregated stats:
+ TOTAL events: 41
+ COMM events: 2 ( 4.9%)
+ EXIT events: 1 ( 2.4%)
+ SAMPLE events: 9 (22.0%)
+ MMAP2 events: 4 ( 9.8%)
+ ATTR events: 1 ( 2.4%)
+ FINISHED_ROUND events: 1 ( 2.4%)
+ THREAD_MAP events: 1 ( 2.4%)
+ CPU_MAP events: 1 ( 2.4%)
+ EVENT_UPDATE events: 1 ( 2.4%)
+ TIME_CONV events: 1 ( 2.4%)
+ FEATURE events: 19 (46.3%)
+ cycles:uhH stats:
+ SAMPLE events: 9
+ $
+
+Fixes: a4a4d0a7a2b20f78 ("perf report: Add --stats option to display quick data statistics")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210630043058.1131295-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-report.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 05eae94d09cb..dea7ed3fb0a4 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -634,9 +634,14 @@ static void report__output_resort(struct report *rep)
+ ui_progress__finish();
+ }
+
++static int process_attr(struct perf_tool *tool __maybe_unused,
++ union perf_event *event,
++ struct evlist **pevlist);
++
+ static void stats_setup(struct report *rep)
+ {
+ memset(&rep->tool, 0, sizeof(rep->tool));
++ rep->tool.attr = process_attr;
+ rep->tool.no_warn = true;
+ }
+
+@@ -656,6 +661,7 @@ static void tasks_setup(struct report *rep)
+ rep->tool.mmap = perf_event__process_mmap;
+ rep->tool.mmap2 = perf_event__process_mmap2;
+ }
++ rep->tool.attr = process_attr;
+ rep->tool.comm = perf_event__process_comm;
+ rep->tool.exit = perf_event__process_exit;
+ rep->tool.fork = perf_event__process_fork;
+--
+2.30.2
+
--- /dev/null
+From efae0e89b83c93387d48e078f5acb5cf2cf1fda2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 11:14:59 +0800
+Subject: power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE
+
+From: Bixuan Cui <cuibixuan@huawei.com>
+
+[ Upstream commit ed3443fb4df4e140a22f65144546c8a8e1e27f4e ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/gpio-poweroff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
+index 38206c39b3bf..5f2fa9c0f526 100644
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -88,6 +88,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = {
+ { .compatible = "gpio-poweroff", },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match);
+
+ static struct platform_driver gpio_poweroff_driver = {
+ .probe = gpio_poweroff_probe,
+--
+2.30.2
+
--- /dev/null
+From e1ed4bb801df902ec070e8d89a7d762888fc804e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jun 2021 09:21:41 +0800
+Subject: power: supply: ab8500: add missing MODULE_DEVICE_TABLE
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit dfe52db13ab8d24857a9840ec7ca75eef800c26c ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_btemp.c | 1 +
+ drivers/power/supply/ab8500_charger.c | 1 +
+ drivers/power/supply/ab8500_fg.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c
+index 708fd58cd62b..0fd24577112e 100644
+--- a/drivers/power/supply/ab8500_btemp.c
++++ b/drivers/power/supply/ab8500_btemp.c
+@@ -1120,6 +1120,7 @@ static const struct of_device_id ab8500_btemp_match[] = {
+ { .compatible = "stericsson,ab8500-btemp", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_btemp_match);
+
+ static struct platform_driver ab8500_btemp_driver = {
+ .probe = ab8500_btemp_probe,
+diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c
+index 76b6c60cde80..0f379fa3385e 100644
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -3639,6 +3639,7 @@ static const struct of_device_id ab8500_charger_match[] = {
+ { .compatible = "stericsson,ab8500-charger", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_charger_match);
+
+ static struct platform_driver ab8500_charger_driver = {
+ .probe = ab8500_charger_probe,
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 8bb89c697c1e..b0e77324b016 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -3221,6 +3221,7 @@ static const struct of_device_id ab8500_fg_match[] = {
+ { .compatible = "stericsson,ab8500-fg", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_fg_match);
+
+ static struct platform_driver ab8500_fg_driver = {
+ .probe = ab8500_fg_probe,
+--
+2.30.2
+
--- /dev/null
+From 743299683cde803728011998cc2e0dad9a8fb634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 May 2021 00:50:41 +0200
+Subject: power: supply: ab8500: Avoid NULL pointers
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 5bcb5087c9dd3dca1ff0ebd8002c5313c9332b56 ]
+
+Sometimes the code will crash because we haven't enabled
+AC or USB charging and thus not created the corresponding
+psy device. Fix it by checking that it is there before
+notifying.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_charger.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c
+index 98b335042ba6..76b6c60cde80 100644
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -407,6 +407,14 @@ disable_otp:
+ static void ab8500_power_supply_changed(struct ab8500_charger *di,
+ struct power_supply *psy)
+ {
++ /*
++ * This happens if we get notifications or interrupts and
++ * the platform has been configured not to support one or
++ * other type of charging.
++ */
++ if (!psy)
++ return;
++
+ if (di->autopower_cfg) {
+ if (!di->usb.charger_connected &&
+ !di->ac.charger_connected &&
+@@ -433,7 +441,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di,
+ if (!connected)
+ di->flags.vbus_drop_end = false;
+
+- sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present");
++ /*
++ * Sometimes the platform is configured not to support
++ * USB charging and no psy has been created, but we still
++ * will get these notifications.
++ */
++ if (di->usb_chg.psy) {
++ sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL,
++ "present");
++ }
+
+ if (connected) {
+ mutex_lock(&di->charger_attached_mutex);
+--
+2.30.2
+
--- /dev/null
+From d8a361f686a6f356425c12ef0dd6ed1f2e7b6cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jun 2021 09:21:54 +0800
+Subject: power: supply: charger-manager: add missing MODULE_DEVICE_TABLE
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit 073b5d5b1f9cc94a3eea25279fbafee3f4f5f097 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/charger-manager.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
+index 7ae983e37f64..eec79db9b750 100644
+--- a/drivers/power/supply/charger-manager.c
++++ b/drivers/power/supply/charger-manager.c
+@@ -1484,6 +1484,7 @@ static const struct of_device_id charger_manager_match[] = {
+ },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, charger_manager_match);
+
+ static struct charger_desc *of_cm_parse_desc(struct device *dev)
+ {
+--
+2.30.2
+
--- /dev/null
+From 3ed42b0659c7c1e37596667e6c23b1e775160ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 May 2021 13:20:35 -0400
+Subject: power: supply: max17042: Do not enforce (incorrect) interrupt trigger
+ type
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 7fbf6b731bca347700e460d94b130f9d734b33e9 ]
+
+Interrupt line can be configured on different hardware in different way,
+even inverted. Therefore driver should not enforce specific trigger
+type - edge falling - but instead rely on Devicetree to configure it.
+
+The Maxim 17047/77693 datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU therefore the edge
+falling is not correct.
+
+The interrupt line is shared between PMIC and RTC driver, so using level
+sensitive interrupt is here especially important to avoid races. With
+an edge configuration in case if first PMIC signals interrupt followed
+shortly after by the RTC, the interrupt might not be yet cleared/acked
+thus the second one would not be noticed.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max17042_battery.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index 1a568df383db..00a3a581e079 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -1083,7 +1083,7 @@ static int max17042_probe(struct i2c_client *client,
+ }
+
+ if (client->irq) {
+- unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT;
++ unsigned int flags = IRQF_ONESHOT;
+
+ /*
+ * On ACPI systems the IRQ may be handled by ACPI-event code,
+--
+2.30.2
+
--- /dev/null
+From b0bce58aaebb6be1bb9e1e29c68b469270abc2fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 12:51:12 +0200
+Subject: power: supply: rt5033_battery: Fix device tree enumeration
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit f3076cd8d1d5fa64b5e1fa5affc045c2fc123baa ]
+
+The fuel gauge in the RT5033 PMIC has its own I2C bus and interrupt
+line. Therefore, it is not actually part of the RT5033 MFD and needs
+its own of_match_table to probe properly.
+
+Also, given that it's independent of the MFD, there is actually
+no need to make the Kconfig depend on MFD_RT5033. Although the driver
+uses the shared <linux/mfd/rt5033.h> header, there is no compile
+or runtime dependency on the RT5033 MFD driver.
+
+Cc: Beomho Seo <beomho.seo@samsung.com>
+Cc: Chanwoo Choi <cw00.choi@samsung.com>
+Fixes: b847dd96e659 ("power: rt5033_battery: Add RT5033 Fuel gauge device driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/Kconfig | 3 ++-
+ drivers/power/supply/rt5033_battery.c | 7 +++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index 76c699b5abda..1d656aa2c6d6 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -621,7 +621,8 @@ config BATTERY_GOLDFISH
+
+ config BATTERY_RT5033
+ tristate "RT5033 fuel gauge support"
+- depends on MFD_RT5033
++ depends on I2C
++ select REGMAP_I2C
+ help
+ This adds support for battery fuel gauge in Richtek RT5033 PMIC.
+ The fuelgauge calculates and determines the battery state of charge
+diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c
+index bcdd83048492..9310b85f3405 100644
+--- a/drivers/power/supply/rt5033_battery.c
++++ b/drivers/power/supply/rt5033_battery.c
+@@ -167,9 +167,16 @@ static const struct i2c_device_id rt5033_battery_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, rt5033_battery_id);
+
++static const struct of_device_id rt5033_battery_of_match[] = {
++ { .compatible = "richtek,rt5033-battery", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, rt5033_battery_of_match);
++
+ static struct i2c_driver rt5033_battery_driver = {
+ .driver = {
+ .name = "rt5033-battery",
++ .of_match_table = rt5033_battery_of_match,
+ },
+ .probe = rt5033_battery_probe,
+ .remove = rt5033_battery_remove,
+--
+2.30.2
+
--- /dev/null
+From 47df7616ef08924d4a9a0dab8f95f4fa10765e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 13:49:00 +1000
+Subject: powerpc/boot: Fixup device-tree on little endian
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit c93f80849bdd9b45d834053ae1336e28f0026c84 ]
+
+This fixes the core devtree.c functions and the ns16550 UART backend.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Acked-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/YMwXrPT8nc4YUdJ9@thinks.paulus.ozlabs.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/devtree.c | 59 +++++++++++++++++++++----------------
+ arch/powerpc/boot/ns16550.c | 9 ++++--
+ 2 files changed, 41 insertions(+), 27 deletions(-)
+
+diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c
+index a7e21a35c03a..27c84b82b588 100644
+--- a/arch/powerpc/boot/devtree.c
++++ b/arch/powerpc/boot/devtree.c
+@@ -17,6 +17,7 @@
+ #include "string.h"
+ #include "stdio.h"
+ #include "ops.h"
++#include "of.h"
+
+ void dt_fixup_memory(u64 start, u64 size)
+ {
+@@ -27,21 +28,25 @@ void dt_fixup_memory(u64 start, u64 size)
+ root = finddevice("/");
+ if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0)
+ naddr = 2;
++ else
++ naddr = be32_to_cpu(naddr);
+ if (naddr < 1 || naddr > 2)
+ fatal("Can't cope with #address-cells == %d in /\n\r", naddr);
+
+ if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0)
+ nsize = 1;
++ else
++ nsize = be32_to_cpu(nsize);
+ if (nsize < 1 || nsize > 2)
+ fatal("Can't cope with #size-cells == %d in /\n\r", nsize);
+
+ i = 0;
+ if (naddr == 2)
+- memreg[i++] = start >> 32;
+- memreg[i++] = start & 0xffffffff;
++ memreg[i++] = cpu_to_be32(start >> 32);
++ memreg[i++] = cpu_to_be32(start & 0xffffffff);
+ if (nsize == 2)
+- memreg[i++] = size >> 32;
+- memreg[i++] = size & 0xffffffff;
++ memreg[i++] = cpu_to_be32(size >> 32);
++ memreg[i++] = cpu_to_be32(size & 0xffffffff);
+
+ memory = finddevice("/memory");
+ if (! memory) {
+@@ -49,9 +54,9 @@ void dt_fixup_memory(u64 start, u64 size)
+ setprop_str(memory, "device_type", "memory");
+ }
+
+- printf("Memory <- <0x%x", memreg[0]);
++ printf("Memory <- <0x%x", be32_to_cpu(memreg[0]));
+ for (i = 1; i < (naddr + nsize); i++)
+- printf(" 0x%x", memreg[i]);
++ printf(" 0x%x", be32_to_cpu(memreg[i]));
+ printf("> (%ldMB)\n\r", (unsigned long)(size >> 20));
+
+ setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32));
+@@ -69,10 +74,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus)
+ printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus));
+
+ while ((devp = find_node_by_devtype(devp, "cpu"))) {
+- setprop_val(devp, "clock-frequency", cpu);
+- setprop_val(devp, "timebase-frequency", tb);
++ setprop_val(devp, "clock-frequency", cpu_to_be32(cpu));
++ setprop_val(devp, "timebase-frequency", cpu_to_be32(tb));
+ if (bus > 0)
+- setprop_val(devp, "bus-frequency", bus);
++ setprop_val(devp, "bus-frequency", cpu_to_be32(bus));
+ }
+
+ timebase_period_ns = 1000000000 / tb;
+@@ -84,7 +89,7 @@ void dt_fixup_clock(const char *path, u32 freq)
+
+ if (devp) {
+ printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq));
+- setprop_val(devp, "clock-frequency", freq);
++ setprop_val(devp, "clock-frequency", cpu_to_be32(freq));
+ }
+ }
+
+@@ -137,8 +142,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize)
+ {
+ if (getprop(node, "#address-cells", naddr, 4) != 4)
+ *naddr = 2;
++ else
++ *naddr = be32_to_cpu(*naddr);
+ if (getprop(node, "#size-cells", nsize, 4) != 4)
+ *nsize = 1;
++ else
++ *nsize = be32_to_cpu(*nsize);
+ }
+
+ static void copy_val(u32 *dest, u32 *src, int naddr)
+@@ -167,9 +176,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr)
+ int i, carry = 0;
+
+ for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) {
+- u64 tmp = (u64)reg[i] + add[i] + carry;
++ u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry;
+ carry = tmp >> 32;
+- reg[i] = (u32)tmp;
++ reg[i] = cpu_to_be32((u32)tmp);
+ }
+
+ return !carry;
+@@ -184,18 +193,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize)
+ u32 end;
+
+ for (i = 0; i < MAX_ADDR_CELLS; i++) {
+- if (reg[i] < range[i])
++ if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i]))
+ return 0;
+- if (reg[i] > range[i])
++ if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i]))
+ break;
+ }
+
+ for (i = 0; i < MAX_ADDR_CELLS; i++) {
+- end = range[i] + rangesize[i];
++ end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]);
+
+- if (reg[i] < end)
++ if (be32_to_cpu(reg[i]) < end)
+ break;
+- if (reg[i] > end)
++ if (be32_to_cpu(reg[i]) > end)
+ return 0;
+ }
+
+@@ -244,7 +253,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+ return 0;
+
+ dt_get_reg_format(parent, &naddr, &nsize);
+-
+ if (nsize > 2)
+ return 0;
+
+@@ -256,10 +264,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+
+ copy_val(last_addr, prop_buf + offset, naddr);
+
+- ret_size = prop_buf[offset + naddr];
++ ret_size = be32_to_cpu(prop_buf[offset + naddr]);
+ if (nsize == 2) {
+ ret_size <<= 32;
+- ret_size |= prop_buf[offset + naddr + 1];
++ ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]);
+ }
+
+ for (;;) {
+@@ -282,7 +290,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+
+ offset = find_range(last_addr, prop_buf, prev_naddr,
+ naddr, prev_nsize, buflen / 4);
+-
+ if (offset < 0)
+ return 0;
+
+@@ -300,8 +307,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+ if (naddr > 2)
+ return 0;
+
+- ret_addr = ((u64)last_addr[2] << 32) | last_addr[3];
+-
++ ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]);
+ if (sizeof(void *) == 4 &&
+ (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL ||
+ ret_addr + ret_size > 0x100000000ULL))
+@@ -354,11 +360,14 @@ int dt_is_compatible(void *node, const char *compat)
+ int dt_get_virtual_reg(void *node, void **addr, int nres)
+ {
+ unsigned long xaddr;
+- int n;
++ int n, i;
+
+ n = getprop(node, "virtual-reg", addr, nres * 4);
+- if (n > 0)
++ if (n > 0) {
++ for (i = 0; i < n/4; i ++)
++ ((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]);
+ return n / 4;
++ }
+
+ for (n = 0; n < nres; n++) {
+ if (!dt_xlate_reg(node, n, &xaddr, NULL))
+diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c
+index b0da4466d419..f16d2be1d0f3 100644
+--- a/arch/powerpc/boot/ns16550.c
++++ b/arch/powerpc/boot/ns16550.c
+@@ -15,6 +15,7 @@
+ #include "stdio.h"
+ #include "io.h"
+ #include "ops.h"
++#include "of.h"
+
+ #define UART_DLL 0 /* Out: Divisor Latch Low */
+ #define UART_DLM 1 /* Out: Divisor Latch High */
+@@ -58,16 +59,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp)
+ int n;
+ u32 reg_offset;
+
+- if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1)
++ if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) {
++ printf("virt reg parse fail...\r\n");
+ return -1;
++ }
+
+ n = getprop(devp, "reg-offset", ®_offset, sizeof(reg_offset));
+ if (n == sizeof(reg_offset))
+- reg_base += reg_offset;
++ reg_base += be32_to_cpu(reg_offset);
+
+ n = getprop(devp, "reg-shift", ®_shift, sizeof(reg_shift));
+ if (n != sizeof(reg_shift))
+ reg_shift = 0;
++ else
++ reg_shift = be32_to_cpu(reg_shift);
+
+ scdp->open = ns16550_open;
+ scdp->putc = ns16550_putc;
+--
+2.30.2
+
--- /dev/null
+From 831ecac041ebaf5d1d003bc6b77ec2077f139ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jun 2021 19:17:02 +0000
+Subject: powerpc/ps3: Add dma_mask to ps3_dma_region
+
+From: Geoff Levand <geoff@infradead.org>
+
+[ Upstream commit 9733862e50fdba55e7f1554e4286fcc5302ff28e ]
+
+Commit f959dcd6ddfd29235030e8026471ac1b022ad2b0 (dma-direct: Fix
+potential NULL pointer dereference) added a null check on the
+dma_mask pointer of the kernel's device structure.
+
+Add a dma_mask variable to the ps3_dma_region structure and set
+the device structure's dma_mask pointer to point to this new variable.
+
+Fixes runtime errors like these:
+# WARNING: Fixes tag on line 10 doesn't match correct format
+# WARNING: Fixes tag on line 10 doesn't match correct format
+
+ ps3_system_bus_match:349: dev=8.0(sb_01), drv=8.0(ps3flash): match
+ WARNING: CPU: 0 PID: 1 at kernel/dma/mapping.c:151 .dma_map_page_attrs+0x34/0x1e0
+ ps3flash sb_01: ps3stor_setup:193: map DMA region failed
+
+Signed-off-by: Geoff Levand <geoff@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/562d0c9ea0100a30c3b186bcc7adb34b0bbd2cd7.1622746428.git.geoff@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ps3.h | 2 ++
+ arch/powerpc/platforms/ps3/mm.c | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h
+index 17ee719e799f..013d24d246d6 100644
+--- a/arch/powerpc/include/asm/ps3.h
++++ b/arch/powerpc/include/asm/ps3.h
+@@ -83,6 +83,7 @@ struct ps3_dma_region_ops;
+ * @bus_addr: The 'translated' bus address of the region.
+ * @len: The length in bytes of the region.
+ * @offset: The offset from the start of memory of the region.
++ * @dma_mask: Device dma_mask.
+ * @ioid: The IOID of the device who owns this region
+ * @chunk_list: Opaque variable used by the ioc page manager.
+ * @region_ops: struct ps3_dma_region_ops - dma region operations
+@@ -97,6 +98,7 @@ struct ps3_dma_region {
+ enum ps3_dma_region_type region_type;
+ unsigned long len;
+ unsigned long offset;
++ u64 dma_mask;
+
+ /* driver variables (set by ps3_dma_region_create) */
+ unsigned long bus_addr;
+diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
+index 894f62d77a77..12ed80850a43 100644
+--- a/arch/powerpc/platforms/ps3/mm.c
++++ b/arch/powerpc/platforms/ps3/mm.c
+@@ -18,6 +18,7 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/dma-mapping.h>
+ #include <linux/kernel.h>
+ #include <linux/export.h>
+ #include <linux/memblock.h>
+@@ -1130,6 +1131,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
+ enum ps3_dma_region_type region_type, void *addr, unsigned long len)
+ {
+ unsigned long lpar_addr;
++ int result;
+
+ lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0;
+
+@@ -1141,6 +1143,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
+ r->offset -= map.r1.offset;
+ r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size);
+
++ dev->core.dma_mask = &r->dma_mask;
++
++ result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32));
++
++ if (result < 0) {
++ dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n",
++ __func__, __LINE__, result);
++ return result;
++ }
++
+ switch (dev->dev_type) {
+ case PS3_DEVICE_TYPE_SB:
+ r->region_ops = (USE_DYNAMIC_DMA)
+--
+2.30.2
+
--- /dev/null
+From 42f7f4a5b90e64a7de5dbaad93d6f5e660b688f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 11:05:24 +0200
+Subject: pwm: spear: Don't modify HW state in .remove callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit b601a18f12383001e7a8da238de7ca1559ebc450 ]
+
+A consumer is expected to disable a PWM before calling pwm_put(). And if
+they didn't there is hopefully a good reason (or the consumer needs
+fixing). Also if disabling an enabled PWM was the right thing to do,
+this should better be done in the framework instead of in each low level
+driver.
+
+So drop the hardware modification from the .remove() callback.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-spear.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c
+index 6c6b44fd3f43..2d11ac277de8 100644
+--- a/drivers/pwm/pwm-spear.c
++++ b/drivers/pwm/pwm-spear.c
+@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev)
+ static int spear_pwm_remove(struct platform_device *pdev)
+ {
+ struct spear_pwm_chip *pc = platform_get_drvdata(pdev);
+- int i;
+-
+- for (i = 0; i < NUM_PWM; i++)
+- pwm_disable(&pc->chip.pwms[i]);
+
+ /* clk was prepared in probe, hence unprepare it here */
+ clk_unprepare(pc->clk);
+--
+2.30.2
+
--- /dev/null
+From a698e765cfaec2566b37f59f73cb4bb961407621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 11:51:41 +0200
+Subject: pwm: tegra: Don't modify HW state in .remove callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 86f7fa71cd830d18d7ebcaf719dffd5ddfe1acdd ]
+
+A consumer is expected to disable a PWM before calling pwm_put(). And if
+they didn't there is hopefully a good reason (or the consumer needs
+fixing). Also if disabling an enabled PWM was the right thing to do,
+this should better be done in the framework instead of in each low level
+driver.
+
+So drop the hardware modification from the .remove() callback.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tegra.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
+index f8ebbece57b7..6be14e0f1dc3 100644
+--- a/drivers/pwm/pwm-tegra.c
++++ b/drivers/pwm/pwm-tegra.c
+@@ -245,7 +245,6 @@ static int tegra_pwm_probe(struct platform_device *pdev)
+ static int tegra_pwm_remove(struct platform_device *pdev)
+ {
+ struct tegra_pwm_chip *pc = platform_get_drvdata(pdev);
+- unsigned int i;
+ int err;
+
+ if (WARN_ON(!pc))
+@@ -255,18 +254,6 @@ static int tegra_pwm_remove(struct platform_device *pdev)
+ if (err < 0)
+ return err;
+
+- for (i = 0; i < pc->chip.npwm; i++) {
+- struct pwm_device *pwm = &pc->chip.pwms[i];
+-
+- if (!pwm_is_enabled(pwm))
+- if (clk_prepare_enable(pc->clk) < 0)
+- continue;
+-
+- pwm_writel(pc, i, 0);
+-
+- clk_disable_unprepare(pc->clk);
+- }
+-
+ reset_control_assert(pc->rst);
+ clk_disable_unprepare(pc->clk);
+
+--
+2.30.2
+
--- /dev/null
+From 7da718d5575461dd487e124a04f366afd74929d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 May 2021 07:28:03 -0400
+Subject: reset: a10sr: add missing of_match_table reference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 466ba3c8ff4fae39e455ff8d080b3d5503302765 ]
+
+The driver defined of_device_id table but did not use it with
+of_match_table. This prevents usual matching via devicetree and causes
+a W=1 warning:
+
+ drivers/reset/reset-a10sr.c:111:34: warning:
+ ‘a10sr_reset_of_match’ defined but not used [-Wunused-const-variable=]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: 627006820268 ("reset: Add Altera Arria10 SR Reset Controller")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20210507112803.20012-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-a10sr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/reset-a10sr.c b/drivers/reset/reset-a10sr.c
+index 37496bd27fa2..306fba5b3519 100644
+--- a/drivers/reset/reset-a10sr.c
++++ b/drivers/reset/reset-a10sr.c
+@@ -129,6 +129,7 @@ static struct platform_driver a10sr_reset_driver = {
+ .probe = a10sr_reset_probe,
+ .driver = {
+ .name = "altr_a10sr_reset",
++ .of_match_table = a10sr_reset_of_match,
+ },
+ };
+ module_platform_driver(a10sr_reset_driver);
+--
+2.30.2
+
--- /dev/null
+From 925d0e3162ca23d816c96d7f134ac2a81e47bb51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 10:26:15 +0200
+Subject: reset: bail if try_module_get() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 4fb26fb83f0def3d39c14e268bcd4003aae8fade ]
+
+Abort instead of returning a new reset control for a reset controller
+device that is going to have its module unloaded.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 61fc41317666 ("reset: Add reset controller API")
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20210607082615.15160-1-p.zabel@pengutronix.de
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index f7bf20493f23..ccb97f4e31c3 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -428,7 +428,10 @@ static struct reset_control *__reset_control_get_internal(
+ if (!rstc)
+ return ERR_PTR(-ENOMEM);
+
+- try_module_get(rcdev->owner);
++ if (!try_module_get(rcdev->owner)) {
++ kfree(rstc);
++ return ERR_PTR(-ENODEV);
++ }
+
+ rstc->rcdev = rcdev;
+ list_add(&rstc->list, &rcdev->reset_control_head);
+--
+2.30.2
+
--- /dev/null
+From dc62926d920009b20794033e99ba5c85f7639aff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 17:45:47 +0900
+Subject: Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro"
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 5d6fb80a142b5994355ce675c517baba6089d199 ]
+
+This reverts commit 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f.
+
+I've explained that optional FireWire card for d.2 is also built-in to
+d.2 Pro, however it's wrong. The optional card uses DM1000 ASIC and has
+'Mackie DJ Mixer' in its model name of configuration ROM. On the other
+hand, built-in FireWire card for d.2 Pro and d.4 Pro uses OXFW971 ASIC
+and has 'd.Pro' in its model name according to manuals and user
+experiences. The former card is not the card for d.2 Pro. They are similar
+in appearance but different internally.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210518084557.102681-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/Kconfig | 4 ++--
+ sound/firewire/bebob/bebob.c | 2 +-
+ sound/firewire/oxfw/oxfw.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
+index a2ed164d80b4..4e0e320b77d8 100644
+--- a/sound/firewire/Kconfig
++++ b/sound/firewire/Kconfig
+@@ -37,7 +37,7 @@ config SND_OXFW
+ * Mackie(Loud) Onyx 1640i (former model)
+ * Mackie(Loud) Onyx Satellite
+ * Mackie(Loud) Tapco Link.Firewire
+- * Mackie(Loud) d.4 pro
++ * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC)
+ * Mackie(Loud) U.420/U.420d
+ * TASCAM FireOne
+ * Stanton Controllers & Systems 1 Deck/Mixer
+@@ -83,7 +83,7 @@ config SND_BEBOB
+ * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394
+ * BridgeCo RDAudio1/Audio5
+ * Mackie Onyx 1220/1620/1640 (FireWire I/O Card)
+- * Mackie d.2 (FireWire Option) and d.2 Pro
++ * Mackie d.2 (optional FireWire card with DM1000 ASIC)
+ * Stanton FinalScratch 2 (ScratchAmp)
+ * Tascam IF-FW/DM
+ * Behringer XENIX UFX 1204/1604
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 2bcfeee75853..8073360581f4 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -414,7 +414,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal),
+ /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal),
+- // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in).
++ // Mackie, d.2 (optional Firewire card with DM1000).
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal),
+ /* Stanton, ScratchAmp */
+ SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal),
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 3c9aa797747b..59c05c5dc1cb 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -400,7 +400,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
+ * Onyx-i series (former models): 0x081216
+ * Mackie Onyx Satellite: 0x00200f
+ * Tapco LINK.firewire 4x6: 0x000460
+- * d.4 pro: Unknown
++ * d.2 pro/d.4 pro (built-in card): Unknown
+ * U.420: Unknown
+ * U.420d: Unknown
+ */
+--
+2.30.2
+
--- /dev/null
+From da8ecc082c916a025f55deb3d5b4f08170fced40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 10:19:26 +0300
+Subject: rtc: fix snprintf() checking in is_rtc_hctosys()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 54b909436ede47e0ee07f1765da27ec2efa41e84 ]
+
+The scnprintf() function silently truncates the printf() and returns
+the number bytes that it was able to copy (not counting the NUL
+terminator). Thus, the highest value it can return here is
+"NAME_SIZE - 1" and the overflow check is dead code. Fix this by
+using the snprintf() function which returns the number of bytes that
+would have been copied if there was enough space and changing the
+condition from "> NAME_SIZE" to ">= NAME_SIZE".
+
+Fixes: 92589c986b33 ("rtc-proc: permit the /proc/driver/rtc device to use other devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c
+index a9dd9218fae2..b8c5b93102ce 100644
+--- a/drivers/rtc/rtc-proc.c
++++ b/drivers/rtc/rtc-proc.c
+@@ -26,8 +26,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc)
+ int size;
+ char name[NAME_SIZE];
+
+- size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id);
+- if (size > NAME_SIZE)
++ size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id);
++ if (size >= NAME_SIZE)
+ return false;
+
+ return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE);
+--
+2.30.2
+
--- /dev/null
+From aa34a5c73c29e438833884429b95cdb0c893debd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Apr 2021 21:40:10 +0200
+Subject: s390/sclp_vt220: fix console name to match device
+
+From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
+
+[ Upstream commit b7d91d230a119fdcc334d10c9889ce9c5e15118b ]
+
+Console name reported in /proc/consoles:
+
+ ttyS1 -W- (EC p ) 4:65
+
+does not match the char device name:
+
+ crw--w---- 1 root root 4, 65 May 17 12:18 /dev/ttysclp0
+
+so debian-installer inside a QEMU s390x instance gets confused and fails
+to start with the following error:
+
+ steal-ctty: No such file or directory
+
+Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
+Link: https://lore.kernel.org/r/20210427194010.9330-1-vvidic@valentin-vidic.from.hr
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/setup.c | 2 +-
+ drivers/s390/char/sclp_vt220.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 4bda9055daef..e8bfd29bb1f9 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -141,7 +141,7 @@ static void __init set_preferred_console(void)
+ else if (CONSOLE_IS_3270)
+ add_preferred_console("tty3270", 0, NULL);
+ else if (CONSOLE_IS_VT220)
+- add_preferred_console("ttyS", 1, NULL);
++ add_preferred_console("ttysclp", 0, NULL);
+ else if (CONSOLE_IS_HVC)
+ add_preferred_console("hvc", 0, NULL);
+ }
+diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
+index 3f9a6ef650fa..3c2ed6d01387 100644
+--- a/drivers/s390/char/sclp_vt220.c
++++ b/drivers/s390/char/sclp_vt220.c
+@@ -35,8 +35,8 @@
+ #define SCLP_VT220_MINOR 65
+ #define SCLP_VT220_DRIVER_NAME "sclp_vt220"
+ #define SCLP_VT220_DEVICE_NAME "ttysclp"
+-#define SCLP_VT220_CONSOLE_NAME "ttyS"
+-#define SCLP_VT220_CONSOLE_INDEX 1 /* console=ttyS1 */
++#define SCLP_VT220_CONSOLE_NAME "ttysclp"
++#define SCLP_VT220_CONSOLE_INDEX 0 /* console=ttysclp0 */
+
+ /* Representation of a single write request */
+ struct sclp_vt220_request {
+--
+2.30.2
+
--- /dev/null
+From 76396505b3e7972693d19744e902ecbff86d5b3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Jun 2021 09:18:34 +0200
+Subject: scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 030e4138d11fced3b831c2761e4cecf347bae99c ]
+
+If an error occurs after a pci_enable_pcie_error_reporting() call, it must
+be undone by a corresponding pci_disable_pcie_error_reporting() call, as
+already done in the remove function.
+
+Link: https://lore.kernel.org/r/77adb02cfea7f1364e5603ecf3930d8597ae356e.1623482155.git.christophe.jaillet@wanadoo.fr
+Fixes: 3567f36a09d1 ("[SCSI] be2iscsi: Fix AER handling in driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/be2iscsi/be_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index a5b807c676fc..50e9b4b68357 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -5764,6 +5764,7 @@ free_hba:
+ pci_disable_msix(phba->pcidev);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_disable_pcie_error_reporting(pcidev);
+ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_release_regions(pcidev);
+--
+2.30.2
+
--- /dev/null
+From be833172540c6745c766316a022509eed38850f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 22:31:02 +0800
+Subject: scsi: core: Cap scsi_host cmd_per_lun at can_queue
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit ea2f0f77538c50739b9fb4de4700cee5535e1f77 ]
+
+The sysfs handling function sdev_store_queue_depth() enforces that the sdev
+queue depth cannot exceed shost can_queue. The initial sdev queue depth
+comes from shost cmd_per_lun. However, the LLDD may manually set
+cmd_per_lun to be larger than can_queue, which leads to an initial sdev
+queue depth greater than can_queue.
+
+Such an issue was reported in [0], which caused a hang. That has since been
+fixed in commit fc09acb7de31 ("scsi: scsi_debug: Fix cmd_per_lun, set to
+max_queue").
+
+Stop this possibly happening for other drivers by capping shost cmd_per_lun
+at shost can_queue.
+
+[0] https://lore.kernel.org/linux-scsi/YHaez6iN2HHYxYOh@T590/
+
+Link: https://lore.kernel.org/r/1621434662-173079-1-git-send-email-john.garry@huawei.com
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hosts.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index 2c085e463243..f3194d634f7f 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -218,6 +218,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ goto fail;
+ }
+
++ shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
++ shost->can_queue);
++
+ error = scsi_init_sense_cache(shost);
+ if (error)
+ goto fail;
+--
+2.30.2
+
--- /dev/null
+From 259ba790864ec0fe9be173193827159ad8c37393 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 13:18:03 -0500
+Subject: scsi: iscsi: Add iscsi_cls_conn refcount helpers
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit b1d19e8c92cfb0ded180ef3376c20e130414e067 ]
+
+There are a couple places where we could free the iscsi_cls_conn while it's
+still in use. This adds some helpers to get/put a refcount on the struct
+and converts an exiting user. Subsequent commits will then use the helpers
+to fix 2 bugs in the eh code.
+
+Link: https://lore.kernel.org/r/20210525181821.7617-11-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 7 ++-----
+ drivers/scsi/scsi_transport_iscsi.c | 12 ++++++++++++
+ include/scsi/scsi_transport_iscsi.h | 2 ++
+ 3 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 81471c304991..52521b68f0a7 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1385,7 +1385,6 @@ void iscsi_session_failure(struct iscsi_session *session,
+ enum iscsi_err err)
+ {
+ struct iscsi_conn *conn;
+- struct device *dev;
+
+ spin_lock_bh(&session->frwd_lock);
+ conn = session->leadconn;
+@@ -1394,10 +1393,8 @@ void iscsi_session_failure(struct iscsi_session *session,
+ return;
+ }
+
+- dev = get_device(&conn->cls_conn->dev);
++ iscsi_get_conn(conn->cls_conn);
+ spin_unlock_bh(&session->frwd_lock);
+- if (!dev)
+- return;
+ /*
+ * if the host is being removed bypass the connection
+ * recovery initialization because we are going to kill
+@@ -1407,7 +1404,7 @@ void iscsi_session_failure(struct iscsi_session *session,
+ iscsi_conn_error_event(conn->cls_conn, err);
+ else
+ iscsi_conn_failure(conn, err);
+- put_device(dev);
++ iscsi_put_conn(conn->cls_conn);
+ }
+ EXPORT_SYMBOL_GPL(iscsi_session_failure);
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index e340b05278b6..2aaa5a2bd613 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2306,6 +2306,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
+ }
+ EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
+
++void iscsi_put_conn(struct iscsi_cls_conn *conn)
++{
++ put_device(&conn->dev);
++}
++EXPORT_SYMBOL_GPL(iscsi_put_conn);
++
++void iscsi_get_conn(struct iscsi_cls_conn *conn)
++{
++ get_device(&conn->dev);
++}
++EXPORT_SYMBOL_GPL(iscsi_get_conn);
++
+ /*
+ * iscsi interface functions
+ */
+diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
+index b266d2a3bcb1..484e9787d817 100644
+--- a/include/scsi/scsi_transport_iscsi.h
++++ b/include/scsi/scsi_transport_iscsi.h
+@@ -436,6 +436,8 @@ extern void iscsi_remove_session(struct iscsi_cls_session *session);
+ extern void iscsi_free_session(struct iscsi_cls_session *session);
+ extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
+ int dd_size, uint32_t cid);
++extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
++extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
+ extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
+ extern void iscsi_unblock_session(struct iscsi_cls_session *session);
+ extern void iscsi_block_session(struct iscsi_cls_session *session);
+--
+2.30.2
+
--- /dev/null
+From 72ae370c5baee0c2b091161f0d7d87ddec852c59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 13:18:06 -0500
+Subject: scsi: iscsi: Fix conn use after free during resets
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit ec29d0ac29be366450a7faffbcf8cba3a6a3b506 ]
+
+If we haven't done a unbind target call we can race where
+iscsi_conn_teardown wakes up the EH thread and then frees the conn while
+those threads are still accessing the conn ehwait.
+
+We can only do one TMF per session so this just moves the TMF fields from
+the conn to the session. We can then rely on the
+iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call
+to remove the target and it's devices, and know after that point there is
+no device or scsi-ml callout trying to access the session.
+
+Link: https://lore.kernel.org/r/20210525181821.7617-14-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 115 +++++++++++++++++++---------------------
+ include/scsi/libiscsi.h | 11 ++--
+ 2 files changed, 60 insertions(+), 66 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 52521b68f0a7..5607fe8541c3 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -259,11 +259,11 @@ static int iscsi_prep_bidi_ahs(struct iscsi_task *task)
+ */
+ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ {
+- struct iscsi_conn *conn = task->conn;
+- struct iscsi_tm *tmf = &conn->tmhdr;
++ struct iscsi_session *session = task->conn->session;
++ struct iscsi_tm *tmf = &session->tmhdr;
+ u64 hdr_lun;
+
+- if (conn->tmf_state == TMF_INITIAL)
++ if (session->tmf_state == TMF_INITIAL)
+ return 0;
+
+ if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC)
+@@ -283,24 +283,19 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ * Fail all SCSI cmd PDUs
+ */
+ if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
+- iscsi_conn_printk(KERN_INFO, conn,
+- "task [op %x itt "
+- "0x%x/0x%x] "
+- "rejected.\n",
+- opcode, task->itt,
+- task->hdr_itt);
++ iscsi_session_printk(KERN_INFO, session,
++ "task [op %x itt 0x%x/0x%x] rejected.\n",
++ opcode, task->itt, task->hdr_itt);
+ return -EACCES;
+ }
+ /*
+ * And also all data-out PDUs in response to R2T
+ * if fast_abort is set.
+ */
+- if (conn->session->fast_abort) {
+- iscsi_conn_printk(KERN_INFO, conn,
+- "task [op %x itt "
+- "0x%x/0x%x] fast abort.\n",
+- opcode, task->itt,
+- task->hdr_itt);
++ if (session->fast_abort) {
++ iscsi_session_printk(KERN_INFO, session,
++ "task [op %x itt 0x%x/0x%x] fast abort.\n",
++ opcode, task->itt, task->hdr_itt);
+ return -EACCES;
+ }
+ break;
+@@ -313,7 +308,7 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ */
+ if (opcode == ISCSI_OP_SCSI_DATA_OUT &&
+ task->hdr_itt == tmf->rtt) {
+- ISCSI_DBG_SESSION(conn->session,
++ ISCSI_DBG_SESSION(session,
+ "Preventing task %x/%x from sending "
+ "data-out due to abort task in "
+ "progress\n", task->itt,
+@@ -970,20 +965,21 @@ iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
+ {
+ struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr;
++ struct iscsi_session *session = conn->session;
+
+ conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
+ conn->tmfrsp_pdus_cnt++;
+
+- if (conn->tmf_state != TMF_QUEUED)
++ if (session->tmf_state != TMF_QUEUED)
+ return;
+
+ if (tmf->response == ISCSI_TMF_RSP_COMPLETE)
+- conn->tmf_state = TMF_SUCCESS;
++ session->tmf_state = TMF_SUCCESS;
+ else if (tmf->response == ISCSI_TMF_RSP_NO_TASK)
+- conn->tmf_state = TMF_NOT_FOUND;
++ session->tmf_state = TMF_NOT_FOUND;
+ else
+- conn->tmf_state = TMF_FAILED;
+- wake_up(&conn->ehwait);
++ session->tmf_state = TMF_FAILED;
++ wake_up(&session->ehwait);
+ }
+
+ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+@@ -1822,15 +1818,14 @@ EXPORT_SYMBOL_GPL(iscsi_target_alloc);
+
+ static void iscsi_tmf_timedout(struct timer_list *t)
+ {
+- struct iscsi_conn *conn = from_timer(conn, t, tmf_timer);
+- struct iscsi_session *session = conn->session;
++ struct iscsi_session *session = from_timer(session, t, tmf_timer);
+
+ spin_lock(&session->frwd_lock);
+- if (conn->tmf_state == TMF_QUEUED) {
+- conn->tmf_state = TMF_TIMEDOUT;
++ if (session->tmf_state == TMF_QUEUED) {
++ session->tmf_state = TMF_TIMEDOUT;
+ ISCSI_DBG_EH(session, "tmf timedout\n");
+ /* unblock eh_abort() */
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock(&session->frwd_lock);
+ }
+@@ -1853,8 +1848,8 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
+ return -EPERM;
+ }
+ conn->tmfcmd_pdus_cnt++;
+- conn->tmf_timer.expires = timeout * HZ + jiffies;
+- add_timer(&conn->tmf_timer);
++ session->tmf_timer.expires = timeout * HZ + jiffies;
++ add_timer(&session->tmf_timer);
+ ISCSI_DBG_EH(session, "tmf set timeout\n");
+
+ spin_unlock_bh(&session->frwd_lock);
+@@ -1868,12 +1863,12 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
+ * 3) session is terminated or restarted or userspace has
+ * given up on recovery
+ */
+- wait_event_interruptible(conn->ehwait, age != session->age ||
++ wait_event_interruptible(session->ehwait, age != session->age ||
+ session->state != ISCSI_STATE_LOGGED_IN ||
+- conn->tmf_state != TMF_QUEUED);
++ session->tmf_state != TMF_QUEUED);
+ if (signal_pending(current))
+ flush_signals(current);
+- del_timer_sync(&conn->tmf_timer);
++ del_timer_sync(&session->tmf_timer);
+
+ mutex_lock(&session->eh_mutex);
+ spin_lock_bh(&session->frwd_lock);
+@@ -2233,17 +2228,17 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ }
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto failed;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_abort_task_pdu(task, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, age, session->abort_timeout))
+ goto failed;
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ spin_unlock_bh(&session->frwd_lock);
+ /*
+@@ -2258,7 +2253,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ */
+ spin_lock_bh(&session->frwd_lock);
+ fail_scsi_task(task, DID_ABORT);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ memset(hdr, 0, sizeof(*hdr));
+ spin_unlock_bh(&session->frwd_lock);
+ iscsi_start_tx(conn);
+@@ -2269,7 +2264,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ goto failed_unlocked;
+ case TMF_NOT_FOUND:
+ if (!sc->SCp.ptr) {
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ memset(hdr, 0, sizeof(*hdr));
+ /* task completed before tmf abort response */
+ ISCSI_DBG_EH(session, "sc completed while abort in "
+@@ -2278,7 +2273,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ }
+ /* fall through */
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto failed;
+ }
+
+@@ -2335,11 +2330,11 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ conn = session->leadconn;
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto unlock;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_lun_reset_pdu(sc, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
+@@ -2348,7 +2343,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ goto unlock;
+ }
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ break;
+ case TMF_TIMEDOUT:
+@@ -2356,7 +2351,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+ goto done;
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto unlock;
+ }
+
+@@ -2368,7 +2363,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ spin_lock_bh(&session->frwd_lock);
+ memset(hdr, 0, sizeof(*hdr));
+ fail_scsi_tasks(conn, sc->device->lun, DID_ERROR);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_start_tx(conn);
+@@ -2391,8 +2386,7 @@ void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
+ spin_lock_bh(&session->frwd_lock);
+ if (session->state != ISCSI_STATE_LOGGED_IN) {
+ session->state = ISCSI_STATE_RECOVERY_FAILED;
+- if (session->leadconn)
+- wake_up(&session->leadconn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock_bh(&session->frwd_lock);
+ }
+@@ -2437,7 +2431,7 @@ failed:
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+
+ ISCSI_DBG_EH(session, "wait for relogin\n");
+- wait_event_interruptible(conn->ehwait,
++ wait_event_interruptible(session->ehwait,
+ session->state == ISCSI_STATE_TERMINATE ||
+ session->state == ISCSI_STATE_LOGGED_IN ||
+ session->state == ISCSI_STATE_RECOVERY_FAILED);
+@@ -2498,11 +2492,11 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ conn = session->leadconn;
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto unlock;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_tgt_reset_pdu(sc, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
+@@ -2511,7 +2505,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ goto unlock;
+ }
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ break;
+ case TMF_TIMEDOUT:
+@@ -2519,7 +2513,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+ goto done;
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto unlock;
+ }
+
+@@ -2531,7 +2525,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ spin_lock_bh(&session->frwd_lock);
+ memset(hdr, 0, sizeof(*hdr));
+ fail_scsi_tasks(conn, -1, DID_ERROR);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_start_tx(conn);
+@@ -2836,7 +2830,10 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost,
+ session->tt = iscsit;
+ session->dd_data = cls_session->dd_data + sizeof(*session);
+
++ session->tmf_state = TMF_INITIAL;
++ timer_setup(&session->tmf_timer, iscsi_tmf_timedout, 0);
+ mutex_init(&session->eh_mutex);
++
+ spin_lock_init(&session->frwd_lock);
+ spin_lock_init(&session->back_lock);
+
+@@ -2940,7 +2937,6 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
+ conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
+ conn->id = conn_idx;
+ conn->exp_statsn = 0;
+- conn->tmf_state = TMF_INITIAL;
+
+ timer_setup(&conn->transport_timer, iscsi_check_transport_timeouts, 0);
+
+@@ -2966,8 +2962,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
+ goto login_task_data_alloc_fail;
+ conn->login_task->data = conn->data = data;
+
+- timer_setup(&conn->tmf_timer, iscsi_tmf_timedout, 0);
+- init_waitqueue_head(&conn->ehwait);
++ init_waitqueue_head(&session->ehwait);
+
+ return cls_conn;
+
+@@ -3002,7 +2997,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ * leading connection? then give up on recovery.
+ */
+ session->state = ISCSI_STATE_TERMINATE;
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock_bh(&session->frwd_lock);
+
+@@ -3077,7 +3072,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
+ * commands after successful recovery
+ */
+ conn->stop_stage = 0;
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ session->age++;
+ if (session->age == 16)
+ session->age = 0;
+@@ -3091,7 +3086,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_unblock_session(session->cls_session);
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(iscsi_conn_start);
+@@ -3177,7 +3172,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
+ spin_lock_bh(&session->frwd_lock);
+ fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED);
+ fail_mgmt_tasks(session, conn);
+- memset(&conn->tmhdr, 0, sizeof(conn->tmhdr));
++ memset(&session->tmhdr, 0, sizeof(session->tmhdr));
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ }
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index 1ee0f30ae190..647f1e0e726c 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -208,12 +208,6 @@ struct iscsi_conn {
+ unsigned long suspend_tx; /* suspend Tx */
+ unsigned long suspend_rx; /* suspend Rx */
+
+- /* abort */
+- wait_queue_head_t ehwait; /* used in eh_abort() */
+- struct iscsi_tm tmhdr;
+- struct timer_list tmf_timer;
+- int tmf_state; /* see TMF_INITIAL, etc.*/
+-
+ /* negotiated params */
+ unsigned max_recv_dlength; /* initiator_max_recv_dsl*/
+ unsigned max_xmit_dlength; /* target_max_recv_dsl */
+@@ -283,6 +277,11 @@ struct iscsi_session {
+ * and recv lock.
+ */
+ struct mutex eh_mutex;
++ /* abort */
++ wait_queue_head_t ehwait; /* used in eh_abort() */
++ struct iscsi_tm tmhdr;
++ struct timer_list tmf_timer;
++ int tmf_state; /* see TMF_INITIAL, etc.*/
+
+ /* iSCSI session-wide sequencing */
+ uint32_t cmdsn;
+--
+2.30.2
+
--- /dev/null
+From f7427362b8ec7bf83e223c67fe164bc550094de5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 13:18:07 -0500
+Subject: scsi: iscsi: Fix shost->max_id use
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit bdd4aad7ff92ae39c2e93c415bb6761cb8b584da ]
+
+The iscsi offload drivers are setting the shost->max_id to the max number
+of sessions they support. The problem is that max_id is not the max number
+of targets but the highest identifier the targets can have. To use it to
+limit the number of targets we need to set it to max sessions - 1, or we
+can end up with a session we might not have preallocated resources for.
+
+Link: https://lore.kernel.org/r/20210525181821.7617-15-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/be2iscsi/be_main.c | 4 ++--
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +-
+ drivers/scsi/cxgbi/libcxgbi.c | 4 ++--
+ drivers/scsi/qedi/qedi_main.c | 2 +-
+ 4 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 3660059784f7..a5b807c676fc 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -423,7 +423,7 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
+ "beiscsi_hba_alloc - iscsi_host_alloc failed\n");
+ return NULL;
+ }
+- shost->max_id = BE2_MAX_SESSIONS;
++ shost->max_id = BE2_MAX_SESSIONS - 1;
+ shost->max_channel = 0;
+ shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
+ shost->max_lun = BEISCSI_NUM_MAX_LUN;
+@@ -5336,7 +5336,7 @@ static int beiscsi_enable_port(struct beiscsi_hba *phba)
+ /* Re-enable UER. If different TPE occurs then it is recoverable. */
+ beiscsi_set_uer_feature(phba);
+
+- phba->shost->max_id = phba->params.cxns_per_ctrl;
++ phba->shost->max_id = phba->params.cxns_per_ctrl - 1;
+ phba->shost->can_queue = phba->params.ios_per_ctrl;
+ ret = beiscsi_init_port(phba);
+ if (ret < 0) {
+diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+index 718a0335cfbb..9a5795d5a347 100644
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -793,7 +793,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
+ return NULL;
+ shost->dma_boundary = cnic->pcidev->dma_mask;
+ shost->transportt = bnx2i_scsi_xport_template;
+- shost->max_id = ISCSI_MAX_CONNS_PER_HBA;
++ shost->max_id = ISCSI_MAX_CONNS_PER_HBA - 1;
+ shost->max_channel = 0;
+ shost->max_lun = 512;
+ shost->max_cmd_len = 16;
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index 559d8bda4cca..01f5ebee3229 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -339,7 +339,7 @@ void cxgbi_hbas_remove(struct cxgbi_device *cdev)
+ EXPORT_SYMBOL_GPL(cxgbi_hbas_remove);
+
+ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun,
+- unsigned int max_id, struct scsi_host_template *sht,
++ unsigned int max_conns, struct scsi_host_template *sht,
+ struct scsi_transport_template *stt)
+ {
+ struct cxgbi_hba *chba;
+@@ -359,7 +359,7 @@ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun,
+
+ shost->transportt = stt;
+ shost->max_lun = max_lun;
+- shost->max_id = max_id;
++ shost->max_id = max_conns - 1;
+ shost->max_channel = 0;
+ shost->max_cmd_len = 16;
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index fe26144d390a..7665fd641886 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -629,7 +629,7 @@ static struct qedi_ctx *qedi_host_alloc(struct pci_dev *pdev)
+ goto exit_setup_shost;
+ }
+
+- shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA;
++ shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA - 1;
+ shost->max_channel = 0;
+ shost->max_lun = ~0;
+ shost->max_cmd_len = 16;
+--
+2.30.2
+
--- /dev/null
+From 8d09f838f81e822a17bf8ee6c26a4a3cbdf7db9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 12:55:56 -0700
+Subject: scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize
+ the SGLs
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 5aa615d195f1e142c662cb2253f057c9baec7531 ]
+
+The driver is encountering a crash in lpfc_free_iocb_list() while
+performing initial attachment.
+
+Code review found this to be an errant failure path that was taken, jumping
+to a tag that then referenced structures that were uninitialized.
+
+Fix the failure path.
+
+Link: https://lore.kernel.org/r/20210514195559.119853-9-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index f4633c9f8183..40d6537e64dd 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -7281,7 +7281,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ "0393 Error %d during rpi post operation\n",
+ rc);
+ rc = -ENODEV;
+- goto out_destroy_queue;
++ goto out_free_iocblist;
+ }
+ lpfc_sli4_node_prep(phba);
+
+@@ -7406,8 +7406,9 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ out_unset_queue:
+ /* Unset all the queues set up in this routine when error out */
+ lpfc_sli4_queue_unset(phba);
+-out_destroy_queue:
++out_free_iocblist:
+ lpfc_free_iocb_list(phba);
++out_destroy_queue:
+ lpfc_sli4_queue_destroy(phba);
+ out_stop_timers:
+ lpfc_stop_hba_timers(phba);
+--
+2.30.2
+
--- /dev/null
+From 464b4be455f5e2c8829a8df2d7a2598a05e77c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 12:55:51 -0700
+Subject: scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit e30d55137edef47434c40d7570276a0846fe922c ]
+
+An 'unexpected timeout' message may be seen in a point-2-point topology.
+The message occurs when a PLOGI is received before the driver is notified
+of FLOGI completion. The FLOGI completion failure causes discovery to be
+triggered for a second time. The discovery timer is restarted but no new
+discovery activity is initiated, thus the timeout message eventually
+appears.
+
+In point-2-point, when discovery has progressed before the FLOGI completion
+is processed, it is not a failure. Add code to FLOGI completion to detect
+that discovery has progressed and exit the FLOGI handling (noop'ing it).
+
+Link: https://lore.kernel.org/r/20210514195559.119853-4-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 6a4b496081e4..c4428249d3d7 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1176,6 +1176,15 @@ stop_rr_fcf_flogi:
+ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
++ } else if (vport->port_state > LPFC_FLOGI &&
++ vport->fc_flag & FC_PT2PT) {
++ /*
++ * In a p2p topology, it is possible that discovery has
++ * already progressed, and this completion can be ignored.
++ * Recheck the indicated topology.
++ */
++ if (!sp->cmn.fPort)
++ goto out;
+ }
+
+ flogifail:
+--
+2.30.2
+
--- /dev/null
+From 77b646c3aec519d0332125552e3d9607b60e09f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 13:18:12 -0500
+Subject: scsi: qedi: Fix null ref during abort handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 5777b7f0f03ce49372203b6521631f62f2810c8f ]
+
+If qedi_process_cmd_cleanup_resp finds the cmd it frees the work and sets
+list_tmf_work to NULL, so qedi_tmf_work should check if list_tmf_work is
+non-NULL when it wants to force cleanup.
+
+Link: https://lore.kernel.org/r/20210525181821.7617-20-michael.christie@oracle.com
+Reviewed-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
+index 357a0acc5ed2..b60b48f3b984 100644
+--- a/drivers/scsi/qedi/qedi_fw.c
++++ b/drivers/scsi/qedi/qedi_fw.c
+@@ -1466,7 +1466,7 @@ abort_ret:
+
+ ldel_exit:
+ spin_lock_bh(&qedi_conn->tmf_work_lock);
+- if (!qedi_cmd->list_tmf_work) {
++ if (qedi_cmd->list_tmf_work) {
+ list_del_init(&list_work->list);
+ qedi_cmd->list_tmf_work = NULL;
+ kfree(list_work);
+--
+2.30.2
+
--- /dev/null
+From 0d95b2aedea4d3870d418f6dc25e8d4689cb752d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Apr 2021 10:30:11 +0200
+Subject: scsi: scsi_dh_alua: Check for negative result value
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 7e26e3ea028740f934477ec01ba586ab033c35aa ]
+
+scsi_execute() will now return a negative error if there was an error prior
+to command submission; evaluate that instead if checking for DRIVER_ERROR.
+
+[mkp: build fix]
+
+Link: https://lore.kernel.org/r/20210427083046.31620-6-hare@suse.de
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index efd2b4312528..41e8c9e68878 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -562,12 +562,12 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ kfree(buff);
+ return SCSI_DH_OK;
+ }
+- if (!scsi_sense_valid(&sense_hdr)) {
++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) {
+ sdev_printk(KERN_INFO, sdev,
+ "%s: rtpg failed, result %d\n",
+ ALUA_DH_NAME, retval);
+ kfree(buff);
+- if (driver_byte(retval) == DRIVER_ERROR)
++ if (retval < 0)
+ return SCSI_DH_DEV_TEMP_BUSY;
+ return SCSI_DH_IO;
+ }
+@@ -789,11 +789,11 @@ static unsigned alua_stpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ retval = submit_stpg(sdev, pg->group_id, &sense_hdr);
+
+ if (retval) {
+- if (!scsi_sense_valid(&sense_hdr)) {
++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) {
+ sdev_printk(KERN_INFO, sdev,
+ "%s: stpg failed, result %d",
+ ALUA_DH_NAME, retval);
+- if (driver_byte(retval) == DRIVER_ERROR)
++ if (retval < 0)
+ return SCSI_DH_DEV_TEMP_BUSY;
+ } else {
+ sdev_printk(KERN_INFO, sdev, "%s: stpg failed\n",
+--
+2.30.2
+
--- /dev/null
+From 5dc4cf7dbd3f0251082832c54f8c823cb901c22e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 09:51:42 -0400
+Subject: selftests/powerpc: Fix "no_handler" EBB selftest
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 45677c9aebe926192e59475b35a1ff35ff2d4217 ]
+
+The "no_handler_test" in ebb selftests attempts to read the PMU
+registers twice via helper function "dump_ebb_state". First dump is
+just before closing of event and the second invocation is done after
+closing of the event. The original intention of second
+dump_ebb_state was to dump the state of registers at the end of
+the test when the counters are frozen. But this will be achieved
+with the first call itself since sample period is set to low value
+and PMU will be frozen by then. Hence patch removes the
+dump which was done before closing of the event.
+
+Reported-by: Shirisha Ganta <shirisha.ganta1@ibm.com>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com <mailto:rnsastry@linux.ibm.com>>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1621950703-1532-2-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
+index 8341d7778d5e..87630d44fb4c 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
+@@ -50,8 +50,6 @@ static int no_handler_test(void)
+
+ event_close(&event);
+
+- dump_ebb_state();
+-
+ /* The real test is that we never took an EBB at 0x0 */
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 780e42e3352ebb294e1bf17c6bc4147a5fae0a64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 10:36:14 +0800
+Subject: selftests: timers: rtcpie: skip test if default RTC device does not
+ exist
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 0d3e5a057992bdc66e4dca2ca50b77fa4a7bd90e ]
+
+This test will require /dev/rtc0, the default RTC device, or one
+specified by user to run. Since this default RTC is not guaranteed to
+exist on all of the devices, so check its existence first, otherwise
+skip this test with the kselftest skip code 4.
+
+Without this patch this test will fail like this on a s390x zVM:
+$ selftests: timers: rtcpie
+$ /dev/rtc0: No such file or directory
+not ok 1 selftests: timers: rtcpie # exit=22
+
+With this patch:
+$ selftests: timers: rtcpie
+$ Default RTC /dev/rtc0 does not exist. Test Skipped!
+not ok 9 selftests: timers: rtcpie # SKIP
+
+Fixed up change log so "With this patch" text doesn't get dropped.
+Shuah Khan <skhan@linuxfoundation.org>
+
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/timers/rtcpie.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/timers/rtcpie.c b/tools/testing/selftests/timers/rtcpie.c
+index 47b5bad1b393..4ef2184f1558 100644
+--- a/tools/testing/selftests/timers/rtcpie.c
++++ b/tools/testing/selftests/timers/rtcpie.c
+@@ -18,6 +18,8 @@
+ #include <stdlib.h>
+ #include <errno.h>
+
++#include "../kselftest.h"
++
+ /*
+ * This expects the new RTC class driver framework, working with
+ * clocks that will often not be clones of what the PC-AT had.
+@@ -35,8 +37,14 @@ int main(int argc, char **argv)
+ switch (argc) {
+ case 2:
+ rtc = argv[1];
+- /* FALLTHROUGH */
++ break;
+ case 1:
++ fd = open(default_rtc, O_RDONLY);
++ if (fd == -1) {
++ printf("Default RTC %s does not exist. Test Skipped!\n", default_rtc);
++ exit(KSFT_SKIP);
++ }
++ close(fd);
+ break;
+ default:
+ fprintf(stderr, "usage: rtctest [rtcdev] [d]\n");
+--
+2.30.2
+
tracing-do-not-reference-char-as-a-string-in-histograms.patch
pci-aardvark-don-t-rely-on-jiffies-while-holding-spinlock.patch
pci-aardvark-fix-kernel-panic-during-pio-transfer.patch
+tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch
+misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch
+revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch
+w1-ds2438-fixing-bug-that-would-always-get-page0.patch
+scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch
+scsi-lpfc-fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
+scsi-core-cap-scsi_host-cmd_per_lun-at-can_queue.patch
+alsa-ac97-fix-pm-reference-leak-in-ac97_bus_remove.patch
+tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch
+scsi-scsi_dh_alua-check-for-negative-result-value.patch
+fs-jfs-fix-missing-error-code-in-lmloginit.patch
+scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch
+scsi-iscsi-fix-conn-use-after-free-during-resets.patch
+scsi-iscsi-fix-shost-max_id-use.patch
+scsi-qedi-fix-null-ref-during-abort-handling.patch
+mfd-da9052-stmpe-add-and-modify-module_device_table.patch
+s390-sclp_vt220-fix-console-name-to-match-device.patch
+selftests-timers-rtcpie-skip-test-if-default-rtc-dev.patch
+alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch
+powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch
+gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch
+alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch
+selftests-powerpc-fix-no_handler-ebb-selftest.patch
+gpio-pca953x-add-support-for-the-on-semi-pca9655.patch
+asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch
+input-hideep-fix-the-uninitialized-use-in-hideep_nvm.patch
+alsa-bebob-add-support-for-toneweal-fw66.patch
+usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch
+usb-gadget-hid-fix-error-return-code-in-hid_bind.patch
+powerpc-boot-fixup-device-tree-on-little-endian.patch
+backlight-lm3630a-fix-return-code-of-.update_status-.patch
+alsa-hda-add-irq-check-for-platform_get_irq.patch
+staging-rtl8723bs-fix-macro-value-for-2.4ghz-only-de.patch
+intel_th-wait-until-port-is-in-reset-before-programm.patch
+i2c-core-disable-client-irq-on-reboot-shutdown.patch
+lib-decompress_unlz4.c-correctly-handle-zero-padding.patch
+pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch
+power-supply-ab8500-avoid-null-pointers.patch
+power-supply-max17042-do-not-enforce-incorrect-inter.patch
+power-reset-gpio-poweroff-add-missing-module_device_.patch
+arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch
+watchdog-fix-possible-use-after-free-in-wdt_startup.patch
+watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch
+watchdog-fix-possible-use-after-free-by-calling-del_.patch
+watchdog-itco_wdt-account-for-rebooting-on-second-ti.patch
+x86-fpu-return-proper-error-codes-from-user-access-f.patch
+pci-tegra-add-missing-module_device_table.patch
+orangefs-fix-orangefs-df-output.patch
+ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch
+nfs-nfs_find_open_context-may-only-select-open-files.patch
+power-supply-charger-manager-add-missing-module_devi.patch
+power-supply-ab8500-add-missing-module_device_table.patch
+pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch
+acpi-amba-fix-resource-name-in-proc-iomem.patch
+acpi-video-add-quirk-for-the-dell-vostro-3350.patch
+virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch
+virtio_net-fix-error-handling-in-virtnet_restore.patch
+virtio_console-assure-used-length-from-device-is-lim.patch
+f2fs-add-module_softdep-to-ensure-crc32-is-included-.patch
+pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch
+power-supply-rt5033_battery-fix-device-tree-enumerat.patch
+nfsv4-initialise-connection-to-the-server-in-nfs4_al.patch
+um-fix-error-return-code-in-slip_open.patch
+um-fix-error-return-code-in-winch_tramp.patch
+watchdog-aspeed-fix-hardware-timeout-calculation.patch
+nfs-fix-acl-memory-leak-of-posix_acl_create.patch
+ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch
+pci-iproc-fix-multi-msi-base-vector-number-allocatio.patch
+pci-iproc-support-multi-msi-only-on-uniprocessor-ker.patch
+x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch
+virtio_net-move-tx-vq-operation-under-tx-queue-lock.patch
+alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch
+nfsv4-pnfs-don-t-call-_nfs4_pnfs_v3_ds_connect-multi.patch
+hexagon-use-common-discards-macro.patch
+reset-a10sr-add-missing-of_match_table-reference.patch
+arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch
+arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-135
+arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-2800
+memory-atmel-ebi-add-missing-of_node_put-for-loop-it.patch
+rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch
+arm64-dts-renesas-v3msk-fix-memory-size.patch
+arm-dts-r8a7779-marzen-fix-du-clock-names.patch
+arm64-dts-qcom-msm8994-angler-fix-gpio-reserved-rang.patch
+arm-dts-bcm5301x-fixup-spi-binding.patch
+reset-bail-if-try_module_get-fails.patch
+memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch
+memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch
+arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch
+arm-dts-am437x-align-ti-pindir-d0-out-d1-in-property.patch
+arm-dts-imx6q-dhcom-fix-ethernet-reset-time-properti.patch
+arm-dts-imx6q-dhcom-fix-ethernet-plugin-detection-pr.patch
+arm-dts-imx6q-dhcom-add-gpios-pinctrl-for-i2c-bus-re.patch
+scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch
+mips-always-link-byteswap-helpers-into-decompressor.patch
+mips-disable-branch-profiling-in-boot-decompress.o.patch
+perf-report-fix-task-and-stat-with-pipe-input.patch
+mips-vdso-invalid-gic-access-through-vdso.patch
--- /dev/null
+From 2d7f19b6056072fd56d75fccb6445c849f6a6fb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 15:09:58 +0200
+Subject: staging: rtl8723bs: fix macro value for 2.4Ghz only device
+
+From: Fabio Aiuto <fabioaiuto83@gmail.com>
+
+[ Upstream commit 6d490a27e23c5fb79b766530016ab8665169498e ]
+
+fix IQK_Matrix_Settings_NUM macro value to 14 which is
+the max channel number value allowed in a 2.4Ghz device.
+
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
+Link: https://lore.kernel.org/r/0b4a876929949248aa18cb919da3583c65e4ee4e.1624367072.git.fabioaiuto83@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/hal/odm.h | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/staging/rtl8723bs/hal/odm.h b/drivers/staging/rtl8723bs/hal/odm.h
+index 23ab160ac2c8..ff8e22d70d4c 100644
+--- a/drivers/staging/rtl8723bs/hal/odm.h
++++ b/drivers/staging/rtl8723bs/hal/odm.h
+@@ -197,10 +197,7 @@ typedef struct _ODM_RATE_ADAPTIVE {
+
+ #define AVG_THERMAL_NUM 8
+ #define IQK_Matrix_REG_NUM 8
+-#define IQK_Matrix_Settings_NUM (14 + 24 + 21) /* Channels_2_4G_NUM
+- * + Channels_5G_20M_NUM
+- * + Channels_5G
+- */
++#define IQK_Matrix_Settings_NUM 14 /* Channels_2_4G_NUM */
+
+ #define DM_Type_ByFW 0
+ #define DM_Type_ByDriver 1
+--
+2.30.2
+
--- /dev/null
+From 98ff5c06ad0091460cf9f2d0b4b6219dc6517fc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 21:44:04 +0200
+Subject: tty: serial: 8250: serial_cs: Fix a memory leak in error handling
+ path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit fad92b11047a748c996ebd6cfb164a63814eeb2e ]
+
+In the probe function, if the final 'serial_config()' fails, 'info' is
+leaking.
+
+Add a resource handling path to free this memory.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/dc25f96b7faebf42e60fe8d02963c941cf4d8124.1621971720.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/serial_cs.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
+index ccd1a615305b..a05c2b652040 100644
+--- a/drivers/tty/serial/8250/serial_cs.c
++++ b/drivers/tty/serial/8250/serial_cs.c
+@@ -306,6 +306,7 @@ static int serial_resume(struct pcmcia_device *link)
+ static int serial_probe(struct pcmcia_device *link)
+ {
+ struct serial_info *info;
++ int ret;
+
+ dev_dbg(&link->dev, "serial_attach()\n");
+
+@@ -320,7 +321,15 @@ static int serial_probe(struct pcmcia_device *link)
+ if (do_sound)
+ link->config_flags |= CONF_ENABLE_SPKR;
+
+- return serial_config(link);
++ ret = serial_config(link);
++ if (ret)
++ goto free_info;
++
++ return 0;
++
++free_info:
++ kfree(info);
++ return ret;
+ }
+
+ static void serial_detach(struct pcmcia_device *link)
+--
+2.30.2
+
--- /dev/null
+From 32ad85becfb55367e88e17e9e30128d19ed01208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Apr 2021 10:12:26 +0800
+Subject: tty: serial: fsl_lpuart: fix the potential risk of division or modulo
+ by zero
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]
+
+We should be very careful about the register values that will be used
+for division or modulo operations, althrough the possibility that the
+UARTBAUD register value is zero is very low, but we had better to deal
+with the "bad data" of hardware in advance to avoid division or modulo
+by zero leading to undefined kernel behavior.
+
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 4b9f42269477..deb9d4fa9cb0 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1992,6 +1992,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
+
+ bd = lpuart32_read(&sport->port, UARTBAUD);
+ bd &= UARTBAUD_SBR_MASK;
++ if (!bd)
++ return;
++
+ sbr = bd;
+ uartclk = clk_get_rate(sport->clk);
+ /*
+--
+2.30.2
+
--- /dev/null
+From f6ad4914fe2faa7748a6e7ca3853f917542da59e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 16:11:03 +0800
+Subject: ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit a801fcfeef96702fa3f9b22ad56c5eb1989d9221 ]
+
+xfstests-generic/476 reports a warning message as below:
+
+WARNING: CPU: 2 PID: 30347 at fs/inode.c:361 inc_nlink+0x52/0x70
+Call Trace:
+ do_rename+0x502/0xd40 [ubifs]
+ ubifs_rename+0x8b/0x180 [ubifs]
+ vfs_rename+0x476/0x1080
+ do_renameat2+0x67c/0x7b0
+ __x64_sys_renameat2+0x6e/0x90
+ do_syscall_64+0x66/0xe0
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Following race case can cause this:
+ rename_whiteout(Thread 1) wb_workfn(Thread 2)
+ubifs_rename
+ do_rename
+ __writeback_single_inode
+ spin_lock(&inode->i_lock)
+ whiteout->i_state |= I_LINKABLE
+ inode->i_state &= ~dirty;
+---- How race happens on i_state:
+ (tmp = whiteout->i_state | I_LINKABLE)
+ (tmp = inode->i_state & ~dirty)
+ (whiteout->i_state = tmp)
+ (inode->i_state = tmp)
+----
+ spin_unlock(&inode->i_lock)
+ inc_nlink(whiteout)
+ WARN_ON(!(inode->i_state & I_LINKABLE)) !!!
+
+Fix to add i_lock to avoid i_state update race condition.
+
+Fixes: 9e0a1fff8db56ea ("ubifs: Implement RENAME_WHITEOUT")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/dir.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 8fe2ee5462a0..dbdf6a4230fb 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1354,7 +1354,10 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ goto out_release;
+ }
+
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state |= I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ whiteout_ui = ubifs_inode(whiteout);
+ whiteout_ui->data = dev;
+ whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0));
+@@ -1447,7 +1450,11 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+
+ inc_nlink(whiteout);
+ mark_inode_dirty(whiteout);
++
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state &= ~I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ iput(whiteout);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4c02e6e0900b57b52ba45f714d45539cff481256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 11:13:54 +0800
+Subject: um: fix error return code in slip_open()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit b77e81fbe5f5fb4ad9a61ec80f6d1e30b6da093a ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: a3c77c67a443 ("[PATCH] uml: slirp and slip driver cleanups and fixes")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Acked-By: anton.ivanov@cambridgegreys.com
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/slip_user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
+index 0d6b66c64a81..76d155631c5d 100644
+--- a/arch/um/drivers/slip_user.c
++++ b/arch/um/drivers/slip_user.c
+@@ -145,7 +145,8 @@ static int slip_open(void *data)
+ }
+ sfd = err;
+
+- if (set_up_tty(sfd))
++ err = set_up_tty(sfd);
++ if (err)
+ goto out_close2;
+
+ pri->slave = sfd;
+--
+2.30.2
+
--- /dev/null
+From 000520cee7fa30f14f1790c52b6edc801d0617f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 11:22:39 +0800
+Subject: um: fix error return code in winch_tramp()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit ccf1236ecac476d9d2704866d9a476c86e387971 ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 89df6bfc0405 ("uml: DEBUG_SHIRQ fixes")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Acked-By: anton.ivanov@cambridgegreys.com
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/chan_user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 9cffbbb15c56..669124d5290b 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
+ goto out_close;
+ }
+
+- if (os_set_fd_block(*fd_out, 0)) {
++ err = os_set_fd_block(*fd_out, 0);
++ if (err) {
+ printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd "
+ "non-blocking.\n");
+ goto out_close;
+--
+2.30.2
+
--- /dev/null
+From 9b757798227e48620c59ed2dc6a5849d3988cbd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 19:27:55 +0300
+Subject: usb: gadget: f_hid: fix endianness issue with descriptors
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit 33cb46c4676d01956811b68a29157ea969a5df70 ]
+
+Running sparse checker it shows warning message about
+incorrect endianness used for descriptor initialization:
+
+| f_hid.c:91:43: warning: incorrect type in initializer (different base types)
+| f_hid.c:91:43: expected restricted __le16 [usertype] bcdHID
+| f_hid.c:91:43: got int
+
+Fixing issue with cpu_to_le16() macro, however this is not a real issue
+as the value is the same both endians.
+
+Cc: Fabien Chouteau <fabien.chouteau@barco.com>
+Cc: Segiy Stetsyuk <serg_stetsuk@ukr.net>
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Link: https://lore.kernel.org/r/20210617162755.29676-1-ruslan.bilovol@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index bc0a693c3260..fa8a8e04008a 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -88,7 +88,7 @@ static struct usb_interface_descriptor hidg_interface_desc = {
+ static struct hid_descriptor hidg_desc = {
+ .bLength = sizeof hidg_desc,
+ .bDescriptorType = HID_DT_HID,
+- .bcdHID = 0x0101,
++ .bcdHID = cpu_to_le16(0x0101),
+ .bCountryCode = 0x00,
+ .bNumDescriptors = 0x1,
+ /*.desc[0].bDescriptorType = DYNAMIC */
+--
+2.30.2
+
--- /dev/null
+From 455e966745eb651ec48cfeb9eebb9e9b8a84291e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 12:38:35 +0800
+Subject: usb: gadget: hid: fix error return code in hid_bind()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 88693f770bb09c196b1eb5f06a484a254ecb9924 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210618043835.2641360-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/legacy/hid.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
+index c4eda7fe7ab4..5b27d289443f 100644
+--- a/drivers/usb/gadget/legacy/hid.c
++++ b/drivers/usb/gadget/legacy/hid.c
+@@ -171,8 +171,10 @@ static int hid_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto put;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+--
+2.30.2
+
--- /dev/null
+From 0e50d8d5012988077b5159b7f28c97d5f52de0b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:43:32 +0800
+Subject: virtio-blk: Fix memory leak among suspend/resume procedure
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit b71ba22e7c6c6b279c66f53ee7818709774efa1f ]
+
+The vblk->vqs should be freed before we call init_vqs()
+in virtblk_restore().
+
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Link: https://lore.kernel.org/r/20210517084332.280-1-xieyongji@bytedance.com
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index c2d9459ec5d1..dac1769146d7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -944,6 +944,8 @@ static int virtblk_freeze(struct virtio_device *vdev)
+ blk_mq_quiesce_queue(vblk->disk->queue);
+
+ vdev->config->del_vqs(vdev);
++ kfree(vblk->vqs);
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 07c8b39c8c0f0e4558c05b391e86a6f0b36da44f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 20:56:22 +0800
+Subject: virtio_console: Assure used length from device is limited
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ]
+
+The buf->len might come from an untrusted device. This
+ensures the value would not exceed the size of the buffer
+to avoid data corruption or loss.
+
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/virtio_console.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index ca71ee939533..cdf441942bae 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -488,7 +488,7 @@ static struct port_buffer *get_inbuf(struct port *port)
+
+ buf = virtqueue_get_buf(port->in_vq, &len);
+ if (buf) {
+- buf->len = len;
++ buf->len = min_t(size_t, len, buf->size);
+ buf->offset = 0;
+ port->stats.bytes_received += len;
+ }
+@@ -1738,7 +1738,7 @@ static void control_work_handler(struct work_struct *work)
+ while ((buf = virtqueue_get_buf(vq, &len))) {
+ spin_unlock(&portdev->c_ivq_lock);
+
+- buf->len = len;
++ buf->len = min_t(size_t, len, buf->size);
+ buf->offset = 0;
+
+ handle_control_message(vq->vdev, portdev, buf);
+--
+2.30.2
+
--- /dev/null
+From 882d891e05385c952f4c99cb7474d06f1267a07a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:45:16 +0800
+Subject: virtio_net: Fix error handling in virtnet_restore()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 3f2869cace829fb4b80fc53b3ddaa7f4ba9acbf1 ]
+
+Do some cleanups in virtnet_restore() when virtnet_cpu_notif_add() failed.
+
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Link: https://lore.kernel.org/r/20210517084516.332-1-xieyongji@bytedance.com
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 84a82c4a9535..bb11a1e30646 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3199,8 +3199,11 @@ static __maybe_unused int virtnet_restore(struct virtio_device *vdev)
+ virtnet_set_queues(vi, vi->curr_queue_pairs);
+
+ err = virtnet_cpu_notif_add(vi);
+- if (err)
++ if (err) {
++ virtnet_freeze_down(vdev);
++ remove_vq_common(vi);
+ return err;
++ }
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 24affbf6906d254a5069c04e266c99da740dc75d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 01:35:26 -0400
+Subject: virtio_net: move tx vq operation under tx queue lock
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 5a2f966d0f3fa0ef6dada7ab9eda74cacee96b8a ]
+
+It's unsafe to operate a vq from multiple threads.
+Unfortunately this is exactly what we do when invoking
+clean tx poll from rx napi.
+Same happens with napi-tx even without the
+opportunistic cleaning from the receive interrupt: that races
+with processing the vq in start_xmit.
+
+As a fix move everything that deals with the vq to under tx lock.
+
+Fixes: b92f1e6751a6 ("virtio-net: transmit napi")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index bb11a1e30646..5e8b40630286 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1506,6 +1506,8 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+ unsigned int index = vq2txq(sq->vq);
+ struct netdev_queue *txq;
++ int opaque;
++ bool done;
+
+ if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
+ /* We don't need to enable cb for XDP */
+@@ -1515,10 +1517,28 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
+
+ txq = netdev_get_tx_queue(vi->dev, index);
+ __netif_tx_lock(txq, raw_smp_processor_id());
++ virtqueue_disable_cb(sq->vq);
+ free_old_xmit_skbs(sq, true);
++
++ opaque = virtqueue_enable_cb_prepare(sq->vq);
++
++ done = napi_complete_done(napi, 0);
++
++ if (!done)
++ virtqueue_disable_cb(sq->vq);
++
+ __netif_tx_unlock(txq);
+
+- virtqueue_napi_complete(napi, sq->vq, 0);
++ if (done) {
++ if (unlikely(virtqueue_poll(sq->vq, opaque))) {
++ if (napi_schedule_prep(napi)) {
++ __netif_tx_lock(txq, raw_smp_processor_id());
++ virtqueue_disable_cb(sq->vq);
++ __netif_tx_unlock(txq);
++ __napi_schedule(napi);
++ }
++ }
++ }
+
+ if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS)
+ netif_tx_wake_queue(txq);
+--
+2.30.2
+
--- /dev/null
+From a4ff0223832bbc0b2b2e9b1654c3d01c47dc9803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 19:30:44 -0300
+Subject: w1: ds2438: fixing bug that would always get page0
+
+From: Luiz Sampaio <sampaio.ime@gmail.com>
+
+[ Upstream commit 1f5e7518f063728aee0679c5086b92d8ea429e11 ]
+
+The purpose of the w1_ds2438_get_page function is to get the register
+values at the page passed as the pageno parameter. However, the page0 was
+hardcoded, such that the function always returned the page0 contents. Fixed
+so that the function can retrieve any page.
+
+Signed-off-by: Luiz Sampaio <sampaio.ime@gmail.com>
+Link: https://lore.kernel.org/r/20210519223046.13798-5-sampaio.ime@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/slaves/w1_ds2438.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c
+index 7c4e33dbee4d..b005dda9c697 100644
+--- a/drivers/w1/slaves/w1_ds2438.c
++++ b/drivers/w1/slaves/w1_ds2438.c
+@@ -64,13 +64,13 @@ static int w1_ds2438_get_page(struct w1_slave *sl, int pageno, u8 *buf)
+ if (w1_reset_select_slave(sl))
+ continue;
+ w1_buf[0] = W1_DS2438_RECALL_MEMORY;
+- w1_buf[1] = 0x00;
++ w1_buf[1] = (u8)pageno;
+ w1_write_block(sl->master, w1_buf, 2);
+
+ if (w1_reset_select_slave(sl))
+ continue;
+ w1_buf[0] = W1_DS2438_READ_SCRATCH;
+- w1_buf[1] = 0x00;
++ w1_buf[1] = (u8)pageno;
+ w1_write_block(sl->master, w1_buf, 2);
+
+ count = w1_read_block(sl->master, buf, DS2438_PAGE_SIZE + 1);
+--
+2.30.2
+
--- /dev/null
+From 91aa360dbfc28db6b5fd2f433e6a28761b0314e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 20:42:49 -0700
+Subject: watchdog: aspeed: fix hardware timeout calculation
+
+From: Tao Ren <rentao.bupt@gmail.com>
+
+[ Upstream commit e7dc481c92060f9ce872878b0b7a08c24713a7e5 ]
+
+Fix hardware timeout calculation in aspeed_wdt_set_timeout function to
+ensure the reload value does not exceed the hardware limit.
+
+Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
+Reported-by: Amithash Prasad <amithash@fb.com>
+Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20210417034249.5978-1-rentao.bupt@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/aspeed_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
+index d84d6cbd9697..814041d4e287 100644
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -149,7 +149,7 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
+
+ wdd->timeout = timeout;
+
+- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
++ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
+
+ writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
+ writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
+--
+2.30.2
+
--- /dev/null
+From d4be2acbd971f37266275e2dd28e6097b575c5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 14:57:56 +0800
+Subject: watchdog: Fix possible use-after-free by calling del_timer_sync()
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ]
+
+This driver's remove path calls del_timer(). However, that function
+does not wait until the timer handler finishes. This means that the
+timer handler may still be running after the driver's remove function
+has finished, which would result in a use-after-free.
+
+Fix by calling del_timer_sync(), which makes sure the timer handler
+has finished, and unable to re-schedule itself.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/lpc18xx_wdt.c | 2 +-
+ drivers/watchdog/w83877f_wdt.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c
+index 331cadb459ac..48580b6406c2 100644
+--- a/drivers/watchdog/lpc18xx_wdt.c
++++ b/drivers/watchdog/lpc18xx_wdt.c
+@@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev)
+ struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev);
+
+ dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n");
+- del_timer(&lpc18xx_wdt->timer);
++ del_timer_sync(&lpc18xx_wdt->timer);
+
+ watchdog_unregister_device(&lpc18xx_wdt->wdt_dev);
+ clk_disable_unprepare(lpc18xx_wdt->wdt_clk);
+diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c
+index 05658ecc0aa4..ec4641fc2d21 100644
+--- a/drivers/watchdog/w83877f_wdt.c
++++ b/drivers/watchdog/w83877f_wdt.c
+@@ -170,7 +170,7 @@ static void wdt_startup(void)
+ static void wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+
+ wdt_change(WDT_DISABLE);
+
+--
+2.30.2
+
--- /dev/null
+From 448785f5699d3e229e105397dc72acacba9d39df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 15:01:35 +0800
+Subject: watchdog: Fix possible use-after-free in wdt_startup()
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit c08a6b31e4917034f0ed0cb457c3bb209576f542 ]
+
+This module's remove path calls del_timer(). However, that function
+does not wait until the timer handler finishes. This means that the
+timer handler may still be running after the driver's remove function
+has finished, which would result in a use-after-free.
+
+Fix by calling del_timer_sync(), which makes sure the timer handler
+has finished, and unable to re-schedule itself.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/1620716495-108352-1-git-send-email-zou_wei@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sbc60xxwdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c
+index 87333a41f753..1702df7f8c38 100644
+--- a/drivers/watchdog/sbc60xxwdt.c
++++ b/drivers/watchdog/sbc60xxwdt.c
+@@ -152,7 +152,7 @@ static void wdt_startup(void)
+ static void wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+ inb_p(wdt_stop);
+ pr_info("Watchdog timer is now disabled...\n");
+ }
+--
+2.30.2
+
--- /dev/null
+From e8de978710869e78371822bf3224151364435de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 May 2021 13:24:23 +0200
+Subject: watchdog: iTCO_wdt: Account for rebooting on second timeout
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+[ Upstream commit cb011044e34c293e139570ce5c01aed66a34345c ]
+
+This was already attempted to fix via 1fccb73011ea: If the BIOS did not
+enable TCO SMIs, the timer definitely needs to trigger twice in order to
+cause a reboot. If TCO SMIs are on, as well as SMIs in general, we can
+continue to assume that the BIOS will perform a reboot on the first
+timeout.
+
+QEMU with its ICH9 and related BIOS falls into the former category,
+currently taking twice the configured timeout in order to reboot the
+machine. For iTCO version that fall under turn_SMI_watchdog_clear_off,
+this is also true and was currently only addressed for v1, irrespective
+of the turn_SMI_watchdog_clear_off value.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/0b8bb307-d08b-41b5-696c-305cdac6789c@siemens.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/iTCO_wdt.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
+index 347f0389b089..059c9eddb546 100644
+--- a/drivers/watchdog/iTCO_wdt.c
++++ b/drivers/watchdog/iTCO_wdt.c
+@@ -75,6 +75,8 @@
+ #define TCOBASE(p) ((p)->tco_res->start)
+ /* SMI Control and Enable Register */
+ #define SMI_EN(p) ((p)->smi_res->start)
++#define TCO_EN (1 << 13)
++#define GBL_SMI_EN (1 << 0)
+
+ #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */
+ #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/
+@@ -330,8 +332,12 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
+
+ tmrval = seconds_to_ticks(p, t);
+
+- /* For TCO v1 the timer counts down twice before rebooting */
+- if (p->iTCO_version == 1)
++ /*
++ * If TCO SMIs are off, the timer counts down twice before rebooting.
++ * Otherwise, the BIOS generally reboots when the SMI triggers.
++ */
++ if (p->smi_res &&
++ (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN))
+ tmrval /= 2;
+
+ /* from the specs: */
+@@ -493,7 +499,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev)
+ * Disables TCO logic generating an SMI#
+ */
+ val32 = inl(SMI_EN(p));
+- val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */
++ val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */
+ outl(val32, SMI_EN(p));
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 03bc6db6ee12641a6e5ad08b4f7aebc8c07531ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 15:04:51 +0800
+Subject: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ]
+
+This module's remove path calls del_timer(). However, that function
+does not wait until the timer handler finishes. This means that the
+timer handler may still be running after the driver's remove function
+has finished, which would result in a use-after-free.
+
+Fix by calling del_timer_sync(), which makes sure the timer handler
+has finished, and unable to re-schedule itself.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sc520_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c
+index 6aadb56e7faa..809ebcaef51d 100644
+--- a/drivers/watchdog/sc520_wdt.c
++++ b/drivers/watchdog/sc520_wdt.c
+@@ -190,7 +190,7 @@ static int wdt_startup(void)
+ static int wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+
+ /* Stop the watchdog */
+ wdt_config(0);
+--
+2.30.2
+
--- /dev/null
+From 31047b68412ac4b4e74b4e30aeab4f903567652d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jun 2021 14:01:35 +0200
+Subject: x86/fpu: Limit xstate copy size in xstateregs_set()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 07d6688b22e09be465652cf2da0da6bf86154df6 ]
+
+If the count argument is larger than the xstate size, this will happily
+copy beyond the end of xstate.
+
+Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@kernel.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20210623121452.120741557@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/regset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c
+index bc02f5144b95..621d249ded0b 100644
+--- a/arch/x86/kernel/fpu/regset.c
++++ b/arch/x86/kernel/fpu/regset.c
+@@ -128,7 +128,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * A whole standard-format XSAVE buffer is needed:
+ */
+- if ((pos != 0) || (count < fpu_user_xstate_size))
++ if (pos != 0 || count != fpu_user_xstate_size)
+ return -EFAULT;
+
+ xsave = &fpu->state.xsave;
+--
+2.30.2
+
--- /dev/null
+From f6403bb087e41e9ad4abb2d352e15a1e3d193777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jun 2021 14:02:30 +0200
+Subject: x86/fpu: Return proper error codes from user access functions
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit aee8c67a4faa40a8df4e79316dbfc92d123989c1 ]
+
+When *RSTOR from user memory raises an exception, there is no way to
+differentiate them. That's bad because it forces the slow path even when
+the failure was not a fault. If the operation raised eg. #GP then going
+through the slow path is pointless.
+
+Use _ASM_EXTABLE_FAULT() which stores the trap number and let the exception
+fixup return the negated trap number as error.
+
+This allows to separate the fast path and let it handle faults directly and
+avoid the slow path for all other exceptions.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20210623121457.601480369@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/fpu/internal.h | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
+index fa2c93cb42a2..b8c935033d21 100644
+--- a/arch/x86/include/asm/fpu/internal.h
++++ b/arch/x86/include/asm/fpu/internal.h
+@@ -103,6 +103,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx)
+ }
+ extern void fpstate_sanitize_xstate(struct fpu *fpu);
+
++/* Returns 0 or the negated trap number, which results in -EFAULT for #PF */
+ #define user_insn(insn, output, input...) \
+ ({ \
+ int err; \
+@@ -110,14 +111,14 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
+ might_fault(); \
+ \
+ asm volatile(ASM_STAC "\n" \
+- "1:" #insn "\n\t" \
++ "1: " #insn "\n" \
+ "2: " ASM_CLAC "\n" \
+ ".section .fixup,\"ax\"\n" \
+- "3: movl $-1,%[err]\n" \
++ "3: negl %%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+- _ASM_EXTABLE(1b, 3b) \
+- : [err] "=r" (err), output \
++ _ASM_EXTABLE_FAULT(1b, 3b) \
++ : [err] "=a" (err), output \
+ : "0"(0), input); \
+ err; \
+ })
+@@ -221,16 +222,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
+ #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f"
+ #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f"
+
++/*
++ * After this @err contains 0 on success or the negated trap number when
++ * the operation raises an exception. For faults this results in -EFAULT.
++ */
+ #define XSTATE_OP(op, st, lmask, hmask, err) \
+ asm volatile("1:" op "\n\t" \
+ "xor %[err], %[err]\n" \
+ "2:\n\t" \
+ ".pushsection .fixup,\"ax\"\n\t" \
+- "3: movl $-2,%[err]\n\t" \
++ "3: negl %%eax\n\t" \
+ "jmp 2b\n\t" \
+ ".popsection\n\t" \
+- _ASM_EXTABLE(1b, 3b) \
+- : [err] "=r" (err) \
++ _ASM_EXTABLE_FAULT(1b, 3b) \
++ : [err] "=a" (err) \
+ : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \
+ : "memory")
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
