--- /dev/null
+From 062587d99d4ce458dc7a8efcb765c56b761c0d78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:13:20 -0300
+Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]
+
+The SPI chip selects are represented as:
+
+cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;
+
+, which means that they are used in GPIO function instead of native
+SPI mode.
+
+Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
+the native CSPI_SSI function.
+
+Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index a25da415cb02e..907339bc81e54 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -59,7 +59,7 @@
+ MX50_PAD_CSPI_MISO__CSPI_MISO 0x00
+ MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00
+ MX50_PAD_CSPI_SS0__GPIO4_11 0xc4
+- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4
++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84
+ >;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 6f5a77a7d0f944725fdc1d0c7a4cd276b4d21dd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 23:11:20 +0300
+Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]
+
+Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
+modes. Adapt imx6q-udoo board phy settings : explicitly set required
+delay configuration using "rgmii-id".
+
+Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index 776bfc77f89d0..16672cbada287 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -98,7 +98,7 @@
+ &fec {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 4653e2d84eb2e4fab24297d5abd42f1b7c30ecd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:07 +0800
+Subject: ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e76724153f5b4539802cc21b2c6131058668a1c6 ]
+
+The Ethernet PHY on the A31 Hummingbird has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: c220aec2bb79 ("ARM: dts: sun6i: Add Merrii A31 Hummingbird support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-2-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun6i-a31-hummingbird.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+index 049e6ab3cf56c..73de34ae37fdc 100644
+--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
++++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+@@ -154,7 +154,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 4afa28ef01a41c9c9573ef3a5cdc755a21430e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:09 +0800
+Subject: ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit f94f78bd93f567c022f594589dbeecdf59931365 ]
+
+The Ethernet PHY on the Bananapi M1+ has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 04c85ecad32a ("ARM: dts: sun7i: Add dts file for Bananapi M1 Plus board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-4-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+index 32d5d45a35c03..8945dbb114a2a 100644
+--- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
++++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+@@ -130,7 +130,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_gmac_3v3>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 3072f0492d9af4e839a918f5d6d8fe5c56871739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:08 +0800
+Subject: ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 353c3de1303fc93032164402c0eb8550ecd6f154 ]
+
+The Ethernet PHY on the Cubietruck has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 67073d97672d ("ARM: dts: sun7i: cubietruck: Enable the GMAC")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Emilio López <emilio@elopez.com.ar>
+Reviewed-by: Emilio López <emilio@elopez.com.ar>
+Link: https://lore.kernel.org/r/20201024162515.30032-3-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-cubietruck.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
+index 8c8dee6ea461a..9109ca0919ade 100644
+--- a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
++++ b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
+@@ -151,7 +151,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From be64e778a488fee3a7c1a7751fadbe22ddef3d84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:11 +0800
+Subject: ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 57dbe558457bf4042169bc1f334e3b53a8480a1c ]
+
+The Ethernet PHY on the Bananapi M3 and Cubietruck Plus have the RX
+and TX delays enabled on the PHY, using pull-ups on the RXDLY and
+TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 039359948a4b ("ARM: dts: sun8i: a83t: Enable Ethernet on two boards")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-6-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +-
+ arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+index 9d34eabba1213..431f70234d364 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+@@ -131,7 +131,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_sw>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ allwinner,rx-delay-ps = <700>;
+ allwinner,tx-delay-ps = <700>;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index d9be511f054f0..d8326a5c681d4 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -183,7 +183,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_dldo4>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From b530fcc347a7402bc6dfa38c2b48cf2be4d5f2d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:10 +0800
+Subject: ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e080ab31a0aa126b0a7e4f67f2b01b371b852c88 ]
+
+The Ethernet PHY on the Orange Pi Plus 2E has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Fixes: 7a78ef92cdc5 ("ARM: sun8i: h3: Enable EMAC with external PHY on Orange Pi Plus 2E")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-5-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+index 6dbf7b2e0c13c..b6ca45d18e511 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+@@ -67,7 +67,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From c40ee9109aeec5aa2e3cb061f9991ba625b0e598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 09:19:49 +0100
+Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit b3eec3212e66ece33f69be0de98d54e67834e798 ]
+
+Ethernet PHY on BananaPi M2 Ultra provides RX and TX delays. Fix
+ethernet node to reflect that fact.
+
+Fixes: c36fd5a48bd2 ("ARM: dts: sun8i: r40: bananapi-m2-ultra: Enable GMAC ethernet controller")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201025081949.783443-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index ea15073f0c79c..7db89500f399c 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -129,7 +129,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 8eb698c30f59edcedfc4cbc147b287481aa60c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:12 +0800
+Subject: ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit b1064037e8ecf09d587b7b4966eebe0c362908e5 ]
+
+The Ethernet PHY on the Cubieboard 4 and A80 Optimus have the RX
+and TX delays enabled on the PHY, using pull-ups on the RXDLY and
+TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 98048143b7f8 ("ARM: dts: sun9i: cubieboard4: Enable GMAC")
+Fixes: bc9bd03a44f9 ("ARM: dts: sun9i: a80-optimus: Enable GMAC")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-7-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 2 +-
+ arch/arm/boot/dts/sun9i-a80-optimus.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+index d3b337b043a15..484b93df20cb6 100644
+--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
++++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+@@ -129,7 +129,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_cldo1>;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+index bbc6335e56314..5c3580d712e40 100644
+--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
++++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+@@ -124,7 +124,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_cldo1>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 890f0bfc127a79ade11ceb8daa92b91b2e426139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:13 +0800
+Subject: ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3914160ffc0bf762d6d605d4b27036b7b89367ea ]
+
+The Ethernet PHY on the Bananapi M2+ has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 8c7ba536e709 ("ARM: sun8i: bananapi-m2-plus: Enable dwmac-sun8i")
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Fixes: aa8fee415f46 ("ARM: dts: sun8i: h3: Split out non-SoC-specific parts of Bananapi M2 Plus")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-8-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
+index 39263e74fbb53..8e5cb3b3fd686 100644
+--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
+@@ -126,7 +126,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 2c921b52a2a66ea33fbc26331a1d5e1fac2a4675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:15 +0800
+Subject: arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on
+ PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 1a9a8910b2153cd3c4f3f2f8defcb853ead3b1fd ]
+
+The Ethernet PHY on the Bananapi M64 has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: e7295499903d ("arm64: allwinner: bananapi-m64: Enable dwmac-sun8i")
+Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-10-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 208373efee494..7d1e89e5b1ae4 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -127,7 +127,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From 5df961d16ebb2f6acd6e3d6efa0b787f9e9cdda3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 20:58:39 +0200
+Subject: arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit d7cdff444579e6659459b2fe04340ebb27628d5e ]
+
+RX/TX delay on OrangePi Win board is set on PHY. Reflect that in
+ethernet node.
+
+Fixes: 93d6a27cfcc0 ("arm64: dts: allwinner: a64: Orange Pi Win: Add Ethernet node")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201022185839.2779245-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+index 04446e4716c44..a0db02504b69e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+@@ -129,7 +129,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_gmac_3v3>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From b16c7790a7f3efeff25f72fe86b6a46a75877f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 23:13:01 +0200
+Subject: arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 927f42fcc1b4f7d04a2ac5cf02f25612aa8923a4 ]
+
+According to board schematic, PHY provides both, RX and TX delays.
+However, according to "fix" Realtek provided for this board, only TX
+delay should be provided by PHY.
+Tests show that both variants work but TX only PHY delay works
+slightly better.
+
+Update ethernet node to reflect the fact that PHY provides TX delay.
+
+Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201022211301.3548422-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index d5b6e8159a335..5d0905f0f1c1d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -52,7 +52,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-txid";
+ phy-handle = <&ext_rgmii_phy>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From a0fbde361801739afd53f8296819406b72b0eb59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Oct 2020 19:24:09 +0200
+Subject: arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Péron <peron.clem@gmail.com>
+
+[ Upstream commit 97a38c1c213b162aa577299de698f39c18ba696b ]
+
+Before the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the software overwrite for RX/TX delays of the RTL8211e
+were not working properly and the Beelink GS1 had both RX/TX delay of RGMII
+interface set using pull-up on the TXDLY and RXDLY pins.
+
+Now that these delays are working properly they overwrite the HW
+config and set this to 'rgmii' meaning no delay on both RX/TX.
+This makes the ethernet of this board not working anymore.
+
+Set the phy-mode to 'rgmii-id' meaning RGMII with RX/TX delays
+in the device-tree to keep the correct configuration.
+
+Fixes: 089bee8dd119 ("arm64: dts: allwinner: h6: Introduce Beelink GS1 board")
+Signed-off-by: Clément Péron <peron.clem@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201018172409.1754775-1-peron.clem@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+index 1d05d570142fa..0a04730960fcb 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+@@ -83,7 +83,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ext_rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_aldo2>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From 423a25a529dc070aee0eae56563fff9fd2db7130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 20:48:58 +0200
+Subject: arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit b34bf9f6a623ddb82600a5ed5c644224122395e1 ]
+
+RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
+node.
+
+Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201023184858.3272918-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+index e126c1c9f05ce..4d357b81b0c00 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+@@ -157,7 +157,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From e9fbbd75d040092d729cbe8e613c1be4420ba494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 12:58:17 +0100
+Subject: arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
+
+From: Nenad Peric <nperic@gmail.com>
+
+[ Upstream commit 107954afc5df667da438644aa4982606663f9b17 ]
+
+RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
+node.
+
+Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
+Signed-off-by: Nenad Peric <nperic@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201028115817.68113-1-nperic@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+index d9b3ed257088a..f10340339007f 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+@@ -164,7 +164,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From a7008b6548874be31e32a5cf2d9b4dfad65accb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:34:49 +0000
+Subject: arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 419c65f5000a6c25597ea52488528d75b287cbd0 ]
+
+Since commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"),
+the network is unusable on PineH64 model A.
+
+This is due to phy-mode incorrectly set to rgmii instead of rgmii-id.
+
+Fixes: 729e1ffcf47e ("arm64: allwinner: h6: add support for the Ethernet on Pine H64")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201019063449.33316-1-clabbe@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+index 30102daf83cc6..3f2882b36616d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+@@ -66,7 +66,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ext_rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_aldo2>;
+ allwinner,rx-delay-ps = <200>;
+--
+2.27.0
+
--- /dev/null
+From e8ffcd073c50768cb264ddf724a19c627b213f72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:06:12 +0100
+Subject: arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit d19d2152ca055baf20339cfacbf039c2cfb8d936 ]
+
+The datasheet for both the industrial and consumer variant of the
+SoC lists a typical voltage of 0.95V for the 1.6GHz CPU operating
+point.
+
+Fixes: e85c9d0faa75 (arm64: dts: imx8mm: Add cpufreq properties)
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index fde1849d36ca5..7b178a77cc712 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -126,7 +126,7 @@
+
+ opp-1600000000 {
+ opp-hz = /bits/ 64 <1600000000>;
+- opp-microvolt = <900000>;
++ opp-microvolt = <950000>;
+ opp-supported-hw = <0xc>, <0x7>;
+ clock-latency-ns = <150000>;
+ opp-suspend;
+--
+2.27.0
+
--- /dev/null
+From 62988588049033eb25c65d813f1568076ba5efaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 13:33:00 -0500
+Subject: arm64: dts imx8mn: Remove non-existent USB OTG2
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit cf5abb0132193767c07c83e06f91b777d22ba495 ]
+
+According to the i.MX8MN TRM, there is only one OTG port. The
+address for OTG2 is reserved on Nano.
+
+This patch removes the non-existent OTG2, usbphynop2, and the usbmisc2
+nodes.
+
+Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 30 -----------------------
+ 1 file changed, 30 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index ac3a3b333efa6..546511b373d43 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -677,28 +677,6 @@
+ #index-cells = <1>;
+ reg = <0x32e40200 0x200>;
+ };
+-
+- usbotg2: usb@32e50000 {
+- compatible = "fsl,imx8mn-usb", "fsl,imx7d-usb";
+- reg = <0x32e50000 0x200>;
+- interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MN_CLK_USB1_CTRL_ROOT>;
+- clock-names = "usb1_ctrl_root_clk";
+- assigned-clocks = <&clk IMX8MN_CLK_USB_BUS>,
+- <&clk IMX8MN_CLK_USB_CORE_REF>;
+- assigned-clock-parents = <&clk IMX8MN_SYS_PLL2_500M>,
+- <&clk IMX8MN_SYS_PLL1_100M>;
+- fsl,usbphy = <&usbphynop2>;
+- fsl,usbmisc = <&usbmisc2 0>;
+- status = "disabled";
+- };
+-
+- usbmisc2: usbmisc@32e50200 {
+- compatible = "fsl,imx8mn-usbmisc", "fsl,imx7d-usbmisc";
+- #index-cells = <1>;
+- reg = <0x32e50200 0x200>;
+- };
+-
+ };
+
+ dma_apbh: dma-controller@33000000 {
+@@ -747,12 +725,4 @@
+ assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
+ clock-names = "main_clk";
+ };
+-
+- usbphynop2: usbphynop2 {
+- compatible = "usb-nop-xceiv";
+- clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
+- assigned-clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
+- assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
+- clock-names = "main_clk";
+- };
+ };
+--
+2.27.0
+
--- /dev/null
+From 04d4eecccd9fc805c2a5379976d8a1d6105581f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 10:26:50 +0530
+Subject: ASoC: qcom: lpass-platform: Fix memory leak
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ]
+
+lpass_pcm_data is not freed in error paths. Free it in
+error paths to avoid memory leak.
+
+Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-platform.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 9acaef81dd74c..b1981d84ac18c 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -73,8 +73,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ else
+ dma_ch = 0;
+
+- if (dma_ch < 0)
++ if (dma_ch < 0) {
++ kfree(data);
+ return dma_ch;
++ }
+
+ drvdata->substream[dma_ch] = substream;
+
+@@ -95,6 +97,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ ret = snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+ if (ret < 0) {
++ kfree(data);
+ dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
+ ret);
+ return -EINVAL;
+--
+2.27.0
+
--- /dev/null
+From fd9b7d8410224d8966b674fbda42cd1e223f024b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:46 -0800
+Subject: bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to
+ self
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 6fa9201a898983da731fca068bb4b5c941537588 ]
+
+If a socket redirects to itself and it is under memory pressure it is
+possible to get a socket stuck so that recv() returns EAGAIN and the
+socket can not advance for some time. This happens because when
+redirecting a skb to the same socket we received the skb on we first
+check if it is OK to enqueue the skb on the receiving socket by checking
+memory limits. But, if the skb is itself the object holding the memory
+needed to enqueue the skb we will keep retrying from kernel side
+and always fail with EAGAIN. Then userspace will get a recv() EAGAIN
+error if there are no skbs in the psock ingress queue. This will continue
+until either some skbs get kfree'd causing the memory pressure to
+reduce far enough that we can enqueue the pending packet or the
+socket is destroyed. In some cases its possible to get a socket
+stuck for a noticeable amount of time if the socket is only receiving
+skbs from sk_skb verdict programs. To reproduce I make the socket
+memory limits ridiculously low so sockets are always under memory
+pressure. More often though if under memory pressure it looks like
+a spurious EAGAIN error on user space side causing userspace to retry
+and typically enough has moved on the memory side that it works.
+
+To fix skip memory checks and skb_orphan if receiving on the same
+sock as already assigned.
+
+For SK_PASS cases this is easy, its always the same socket so we
+can just omit the orphan/set_owner pair.
+
+For backlog cases we need to check skb->sk and decide if the orphan
+and set_owner pair are needed.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556572660.73229.12566203819812939627.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 72 +++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 53 insertions(+), 19 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index ddb1b7d94c998..17cc1edd149cb 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -399,38 +399,38 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
+
+-static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
++static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
++ struct sk_buff *skb)
+ {
+- struct sock *sk = psock->sk;
+- int copied = 0, num_sge;
+ struct sk_msg *msg;
+
+ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
+- return -EAGAIN;
++ return NULL;
++
++ if (!sk_rmem_schedule(sk, skb, skb->truesize))
++ return NULL;
+
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+- return -EAGAIN;
+- if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
+- kfree(msg);
+- return -EAGAIN;
+- }
++ return NULL;
+
+ sk_msg_init(msg);
+- num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
++ return msg;
++}
++
++static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
++ struct sk_psock *psock,
++ struct sock *sk,
++ struct sk_msg *msg)
++{
++ int num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
++ int copied;
++
+ if (unlikely(num_sge < 0)) {
+ kfree(msg);
+ return num_sge;
+ }
+
+- /* This will transition ownership of the data from the socket where
+- * the BPF program was run initiating the redirect to the socket
+- * we will eventually receive this data on. The data will be released
+- * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
+- * into user buffers.
+- */
+- skb_set_owner_r(skb, sk);
+-
+ copied = skb->len;
+ msg->sg.start = 0;
+ msg->sg.size = copied;
+@@ -442,6 +442,40 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ return copied;
+ }
+
++static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
++{
++ struct sock *sk = psock->sk;
++ struct sk_msg *msg;
++
++ msg = sk_psock_create_ingress_msg(sk, skb);
++ if (!msg)
++ return -EAGAIN;
++
++ /* This will transition ownership of the data from the socket where
++ * the BPF program was run initiating the redirect to the socket
++ * we will eventually receive this data on. The data will be released
++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
++ * into user buffers.
++ */
++ skb_set_owner_r(skb, sk);
++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
++}
++
++/* Puts an skb on the ingress queue of the socket already assigned to the
++ * skb. In this case we do not need to check memory limits or skb_set_owner_r
++ * because the skb is already accounted for here.
++ */
++static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb)
++{
++ struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
++ struct sock *sk = psock->sk;
++
++ if (unlikely(!msg))
++ return -EAGAIN;
++ sk_msg_init(msg);
++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
++}
++
+ static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
+ u32 off, u32 len, bool ingress)
+ {
+@@ -787,7 +821,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ * retrying later from workqueue.
+ */
+ if (skb_queue_empty(&psock->ingress_skb)) {
+- err = sk_psock_skb_ingress(psock, skb);
++ err = sk_psock_skb_ingress_self(psock, skb);
+ }
+ if (err < 0) {
+ skb_queue_tail(&psock->ingress_skb, skb);
+--
+2.27.0
+
--- /dev/null
+From 7e9757f6f68d2f636139adafbdac0faed9a45f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:06 -0800
+Subject: bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 36cd0e696a832a00247fca522034703566ac8885 ]
+
+Fix sockmap sk_skb programs so that they observe sk_rcvbuf limits. This
+allows users to tune SO_RCVBUF and sockmap will honor them.
+
+We can refactor the if(charge) case out in later patches. But, keep this
+fix to the point.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556568657.73229.8404601585878439060.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 20 ++++++++++++++++----
+ net/ipv4/tcp_bpf.c | 3 ++-
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 118cf1ace43a6..1f8e3445cd2f0 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -170,10 +170,12 @@ static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
+ struct scatterlist *sge = sk_msg_elem(msg, i);
+ u32 len = sge->length;
+
+- if (charge)
+- sk_mem_uncharge(sk, len);
+- if (!msg->skb)
++ /* When the skb owns the memory we free it from consume_skb path. */
++ if (!msg->skb) {
++ if (charge)
++ sk_mem_uncharge(sk, len);
+ put_page(sg_page(sge));
++ }
+ memset(sge, 0, sizeof(*sge));
+ return len;
+ }
+@@ -403,6 +405,9 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ int copied = 0, num_sge;
+ struct sk_msg *msg;
+
++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
++ return -EAGAIN;
++
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+ return -EAGAIN;
+@@ -418,7 +423,14 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ return num_sge;
+ }
+
+- sk_mem_charge(sk, skb->len);
++ /* This will transition ownership of the data from the socket where
++ * the BPF program was run initiating the redirect to the socket
++ * we will eventually receive this data on. The data will be released
++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
++ * into user buffers.
++ */
++ skb_set_owner_r(skb, sk);
++
+ copied = skb->len;
+ msg->sg.start = 0;
+ msg->sg.size = copied;
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index efd098b00104b..819255ee4e42d 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -77,7 +77,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ if (likely(!peek)) {
+ sge->offset += copy;
+ sge->length -= copy;
+- sk_mem_uncharge(sk, copy);
++ if (!msg_rx->skb)
++ sk_mem_uncharge(sk, copy);
+ msg_rx->sg.size -= copy;
+
+ if (!sge->length) {
+--
+2.27.0
+
--- /dev/null
+From 071e5c00797910205478650e744069b779407cc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:27:46 -0800
+Subject: bpf, sockmap: Fix partial copy_page_to_iter so progress can still be
+ made
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit c9c89dcd872ea33327673fcb97398993a1f22736 ]
+
+If copy_page_to_iter() fails or even partially completes, but with fewer
+bytes copied than expected we currently reset sg.start and return EFAULT.
+This proves problematic if we already copied data into the user buffer
+before we return an error. Because we leave the copied data in the user
+buffer and fail to unwind the scatterlist so kernel side believes data
+has been copied and user side believes data has _not_ been received.
+
+Expected behavior should be to return number of bytes copied and then
+on the next read we need to return the error assuming its still there. This
+can happen if we have a copy length spanning multiple scatterlist elements
+and one or more complete before the error is hit.
+
+The error is rare enough though that my normal testing with server side
+programs, such as nginx, httpd, envoy, etc., I have never seen this. The
+only reliable way to reproduce that I've found is to stream movies over
+my browser for a day or so and wait for it to hang. Not very scientific,
+but with a few extra WARN_ON()s in the code the bug was obvious.
+
+When we review the errors from copy_page_to_iter() it seems we are hitting
+a page fault from copy_page_to_iter_iovec() where the code checks
+fault_in_pages_writeable(buf, copy) where buf is the user buffer. It
+also seems typical server applications don't hit this case.
+
+The other way to try and reproduce this is run the sockmap selftest tool
+test_sockmap with data verification enabled, but it doesn't reproduce the
+fault. Perhaps we can trigger this case artificially somehow from the
+test tools. I haven't sorted out a way to do that yet though.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556566659.73229.15694973114605301063.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index ad9f382027311..efd098b00104b 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -47,8 +47,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ {
+ struct iov_iter *iter = &msg->msg_iter;
+ int peek = flags & MSG_PEEK;
+- int i, ret, copied = 0;
+ struct sk_msg *msg_rx;
++ int i, copied = 0;
+
+ msg_rx = list_first_entry_or_null(&psock->ingress_msg,
+ struct sk_msg, list);
+@@ -69,11 +69,9 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ page = sg_page(sge);
+ if (copied + copy > len)
+ copy = len - copied;
+- ret = copy_page_to_iter(page, sge->offset, copy, iter);
+- if (ret != copy) {
+- msg_rx->sg.start = i;
+- return -EFAULT;
+- }
++ copy = copy_page_to_iter(page, sge->offset, copy, iter);
++ if (!copy)
++ return copied ? copied : -EFAULT;
+
+ copied += copy;
+ if (likely(!peek)) {
+@@ -88,6 +86,11 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ put_page(page);
+ }
+ } else {
++ /* Lets not optimize peek case if copy_page_to_iter
++ * didn't copy the entire length lets just break.
++ */
++ if (copy != sge->length)
++ return copied;
+ sk_msg_iter_var_next(i);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From b574b088aa19b0d5c99f15f224f2160b646eb8c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 11:36:37 -0700
+Subject: bpf, sockmap: On receive programs try to fast track SK_PASS ingress
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 9ecbfb06a078c4911fb444203e8e41d93d22f886 ]
+
+When we receive an skb and the ingress skb verdict program returns
+SK_PASS we currently set the ingress flag and put it on the workqueue
+so it can be turned into a sk_msg and put on the sk_msg ingress queue.
+Then finally telling userspace with data_ready hook.
+
+Here we observe that if the workqueue is empty then we can try to
+convert into a sk_msg type and call data_ready directly without
+bouncing through a workqueue. Its a common pattern to have a recv
+verdict program for visibility that always returns SK_PASS. In this
+case unless there is an ENOMEM error or we overrun the socket we
+can avoid the workqueue completely only using it when we fall back
+to error cases caused by memory pressure.
+
+By doing this we eliminate another case where data may be dropped
+if errors occur on memory limits in workqueue.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/160226859704.5692.12929678876744977669.stgit@john-Precision-5820-Tower
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 605c48df7eb68..4fad59ee3df0b 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -767,6 +767,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ {
+ struct tcp_skb_cb *tcp;
+ struct sock *sk_other;
++ int err = -EIO;
+
+ switch (verdict) {
+ case __SK_PASS:
+@@ -778,8 +779,20 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+
+ tcp = TCP_SKB_CB(skb);
+ tcp->bpf.flags |= BPF_F_INGRESS;
+- skb_queue_tail(&psock->ingress_skb, skb);
+- schedule_work(&psock->work);
++
++ /* If the queue is empty then we can submit directly
++ * into the msg queue. If its not empty we have to
++ * queue work otherwise we may get OOO data. Otherwise,
++ * if sk_psock_skb_ingress errors will be handled by
++ * retrying later from workqueue.
++ */
++ if (skb_queue_empty(&psock->ingress_skb)) {
++ err = sk_psock_skb_ingress(psock, skb);
++ }
++ if (err < 0) {
++ skb_queue_tail(&psock->ingress_skb, skb);
++ schedule_work(&psock->work);
++ }
+ break;
+ case __SK_REDIRECT:
+ sk_psock_skb_redirect(skb);
+--
+2.27.0
+
--- /dev/null
+From 5777af3e9a3482f18d94cc389dee6b22926f9d6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 11:36:16 -0700
+Subject: bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit cfea28f890cf292d5fe90680db64b68086ef25ba ]
+
+For sk_skb case where skb_verdict program returns SK_PASS to continue to
+pass packet up the stack, the memory limits were already checked before
+enqueuing in skb_queue_tail from TCP side. So, lets remove the extra checks
+here. The theory is if the TCP stack believes we have memory to receive
+the packet then lets trust the stack and not double check the limits.
+
+In fact the accounting here can cause a drop if sk_rmem_alloc has increased
+after the stack accepted this packet, but before the duplicate check here.
+And worse if this happens because TCP stack already believes the data has
+been received there is no retransmit.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/160226857664.5692.668205469388498375.stgit@john-Precision-5820-Tower
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 1f8e3445cd2f0..605c48df7eb68 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -765,6 +765,7 @@ EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
+ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ struct sk_buff *skb, int verdict)
+ {
++ struct tcp_skb_cb *tcp;
+ struct sock *sk_other;
+
+ switch (verdict) {
+@@ -774,16 +775,12 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
+ goto out_free;
+ }
+- if (atomic_read(&sk_other->sk_rmem_alloc) <=
+- sk_other->sk_rcvbuf) {
+- struct tcp_skb_cb *tcp = TCP_SKB_CB(skb);
+
+- tcp->bpf.flags |= BPF_F_INGRESS;
+- skb_queue_tail(&psock->ingress_skb, skb);
+- schedule_work(&psock->work);
+- break;
+- }
+- goto out_free;
++ tcp = TCP_SKB_CB(skb);
++ tcp->bpf.flags |= BPF_F_INGRESS;
++ skb_queue_tail(&psock->ingress_skb, skb);
++ schedule_work(&psock->work);
++ break;
+ case __SK_REDIRECT:
+ sk_psock_skb_redirect(skb);
+ break;
+--
+2.27.0
+
--- /dev/null
+From d3feba5f1f010901d2ba3485b6157ef7923b33da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:26 -0800
+Subject: bpf, sockmap: Use truesize with sk_rmem_schedule()
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 70796fb751f1d34cc650e640572a174faf009cd4 ]
+
+We use skb->size with sk_rmem_scheduled() which is not correct. Instead
+use truesize to align with socket and tcp stack usage of sk_rmem_schedule.
+
+Suggested-by: Daniel Borkman <daniel@iogearbox.net>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556570616.73229.17003722112077507863.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 4fad59ee3df0b..ddb1b7d94c998 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -411,7 +411,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+ return -EAGAIN;
+- if (!sk_rmem_schedule(sk, skb, skb->len)) {
++ if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
+ kfree(msg);
+ return -EAGAIN;
+ }
+--
+2.27.0
+
--- /dev/null
+From 9936de8c802af838cf0639a0433b85e6e4b9c3a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:05 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ can_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ]
+
+In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 128d37a4c2e0b..09d2329719c17 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -675,16 +675,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
+- cfd->len > CAN_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CAN_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+--
+2.27.0
+
--- /dev/null
+From e9b69db061a6e80fc562466ec9d45bd3847577f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:06 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ canfd_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ]
+
+In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 09d2329719c17..fd6ef6d26846f 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -701,16 +701,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
+- cfd->len > CANFD_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ /* af_can protocol functions */
+--
+2.27.0
+
--- /dev/null
+From 22490f074f56db158179721e6aeab1b3797373e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 21:51:47 +0000
+Subject: can: dev: can_restart(): post buffer from the right context
+
+From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+
+[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]
+
+netif_rx() is meant to be called from interrupt contexts. can_restart() may be
+called by can_restart_work(), which is called from a worqueue, so it may run in
+process context. Use netif_rx_ni() instead.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
+[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 448d1548cca39..5b8791135de13 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -567,7 +567,7 @@ static void can_restart(struct net_device *dev)
+ }
+ cf->can_id |= CAN_ERR_RESTARTED;
+
+- netif_rx(skb);
++ netif_rx_ni(skb);
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+--
+2.27.0
+
--- /dev/null
+From e998799ed7f52213cd2e5960e3e0a0f86abd42aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:30:00 +0800
+Subject: can: flexcan: fix failure handling of pm_runtime_get_sync()
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b7ee5bc3e1006433601a058a6a7c24c5272635f4 ]
+
+pm_runtime_get_sync() will increment pm usage at first and it will resume the
+device later. If runtime of the device has error or device is in inaccessible
+state(or other error state), resume operation will fail. If we do not call put
+operation to decrease the reference, it will result in reference leak in the
+two functions flexcan_get_berr_counter() and flexcan_open().
+
+Moreover, this device cannot enter the idle state and always stay busy or other
+non-idle state later. So we should fix it through adding
+pm_runtime_put_noidle().
+
+Fixes: ca10989632d88 ("can: flexcan: implement can Runtime PM")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201108083000.2599705-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 130f3022d3396..b22cd8d14716a 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -614,8 +614,10 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
+ int err;
+
+ err = pm_runtime_get_sync(priv->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_noidle(priv->dev);
+ return err;
++ }
+
+ err = __flexcan_get_berr_counter(dev, bec);
+
+@@ -1282,8 +1284,10 @@ static int flexcan_open(struct net_device *dev)
+ int err;
+
+ err = pm_runtime_get_sync(priv->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_noidle(priv->dev);
+ return err;
++ }
+
+ err = open_candev(dev);
+ if (err)
+--
+2.27.0
+
--- /dev/null
+From b117071bcbc907a3b09286c327e592322f048420 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 16:01:48 +0100
+Subject: can: flexcan: flexcan_chip_start(): fix erroneous
+ flexcan_transceiver_enable() during bus-off recovery
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit cd9f13c59461351d7a5fd07924264fb49b287359 ]
+
+If the CAN controller goes into bus off, the do_set_mode() callback with
+CAN_MODE_START can be used to recover the controller, which then calls
+flexcan_chip_start(). If configured, this is done automatically by the
+framework or manually by the user.
+
+In flexcan_chip_start() there is an explicit call to
+flexcan_transceiver_enable(), which does a regulator_enable() on the
+transceiver regulator. This results in a net usage counter increase, as there
+is no corresponding flexcan_transceiver_disable() in the bus off code path.
+This further leads to the transceiver stuck enabled, even if the CAN interface
+is shut down.
+
+To fix this problem the
+flexcan_transceiver_enable()/flexcan_transceiver_disable() are moved out of
+flexcan_chip_start()/flexcan_chip_stop() into flexcan_open()/flexcan_close().
+
+Fixes: e955cead0311 ("CAN: Add Flexcan CAN controller driver")
+Link: https://lore.kernel.org/r/20201118150148.2664024-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index b22cd8d14716a..1bd955e4c7d66 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1202,14 +1202,10 @@ static int flexcan_chip_start(struct net_device *dev)
+ priv->write(reg_mecr, ®s->mecr);
+ }
+
+- err = flexcan_transceiver_enable(priv);
+- if (err)
+- goto out_chip_disable;
+-
+ /* synchronize with the can bus */
+ err = flexcan_chip_unfreeze(priv);
+ if (err)
+- goto out_transceiver_disable;
++ goto out_chip_disable;
+
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+
+@@ -1226,8 +1222,6 @@ static int flexcan_chip_start(struct net_device *dev)
+
+ return 0;
+
+- out_transceiver_disable:
+- flexcan_transceiver_disable(priv);
+ out_chip_disable:
+ flexcan_chip_disable(priv);
+ return err;
+@@ -1257,7 +1251,6 @@ static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error)
+ priv->write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+ ®s->ctrl);
+
+- flexcan_transceiver_disable(priv);
+ priv->can.state = CAN_STATE_STOPPED;
+
+ return 0;
+@@ -1293,10 +1286,14 @@ static int flexcan_open(struct net_device *dev)
+ if (err)
+ goto out_runtime_put;
+
+- err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
++ err = flexcan_transceiver_enable(priv);
+ if (err)
+ goto out_close;
+
++ err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
++ if (err)
++ goto out_transceiver_disable;
++
+ priv->mb_size = sizeof(struct flexcan_mb) + CAN_MAX_DLEN;
+ priv->mb_count = (sizeof(priv->regs->mb[0]) / priv->mb_size) +
+ (sizeof(priv->regs->mb[1]) / priv->mb_size);
+@@ -1352,6 +1349,8 @@ static int flexcan_open(struct net_device *dev)
+ can_rx_offload_del(&priv->offload);
+ out_free_irq:
+ free_irq(dev->irq, dev);
++ out_transceiver_disable:
++ flexcan_transceiver_disable(priv);
+ out_close:
+ close_candev(dev);
+ out_runtime_put:
+@@ -1370,6 +1369,7 @@ static int flexcan_close(struct net_device *dev)
+
+ can_rx_offload_del(&priv->offload);
+ free_irq(dev->irq, dev);
++ flexcan_transceiver_disable(priv);
+
+ close_candev(dev);
+ pm_runtime_put(priv->dev);
+--
+2.27.0
+
--- /dev/null
+From 0f2c22a060d9e5cc22dc3d9d7ab6f707ea441a1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 17:30:22 +0100
+Subject: can: kvaser_pciefd: Fix KCAN bittiming limits
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit 470e14c00c63752466ac44de392f584dfdddd82e ]
+
+Use correct bittiming limits for the KCAN CAN controller.
+
+Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/r/20201115163027.16851-1-jimmyassarsson@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 6f766918211a4..72acd1ba162d2 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -287,12 +287,12 @@ struct kvaser_pciefd_tx_packet {
+ static const struct can_bittiming_const kvaser_pciefd_bittiming_const = {
+ .name = KVASER_PCIEFD_DRV_NAME,
+ .tseg1_min = 1,
+- .tseg1_max = 255,
++ .tseg1_max = 512,
+ .tseg2_min = 1,
+ .tseg2_max = 32,
+ .sjw_max = 16,
+ .brp_min = 1,
+- .brp_max = 4096,
++ .brp_max = 8192,
+ .brp_inc = 1,
+ };
+
+--
+2.27.0
+
--- /dev/null
+From a4764ca7bd8e5a5d794ff4e1493a33956e81c4db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 17:30:23 +0100
+Subject: can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit d003868d7f8579838ed58b6429af91844039b6f8 ]
+
+Use correct bittiming limits for the KCAN CAN controller.
+
+Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/r/20201115163027.16851-2-jimmyassarsson@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 7ab87a7587545..218fadc911558 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
+ .tseg2_max = 32,
+ .sjw_max = 16,
+ .brp_min = 1,
+- .brp_max = 4096,
++ .brp_max = 8192,
+ .brp_inc = 1,
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 3acfcb2cf0e9a9d50682bbe9263e57a615e1b819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 12:38:29 -0600
+Subject: can: m_can: m_can_class_free_dev(): introduce new function
+
+From: Dan Murphy <dmurphy@ti.com>
+
+[ Upstream commit a8c22f5b0c689a29f45ef4a110d09fd391debcbc ]
+
+This patch creates a common function that peripherials can call to free the
+netdev device when failures occur.
+
+Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
+Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 6 ++++++
+ drivers/net/can/m_can/m_can.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 20f025b4f6d4c..85e3df24e7bfb 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1764,6 +1764,12 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_allocate_dev);
+
++void m_can_class_free_dev(struct net_device *net)
++{
++ free_candev(net);
++}
++EXPORT_SYMBOL_GPL(m_can_class_free_dev);
++
+ int m_can_class_register(struct m_can_classdev *m_can_dev)
+ {
+ int ret;
+diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h
+index 49f42b50627a1..b2699a7c99973 100644
+--- a/drivers/net/can/m_can/m_can.h
++++ b/drivers/net/can/m_can/m_can.h
+@@ -99,6 +99,7 @@ struct m_can_classdev {
+ };
+
+ struct m_can_classdev *m_can_class_allocate_dev(struct device *dev);
++void m_can_class_free_dev(struct net_device *net);
+ int m_can_class_register(struct m_can_classdev *cdev);
+ void m_can_class_unregister(struct m_can_classdev *cdev);
+ int m_can_class_get_clocks(struct m_can_classdev *cdev);
+--
+2.27.0
+
--- /dev/null
+From b663228b9f0923ce233462b20313f040657d5329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 10:23:30 +0800
+Subject: can: m_can: m_can_handle_state_change(): fix state change
+
+From: Wu Bo <wubo.oduw@gmail.com>
+
+[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]
+
+m_can_handle_state_change() is called with the new_state as an argument.
+
+In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
+following code indicate that a CAN_STATE_ERROR_WARNING is handled.
+
+This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.
+
+Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
+Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
+Cc: Dan Murphy <dmurphy@ti.com>
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 562c8317e3aa8..20f025b4f6d4c 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -664,7 +664,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ unsigned int ecr;
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cdev->can.can_stats.error_warning++;
+ cdev->can.state = CAN_STATE_ERROR_WARNING;
+@@ -693,7 +693,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->data[1] = (bec.txerr > bec.rxerr) ?
+--
+2.27.0
+
--- /dev/null
+From 1a90d163ee8fd3a34192eb16ecf71200b379ef4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 11:24:42 +0530
+Subject: can: m_can: m_can_stop(): set device to software init mode before
+ closing
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+[ Upstream commit a584e9bc1b7e88f24f8504886eafbe6c73d8a97c ]
+
+There might be some requests pending in the buffer when the interface close
+sequence occurs. In some devices, these pending requests might lead to the
+module not shutting down properly when m_can_clk_stop() is called.
+
+Therefore, move the device to init state before potentially powering it down.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Link: https://lore.kernel.org/r/20200825055442.16994-1-faiz_abbas@ti.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 85e3df24e7bfb..661db85d569ce 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1366,6 +1366,9 @@ static void m_can_stop(struct net_device *dev)
+ /* disable all interrupts */
+ m_can_disable_all_interrupts(cdev);
+
++ /* Set init mode to disengage from the network */
++ m_can_config_endisable(cdev, true);
++
+ /* set the state as STOPPED */
+ cdev->can.state = CAN_STATE_STOPPED;
+ }
+--
+2.27.0
+
--- /dev/null
+From 79899e1d12ac78d9403ad46e6cfdb482f02348d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Sep 2020 16:47:15 +0300
+Subject: can: m_can: process interrupt only when not runtime suspended
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit a1f634463aaf2c94dfa13001dbdea011303124cc ]
+
+Avoid processing bogus interrupt statuses when the HW is runtime suspended and
+the M_CAN_IR register read may get all bits 1's. Handler can be called if the
+interrupt request is shared with other peripherals or at the end of free_irq().
+
+Therefore check the runtime suspended status before processing.
+
+Fixes: cdf8259d6573 ("can: m_can: Add PM Support")
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20200915134715.696303-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 661db85d569ce..246fa2657d744 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -913,6 +913,8 @@ static irqreturn_t m_can_isr(int irq, void *dev_id)
+ struct net_device_stats *stats = &dev->stats;
+ u32 ir;
+
++ if (pm_runtime_suspended(cdev->dev))
++ return IRQ_NONE;
+ ir = m_can_read(cdev, M_CAN_IR);
+ if (!ir)
+ return IRQ_NONE;
+--
+2.27.0
+
--- /dev/null
+From b9bc7bbfc14234f5309e5c8ce6109c296dc8b830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 21:16:55 +0200
+Subject: can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
+ can_put_echo_skb()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ]
+
+The driver has to first fill the skb with data and then handle it to
+can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before
+sending the skb out via USB.
+
+Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
+Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
+Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/mcba_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 21faa2ec46327..8f785c199e220 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -326,8 +326,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (!ctx)
+ return NETDEV_TX_BUSY;
+
+- can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+-
+ if (cf->can_id & CAN_EFF_FLAG) {
+ /* SIDH | SIDL | EIDH | EIDL
+ * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
+@@ -357,6 +355,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (cf->can_id & CAN_RTR_FLAG)
+ usb_msg.dlc |= MCBA_DLC_RTR_MASK;
+
++ can_put_echo_skb(skb, priv->netdev, ctx->ndx);
++
+ err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
+ if (err)
+ goto xmit_failed;
+--
+2.27.0
+
--- /dev/null
+From 786931df3714c45b774d8dfb808e181e8be6abd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 11:24:27 +0000
+Subject: can: peak_usb: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit variable. In the case where
+time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
+Avoid this by shifting using the BIT_ULL macro instead.
+
+Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index c844c6abe5fcd..f22089101cdda 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -156,7 +156,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+ /* case when event time (tsw) wraps */
+ if (ts < time_ref->ts_dev_1)
+- delta_ts = 1 << time_ref->adapter->ts_used_bits;
++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
+
+ /* Otherwise, sync time counter (ts_dev_2) has wrapped:
+ * handle case when event time (tsn) hasn't.
+@@ -168,7 +168,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ * tsn ts
+ */
+ } else if (time_ref->ts_dev_1 < ts) {
+- delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
+ }
+
+ /* add delay between last sync and event timestamps */
+--
+2.27.0
+
--- /dev/null
+From df574edff98414c83e12eb9beb8284052473484e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 16:10:13 +0200
+Subject: can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 3fcce133f0d9a50d3a23f8e2bc950197b4e03900 ]
+
+regmap is a library function that gets selected by drivers that need it. No
+driver modules should depend on it. Instead depends on SPI and select
+REGMAP_SPI. Depending on REGMAP_SPI makes this driver only build if another
+driver already selected REGMAP_SPI, as the symbol can't be selected through the
+menu kernel configuration.
+
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: http://lore.kernel.org/r/20200413141013.506613-1-enric.balletbo@collabora.com
+Reviewed-by: Dan Murphy <dmurphy@ti.com>
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
+index 1ff0b7fe81d6a..c10932a7f1fe3 100644
+--- a/drivers/net/can/m_can/Kconfig
++++ b/drivers/net/can/m_can/Kconfig
+@@ -16,7 +16,8 @@ config CAN_M_CAN_PLATFORM
+
+ config CAN_M_CAN_TCAN4X5X
+ depends on CAN_M_CAN
+- depends on REGMAP_SPI
++ depends on SPI
++ select REGMAP_SPI
+ tristate "TCAN4X5X M_CAN device"
+ ---help---
+ Say Y here if you want support for Texas Instruments TCAN4x5x
+--
+2.27.0
+
--- /dev/null
+From 477a6cd5bfce91f743e957fc4b1f6787d3744d67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 11:30:34 +0100
+Subject: can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for
+ devm_regmap_init()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1ff203badbbf1738027c8395d5b40b0d462b6e4d ]
+
+This patch adds the missing error checking when initializing the regmap
+interface fails.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Cc: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20201019154233.1262589-7-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/tcan4x5x.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index b233756345f83..11c223a534887 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -467,6 +467,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+
+ priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus,
+ &spi->dev, &tcan4x5x_regmap);
++ if (IS_ERR(priv->regmap)) {
++ ret = PTR_ERR(priv->regmap);
++ goto out_clk;
++ }
+
+ tcan4x5x_power_enable(priv->power, 1);
+
+--
+2.27.0
+
--- /dev/null
+From 47c656abb70e1d106014f0fe18f43fe4aabac90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 22:23:49 +0200
+Subject: can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit c81d0b6ca665477c761f227807010762630b089f ]
+
+Change the order in tcan4x5x_can_remove() to be the exact inverse of
+tcan4x5x_can_probe(). First m_can_class_unregister(), then power down the
+device.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Cc: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20201019154233.1262589-10-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/tcan4x5x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index 11c223a534887..681bb861de05e 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -501,10 +501,10 @@ static int tcan4x5x_can_remove(struct spi_device *spi)
+ {
+ struct tcan4x5x_priv *priv = spi_get_drvdata(spi);
+
+- tcan4x5x_power_enable(priv->power, 0);
+-
+ m_can_class_unregister(priv->mcan_dev);
+
++ tcan4x5x_power_enable(priv->power, 0);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 2a37a6a62c44e5a7ea25b169eb02cfc27f868dd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 19:17:08 +0800
+Subject: can: ti_hecc: Fix memleak in ti_hecc_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ]
+
+In the error handling, we should goto the probe_exit_candev
+to free ndev to prevent memory leak.
+
+Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/ti_hecc.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index d3a7631eecaf2..d0a05fc5cc32f 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -873,7 +873,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->base)) {
+ dev_err(&pdev->dev, "hecc ioremap failed\n");
+- return PTR_ERR(priv->base);
++ err = PTR_ERR(priv->base);
++ goto probe_exit_candev;
+ }
+
+ /* handle hecc-ram memory */
+@@ -886,7 +887,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->hecc_ram)) {
+ dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
+- return PTR_ERR(priv->hecc_ram);
++ err = PTR_ERR(priv->hecc_ram);
++ goto probe_exit_candev;
+ }
+
+ /* handle mbx memory */
+@@ -899,13 +901,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->mbx = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->mbx)) {
+ dev_err(&pdev->dev, "mbx ioremap failed\n");
+- return PTR_ERR(priv->mbx);
++ err = PTR_ERR(priv->mbx);
++ goto probe_exit_candev;
+ }
+
+ irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!irq) {
+ dev_err(&pdev->dev, "No irq resource\n");
+- goto probe_exit;
++ goto probe_exit_candev;
+ }
+
+ priv->ndev = ndev;
+@@ -969,7 +972,7 @@ probe_exit_release_clk:
+ clk_put(priv->clk);
+ probe_exit_candev:
+ free_candev(ndev);
+-probe_exit:
++
+ return err;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 4487ea000737993c07b586a718ad29886ebb357f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 09:09:29 +0800
+Subject: drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 6654b57866b98230a270953dd34f67de17ab1708 ]
+
+Fix to return a negative error code from the error handling case instead
+of 0 in function sun8i_dw_hdmi_bind().
+
+Fixes: b7c7436a5ff0 ("drm/sun4i: Implement A83T HDMI driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/1605488969-5211-1-git-send-email-wangxiongfeng2@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index a44dca4b0219e..12fe241956213 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -209,6 +209,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
+ phy_node = of_parse_phandle(dev->of_node, "phys", 0);
+ if (!phy_node) {
+ dev_err(dev, "Can't found PHY phandle\n");
++ ret = -EINVAL;
+ goto err_disable_clk_tmds;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 9b0b995e3a874b17c631ac645e0e7c4a6d24e02c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 11:39:19 -0500
+Subject: efi/x86: Free efi_pgd with free_pages()
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit c2fe61d8be491ff8188edaf22e838f819999146b ]
+
+Commit
+
+ d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
+
+changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in
+the error path it should be freed using free_pages() rather than
+free_page().
+
+Commit
+
+ 06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()")
+
+fixed one instance of this, but missed another.
+
+Move the freeing out-of-line to avoid code duplication and fix this bug.
+
+Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
+Link: https://lore.kernel.org/r/20201110163919.1134431-1-nivedita@alum.mit.edu
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi_64.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index e39c930cfbd1e..5283978181103 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -217,28 +217,30 @@ int __init efi_alloc_page_tables(void)
+ gfp_mask = GFP_KERNEL | __GFP_ZERO;
+ efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
+ if (!efi_pgd)
+- return -ENOMEM;
++ goto fail;
+
+ pgd = efi_pgd + pgd_index(EFI_VA_END);
+ p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END);
+- if (!p4d) {
+- free_page((unsigned long)efi_pgd);
+- return -ENOMEM;
+- }
++ if (!p4d)
++ goto free_pgd;
+
+ pud = pud_alloc(&init_mm, p4d, EFI_VA_END);
+- if (!pud) {
+- if (pgtable_l5_enabled())
+- free_page((unsigned long) pgd_page_vaddr(*pgd));
+- free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
+- return -ENOMEM;
+- }
++ if (!pud)
++ goto free_p4d;
+
+ efi_mm.pgd = efi_pgd;
+ mm_init_cpumask(&efi_mm);
+ init_new_context(NULL, &efi_mm);
+
+ return 0;
++
++free_p4d:
++ if (pgtable_l5_enabled())
++ free_page((unsigned long)pgd_page_vaddr(*pgd));
++free_pgd:
++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
++fail:
++ return -ENOMEM;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From eac0e7cc5da10bbc812234781a0b7f8b7140903e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 22:49:31 +0900
+Subject: fail_function: Remove a redundant mutex unlock
+
+From: Luo Meng <luomeng12@huawei.com>
+
+[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ]
+
+Fix a mutex_unlock() issue where before copy_from_user() is
+not called mutex_locked.
+
+Fixes: 4b1a29a7f542 ("error-injection: Support fault injection framework")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Luo Meng <luomeng12@huawei.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/fail_function.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/fail_function.c b/kernel/fail_function.c
+index 63b349168da72..b0b1ad93fa957 100644
+--- a/kernel/fail_function.c
++++ b/kernel/fail_function.c
+@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+
+ if (copy_from_user(buf, buffer, count)) {
+ ret = -EFAULT;
+- goto out;
++ goto out_free;
+ }
+ buf[count] = '\0';
+ sym = strstrip(buf);
+@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+ ret = count;
+ }
+ out:
+- kfree(buf);
+ mutex_unlock(&fei_lock);
++out_free:
++ kfree(buf);
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 36511e515ac210ce1bdb7a3c968f58967696e338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 22:20:56 +0100
+Subject: HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b4c00e7976636f33a4f67eab436a11666c8afd60 ]
+
+Some users are pairing the Dinovo keyboards with the MX5000 or MX5500
+receivers, instead of with the Dinovo receivers. The receivers are
+mostly the same (and the air protocol obviously is compatible) but
+currently the Dinovo receivers are handled by hid-lg.c while the
+MX5x00 receivers are handled by logitech-dj.c.
+
+When using a Dinovo keyboard, with its builtin touchpad, through
+logitech-dj.c then the touchpad stops working because when asking the
+receiver for paired devices, we get only 1 paired device with
+a device_type of REPORT_TYPE_KEYBOARD. And since we don't see a paired
+mouse, we have nowhere to send mouse-events to, so we drop them.
+
+Extend the existing fix for the Dinovo Edge for this to also cover the
+Dinovo Mini keyboard and also add a mapping to logitech-hidpp for the
+Media key on the Dinovo Mini, so that that keeps working too.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
+Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 1 +
+ drivers/hid/hid-logitech-hidpp.c | 25 +++++++++++++++++++++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 32e5391d98c35..309e5df463d5c 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -875,6 +875,7 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
+ */
+ static const u16 kbd_builtin_touchpad_ids[] = {
+ 0xb309, /* Dinovo Edge */
++ 0xb30c, /* Dinovo Mini */
+ };
+
+ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index c85070d631da5..e49d36de07968 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -88,6 +88,8 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ #define HIDPP_CAPABILITY_BATTERY_MILEAGE BIT(2)
+ #define HIDPP_CAPABILITY_BATTERY_LEVEL_STATUS BIT(3)
+
++#define lg_map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
++
+ /*
+ * There are two hidpp protocols in use, the first version hidpp10 is known
+ * as register access protocol or RAP, the second version hidpp20 is known as
+@@ -2768,6 +2770,26 @@ static int g920_get_config(struct hidpp_device *hidpp,
+ return g920_ff_set_autocenter(hidpp, data);
+ }
+
++/* -------------------------------------------------------------------------- */
++/* Logitech Dinovo Mini keyboard with builtin touchpad */
++/* -------------------------------------------------------------------------- */
++#define DINOVO_MINI_PRODUCT_ID 0xb30c
++
++static int lg_dinovo_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
++ return 0;
++
++ switch (usage->hid & HID_USAGE) {
++ case 0x00d: lg_map_key_clear(KEY_MEDIA); break;
++ default:
++ return 0;
++ }
++ return 1;
++}
++
+ /* -------------------------------------------------------------------------- */
+ /* HID++1.0 devices which use HID++ reports for their wheels */
+ /* -------------------------------------------------------------------------- */
+@@ -3003,6 +3025,9 @@ static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ field->application != HID_GD_MOUSE)
+ return m560_input_mapping(hdev, hi, field, usage, bit, max);
+
++ if (hdev->product == DINOVO_MINI_PRODUCT_ID)
++ return lg_dinovo_input_mapping(hdev, hi, field, usage, bit, max);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 43b359d3c21740338817c55e0b1f19c5b80c5d4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 14:36:56 +0100
+Subject: HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin
+ trackpad
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit ee5e58418a854755201eb4952b1230d873a457d5 ]
+
+Some quad/bluetooth keyboards, such as the Dinovo Edge (Y-RAY81) have a
+builtin touchpad. In this case when asking the receiver for paired devices,
+we get only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD.
+
+This means that we do not instantiate a second dj_hiddev for the mouse
+(as we normally would) and thus there is no place for us to forward the
+mouse input reports to, causing the touchpad part of the keyboard to not
+work.
+
+There is no way for us to detect these keyboards, so this commit adds
+an array with device-ids for such keyboards and when a keyboard is on
+this list it adds STD_MOUSE to the reports_supported bitmap for the
+dj_hiddev created for the keyboard fixing the touchpad not working.
+
+Using a list of device-ids for this is not ideal, but there are only
+very few such keyboards so this should be fine. Besides the Dinovo Edge,
+other known wireless Logitech keyboards with a builtin touchpad are:
+
+* Dinovo Mini (TODO add its device-id to the list)
+* K400 (uses a unifying receiver so is not affected)
+* K600 (uses a unifying receiver so is not affected)
+
+Cc: stable@vger.kernel.org
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
+Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index bb50d6e7745bc..32e5391d98c35 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -866,11 +866,23 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
+ schedule_work(&djrcv_dev->work);
+ }
+
++/*
++ * Some quad/bluetooth keyboards have a builtin touchpad in this case we see
++ * only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. For the
++ * touchpad to work we must also forward mouse input reports to the dj_hiddev
++ * created for the keyboard (instead of forwarding them to a second paired
++ * device with a device_type of REPORT_TYPE_MOUSE as we normally would).
++ */
++static const u16 kbd_builtin_touchpad_ids[] = {
++ 0xb309, /* Dinovo Edge */
++};
++
+ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+ struct hidpp_event *hidpp_report,
+ struct dj_workitem *workitem)
+ {
+ struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
++ int i, id;
+
+ workitem->type = WORKITEM_TYPE_PAIRED;
+ workitem->device_type = hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] &
+@@ -882,6 +894,13 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+ workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA |
+ POWER_KEYS | MEDIA_CENTER |
+ HIDPP;
++ id = (workitem->quad_id_msb << 8) | workitem->quad_id_lsb;
++ for (i = 0; i < ARRAY_SIZE(kbd_builtin_touchpad_ids); i++) {
++ if (id == kbd_builtin_touchpad_ids[i]) {
++ workitem->reports_supported |= STD_MOUSE;
++ break;
++ }
++ }
+ break;
+ case REPORT_TYPE_MOUSE:
+ workitem->reports_supported |= STD_MOUSE | HIDPP;
+--
+2.27.0
+
--- /dev/null
+From 9474d068400ce86de9a23a1f815d6c1a30f31795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 06:56:12 -0700
+Subject: HID: logitech-hidpp: Add PID for MX Anywhere 2
+
+From: Harry Cutts <hcutts@chromium.org>
+
+[ Upstream commit b59f38dbfd5d19eb7e03d8b639f0c0d385ba8cc5 ]
+
+It seems that the PID 0x4072 was missing from the list Logitech gave me
+for this mouse, as I found one with it in the wild (with which I tested
+this patch).
+
+Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice")
+Signed-off-by: Harry Cutts <hcutts@chromium.org>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 60cf806062821..c85070d631da5 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3741,6 +3741,7 @@ static const struct hid_device_id hidpp_devices[] = {
+ LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { /* Mouse Logitech MX Anywhere 2 */
+ LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
++ { LDJ_DEVICE(0x4072), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+--
+2.27.0
+
--- /dev/null
+From c763617b09e07cc9b58d446e215149c67589a958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:09 -0700
+Subject: Input: adxl34x - clean up a data type in adxl34x_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]
+
+The "revid" is used to store negative error codes so it should be an int
+type.
+
+Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/adxl34x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index 5fe92d4ba3f0c..4cc4e8ff42b33 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ struct input_dev *input_dev;
+ const struct adxl34x_platform_data *pdata;
+ int err, range, i;
+- unsigned char revid;
++ int revid;
+
+ if (!irq) {
+ dev_err(dev, "no IRQ?\n");
+--
+2.27.0
+
--- /dev/null
+From 1c2db109857a45b41273b8eb0a4c9cd402dd6376 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 17:48:52 -0800
+Subject: Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
+
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+
+[ Upstream commit 676650d007e06fddcf3fe38238251d71bd179641 ]
+
+When TOUCHSCREEN_ADC is enabled and IIO_BUFFER is disabled, it results
+in the following Kbuild warning:
+
+WARNING: unmet direct dependencies detected for IIO_BUFFER_CB
+ Depends on [n]: IIO [=y] && IIO_BUFFER [=n]
+ Selected by [y]:
+ - TOUCHSCREEN_ADC [=y] && !UML && INPUT [=y] && INPUT_TOUCHSCREEN [=y] && IIO [=y]
+
+The reason is that TOUCHSCREEN_ADC selects IIO_BUFFER_CB without depending
+on or selecting IIO_BUFFER while IIO_BUFFER_CB depends on IIO_BUFFER. This
+can also fail building the kernel.
+
+Honor the kconfig dependency to remove unmet direct dependency warnings
+and avoid any potential build failures.
+
+Fixes: aa132ffb6b0a ("input: touchscreen: resistive-adc-touch: add generic resistive ADC touchscreen")
+Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/20201102221504.541279-1-fazilyildiran@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
+index 46ad9090493bb..1e812a193ce7a 100644
+--- a/drivers/input/touchscreen/Kconfig
++++ b/drivers/input/touchscreen/Kconfig
+@@ -96,6 +96,7 @@ config TOUCHSCREEN_AD7879_SPI
+ config TOUCHSCREEN_ADC
+ tristate "Generic ADC based resistive touchscreen"
+ depends on IIO
++ select IIO_BUFFER
+ select IIO_BUFFER_CB
+ help
+ Say Y here if you want to use the generic ADC
+--
+2.27.0
+
--- /dev/null
+From d5df3be9c4fc268d37e16de1858abafbaf760a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 15:19:08 +0800
+Subject: iommu/vt-d: Avoid panic if iommu init fails in tboot system
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit 4d213e76a359e540ca786ee937da7f35faa8e5f8 ]
+
+"intel_iommu=off" command line is used to disable iommu but iommu is force
+enabled in a tboot system for security reason.
+
+However for better performance on high speed network device, a new option
+"intel_iommu=tboot_noforce" is introduced to disable the force on.
+
+By default kernel should panic if iommu init fail in tboot for security
+reason, but it's unnecessory if we use "intel_iommu=tboot_noforce,off".
+
+Fix the code setting force_on and move intel_iommu_tboot_noforce
+from tboot code to intel iommu code.
+
+Fixes: 7304e8f28bb2 ("iommu/vt-d: Correctly disable Intel IOMMU force on")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Tested-by: Lukasz Hawrylko <lukasz.hawrylko@linux.intel.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20201110071908.3133-1-zhenzhong.duan@gmail.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tboot.c | 3 ---
+ drivers/iommu/intel-iommu.c | 5 +++--
+ include/linux/intel-iommu.h | 1 -
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
+index a49fe1dcb47e8..bded81591ad95 100644
+--- a/arch/x86/kernel/tboot.c
++++ b/arch/x86/kernel/tboot.c
+@@ -512,9 +512,6 @@ int tboot_force_iommu(void)
+ if (!tboot_enabled())
+ return 0;
+
+- if (intel_iommu_tboot_noforce)
+- return 1;
+-
+ if (no_iommu || swiotlb || dmar_disabled)
+ pr_warning("Forcing Intel-IOMMU to enabled\n");
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 1147626f0d253..984c7a6ea4fe8 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -179,7 +179,7 @@ static int rwbf_quirk;
+ * (used when kernel is launched w/ TXT)
+ */
+ static int force_on = 0;
+-int intel_iommu_tboot_noforce;
++static int intel_iommu_tboot_noforce;
+ static int no_platform_optin;
+
+ #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
+@@ -4927,7 +4927,8 @@ int __init intel_iommu_init(void)
+ * Intel IOMMU is required for a TXT/tboot launch or platform
+ * opt in, so enforce that.
+ */
+- force_on = tboot_force_iommu() || platform_optin_force_iommu();
++ force_on = (!intel_iommu_tboot_noforce && tboot_force_iommu()) ||
++ platform_optin_force_iommu();
+
+ if (iommu_init_mempool()) {
+ if (force_on)
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index e54d51308f6f5..6b559d25a84ee 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -706,7 +706,6 @@ extern int iommu_calculate_agaw(struct intel_iommu *iommu);
+ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
+ extern int dmar_disabled;
+ extern int intel_iommu_enabled;
+-extern int intel_iommu_tboot_noforce;
+ extern int intel_iommu_gfx_mapped;
+ #else
+ static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
+--
+2.27.0
+
--- /dev/null
+From b4d398632f11f0a6d0ee0eda38a00c0f9e7c4888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 19:12:11 +0300
+Subject: iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c7eb900f5f45eeab1ea1bed997a2a12d8b5907bc ]
+
+Static analyzer is not happy about intel_iommu_gfx_mapped declaration:
+
+.../drivers/iommu/intel/iommu.c:364:5: warning: symbol 'intel_iommu_gfx_mapped' was not declared. Should it be static?
+
+Move its declaration to Intel IOMMU header file.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20200828161212.71294-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/intel-gtt.h | 5 +----
+ include/linux/intel-iommu.h | 1 +
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/include/drm/intel-gtt.h b/include/drm/intel-gtt.h
+index 71d81923e6b06..abfefaaf897a0 100644
+--- a/include/drm/intel-gtt.h
++++ b/include/drm/intel-gtt.h
+@@ -5,6 +5,7 @@
+ #define _DRM_INTEL_GTT_H
+
+ #include <linux/agp_backend.h>
++#include <linux/intel-iommu.h>
+ #include <linux/kernel.h>
+
+ void intel_gtt_get(u64 *gtt_total,
+@@ -33,8 +34,4 @@ void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries);
+ /* flag for GFDT type */
+ #define AGP_USER_CACHED_MEMORY_GFDT (1 << 3)
+
+-#ifdef CONFIG_INTEL_IOMMU
+-extern int intel_iommu_gfx_mapped;
+-#endif
+-
+ #endif
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index ed870da78326b..e54d51308f6f5 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -707,6 +707,7 @@ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
+ extern int dmar_disabled;
+ extern int intel_iommu_enabled;
+ extern int intel_iommu_tboot_noforce;
++extern int intel_iommu_gfx_mapped;
+ #else
+ static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
+ {
+--
+2.27.0
+
--- /dev/null
+From 139be6e37b5b4b10534835126fa6bae397d2bd05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 16:16:40 -0800
+Subject: ip_tunnels: Set tunnel option flag when tunnel metadata is present
+
+From: Yi-Hung Wei <yihung.wei@gmail.com>
+
+[ Upstream commit 9c2e14b48119b39446031d29d994044ae958d8fc ]
+
+Currently, we may set the tunnel option flag when the size of metadata
+is zero. For example, we set TUNNEL_GENEVE_OPT in the receive function
+no matter the geneve option is present or not. As this may result in
+issues on the tunnel flags consumers, this patch fixes the issue.
+
+Related discussion:
+* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u
+
+Fixes: 256c87c17c53 ("net: check tunnel option type in tunnel flags")
+Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
+Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 3 +--
+ include/net/ip_tunnels.h | 7 ++++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index fcb7a6b4cc02a..c7ec3d24eabc8 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -221,8 +221,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ if (ip_tunnel_collect_metadata() || gs->collect_md) {
+ __be16 flags;
+
+- flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT |
+- (gnvh->oam ? TUNNEL_OAM : 0) |
++ flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) |
+ (gnvh->critical ? TUNNEL_CRIT_OPT : 0);
+
+ tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags,
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index af645604f3289..56deb2501e962 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -472,9 +472,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ const void *from, int len,
+ __be16 flags)
+ {
+- memcpy(ip_tunnel_info_opts(info), from, len);
+ info->options_len = len;
+- info->key.tun_flags |= flags;
++ if (len > 0) {
++ memcpy(ip_tunnel_info_opts(info), from, len);
++ info->key.tun_flags |= flags;
++ }
+ }
+
+ static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate)
+@@ -520,7 +522,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ __be16 flags)
+ {
+ info->options_len = 0;
+- info->key.tun_flags |= flags;
+ }
+
+ #endif /* CONFIG_INET */
+--
+2.27.0
+
--- /dev/null
+From c3ae1399c26f662ba5a9239d2c6bd8cf44dd9ea5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 22:17:19 -0800
+Subject: libfs: fix error cast of negative value in simple_attr_write()
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]
+
+The attr->set() receive a value of u64, but simple_strtoll() is used for
+doing the conversion. It will lead to the error cast if user inputs a
+negative value.
+
+Use kstrtoull() instead of simple_strtoll() to convert a string got from
+the user to an unsigned value. The former will return '-EINVAL' if it
+gets a negetive value, but the latter can't handle the situation
+correctly. Make 'val' unsigned long long as what kstrtoull() takes,
+this will eliminate the compile warning on no 64-bit architectures.
+
+Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 5fd9cc0e2ac9e..247b58a68240a 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -887,7 +887,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos)
+ {
+ struct simple_attr *attr;
+- u64 val;
++ unsigned long long val;
+ size_t size;
+ ssize_t ret;
+
+@@ -905,7 +905,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ goto out;
+
+ attr->set_buf[size] = '\0';
+- val = simple_strtoll(attr->set_buf, NULL, 0);
++ ret = kstrtoull(attr->set_buf, 0, &val);
++ if (ret)
++ goto out;
+ ret = attr->set(attr->data, val);
+ if (ret == 0)
+ ret = len; /* on success, claim we got the whole input */
+--
+2.27.0
+
--- /dev/null
+From 42a1adfbfe9bf960ca3336e7bf25168e12c303da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:18:56 +0800
+Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]
+
+If the clk_register fails, we should free h before
+function returns to prevent memleak.
+
+Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/alchemy/common/clock.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index a95a894aceaf1..f0c8303371047 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ {
+ struct clk_init_data id;
+ struct clk_hw *h;
++ struct clk *clk;
+
+ h = kzalloc(sizeof(*h), GFP_KERNEL);
+ if (!h)
+@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ id.ops = &alchemy_clkops_cpu;
+ h->init = &id;
+
+- return clk_register(NULL, h);
++ clk = clk_register(NULL, h);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ kfree(h);
++ }
++
++ return clk;
+ }
+
+ /* AUXPLLs ************************************************************/
+--
+2.27.0
+
--- /dev/null
+From 7cabe70e5c8ee4a552c73fa6e9603698ce5c3838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 12:44:40 -0700
+Subject: MIPS: export has_transparent_hugepage() for modules
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ]
+
+MIPS should export its local version of "has_transparent_hugepage"
+so that loadable modules (dax) can use it.
+
+Fixes this build error:
+ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined!
+
+Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: linux-nvdimm@lists.01.org
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlb-r4k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index c13e46ced4252..60046445122b3 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -437,6 +437,7 @@ int has_transparent_hugepage(void)
+ }
+ return mask == PM_HUGE_MASK;
+ }
++EXPORT_SYMBOL(has_transparent_hugepage);
+
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
+--
+2.27.0
+
--- /dev/null
+From dd686c429d8183d7e8e12d8227dbd0188a943c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 11:35:52 +0200
+Subject: net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 5b8631c7b21ca8bc039f0bc030048973b039e0d2 ]
+
+Avoid calling mlx5_esw_modify_vport_rate() if qos is not enabled and
+avoid unnecessary syndrome messages from firmware.
+
+Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index d2d407ebe6872..009d383d83f4b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1592,6 +1592,10 @@ int mlx5_esw_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num,
+ struct mlx5_vport *vport;
+
+ vport = mlx5_eswitch_get_vport(esw, vport_num);
++
++ if (!vport->qos.enabled)
++ return -EOPNOTSUPP;
++
+ MLX5_SET(scheduling_context, ctx, max_average_bw, rate_mbps);
+
+ return mlx5_modify_scheduling_element_cmd(esw->dev,
+--
+2.27.0
+
--- /dev/null
+From 77d6c3223aac545040debfe658de3309613cc97c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:42:29 +0800
+Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]
+
+When execute command "perf lock report", it hits failure and outputs log
+as follows:
+
+ perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
+ Aborted
+
+This is an imbalance issue. The locking sequence structure
+"lock_seq_stat" contains the reader counter and it is used to check if
+the locking sequence is balance or not between acquiring and releasing.
+
+If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
+the "read_count" will be reset to zero when allocate a new structure at
+the next time; thus it causes the wrong counting for reader and finally
+results in imbalance issue.
+
+To fix this issue, if detects "read_count" is not zero (means still have
+read user in the locking sequence), goto the "end" tag to skip freeing
+structure "lock_seq_stat".
+
+Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index 474dfd59d7eb2..d06665077dfe0 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -621,7 +621,7 @@ static int report_lock_release_event(struct evsel *evsel,
+ case SEQ_STATE_READ_ACQUIRED:
+ seq->read_count--;
+ BUG_ON(seq->read_count < 0);
+- if (!seq->read_count) {
++ if (seq->read_count) {
+ ls->nr_release++;
+ goto end;
+ }
+--
+2.27.0
+
--- /dev/null
+From b0a3f65cbfd7c0c483956aa7854344edad7c5d4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 11:22:02 +0800
+Subject: RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit d035c3f6cdb8e5d5a17adcbb79d7453417a6077d ]
+
+Fix missing kfree in pvrdma_register_device() when failure from
+ib_device_set_netdev().
+
+Fixes: 4b38da75e089 ("RDMA/drivers: Convert easy drivers to use ib_device_set_netdev()")
+Link: https://lore.kernel.org/r/20201111032202.17925-1-miaoqinglang@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index 780fd2dfc07eb..10e67283b9db7 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -266,7 +266,7 @@ static int pvrdma_register_device(struct pvrdma_dev *dev)
+ }
+ ret = ib_device_set_netdev(&dev->ib_dev, dev->netdev, 1);
+ if (ret)
+- return ret;
++ goto err_srq_free;
+ spin_lock_init(&dev->srq_tbl_lock);
+ rdma_set_device_sysfs_group(&dev->ib_dev, &pvrdma_attr_group);
+
+--
+2.27.0
+
--- /dev/null
+From 17d9088b2119e56eafdc2dac6c9574234d94925e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 08:50:09 -0600
+Subject: regulator: ti-abb: Fix array out of bound read access on the first
+ transition
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]
+
+At the start of driver initialization, we do not know what bias
+setting the bootloader has configured the system for and we only know
+for certain the very first time we do a transition.
+
+However, since the initial value of the comparison index is -EINVAL,
+this negative value results in an array out of bound access on the
+very first transition.
+
+Since we don't know what the setting is, we just set the bias
+configuration as there is nothing to compare against. This prevents
+the array out of bound access.
+
+NOTE: Even though we could use a more relaxed check of "< 0" the only
+valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.
+
+Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
+Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index 89b9314d64c9d..016330f909c09 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ return ret;
+ }
+
+- /* If data is exactly the same, then just update index, no change */
+ info = &abb->info[sel];
++ /*
++ * When Linux kernel is starting up, we are'nt sure of the
++ * Bias configuration that bootloader has configured.
++ * So, we get to know the actual setting the first time
++ * we are asked to transition.
++ */
++ if (abb->current_info_idx == -EINVAL)
++ goto just_set_abb;
++
++ /* If data is exactly the same, then just update index, no change */
+ oinfo = &abb->info[abb->current_info_idx];
+ if (!memcmp(info, oinfo, sizeof(*info))) {
+ dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
+@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ goto out;
+ }
+
++just_set_abb:
+ ret = ti_abb_set_opp(rdev, abb, info);
+
+ out:
+--
+2.27.0
+
--- /dev/null
+From 47a36388c494117a977b029cb95bc6386af18065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:06 +0800
+Subject: Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to
+ active high"
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 8d80e2f00a42ef10b54e1b2d9e97314f8fd046c0 ]
+
+This reverts commit 75ee680cbd2e4d0156b94f9fec50076361ab12f2.
+
+Turns out the activity and link LEDs on the RJ45 port are active low,
+just like on the Orange Pi PC.
+
+Revert the commit that says otherwise.
+
+Fixes: 75ee680cbd2e ("arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high")
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-1-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+index 71fb732089397..babf4cf1b2f68 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+@@ -53,11 +53,6 @@
+ };
+ };
+
+-&emac {
+- /* LEDs changed to active high on the plus */
+- /delete-property/ allwinner,leds-active-low;
+-};
+-
+ &mmc1 {
+ vmmc-supply = <®_vcc3v3>;
+ bus-width = <4>;
+--
+2.27.0
+
--- /dev/null
+From 30403155713c499bb667dff809c82bb77eb20a63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 16:49:08 +0800
+Subject: rfkill: Fix use-after-free in rfkill_resume()
+
+From: Claire Chang <tientzu@chromium.org>
+
+[ Upstream commit 94e2bd0b259ed39a755fdded47e6734acf1ce464 ]
+
+If a device is getting removed or reprobed during resume, use-after-free
+might happen. For example, h5_btrtl_resume() schedules a work queue for
+device reprobing, which of course requires removal first.
+
+If the removal happens in parallel with the device_resume() and wins the
+race to acquire device_lock(), removal may remove the device from the PM
+lists and all, but device_resume() is already running and will continue
+when the lock can be acquired, thus calling rfkill_resume().
+
+During this, if rfkill_set_block() is then called after the corresponding
+*_unregister() and kfree() are called, there will be an use-after-free
+in hci_rfkill_set_block():
+
+BUG: KASAN: use-after-free in hci_rfkill_set_block+0x58/0xc0 [bluetooth]
+...
+Call trace:
+ dump_backtrace+0x0/0x154
+ show_stack+0x20/0x2c
+ dump_stack+0xbc/0x12c
+ print_address_description+0x88/0x4b0
+ __kasan_report+0x144/0x168
+ kasan_report+0x10/0x18
+ check_memory_region+0x19c/0x1ac
+ __kasan_check_write+0x18/0x24
+ hci_rfkill_set_block+0x58/0xc0 [bluetooth]
+ rfkill_set_block+0x9c/0x120
+ rfkill_resume+0x34/0x70
+ dpm_run_callback+0xf0/0x1f4
+ device_resume+0x210/0x22c
+
+Fix this by checking rfkill->registered in rfkill_resume(). device_del()
+in rfkill_unregister() requires device_lock() and the whole rfkill_resume()
+is also protected by the same lock via device_resume(), we can make sure
+either the rfkill->registered is false before rfkill_resume() starts or the
+rfkill device won't be unregistered before rfkill_resume() returns.
+
+As async_resume() holds a reference to the device, at this level there can
+be no use-after-free; only in the user that doesn't expect this scenario.
+
+Fixes: 8589086f4efd ("Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Link: https://lore.kernel.org/r/20201110084908.219088-1-tientzu@chromium.org
+[edit commit message for clarity and add more info provided later]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rfkill/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index 6c089320ae4f1..5bba7c36ac74f 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -876,6 +876,9 @@ static int rfkill_resume(struct device *dev)
+
+ rfkill->suspended = false;
+
++ if (!rfkill->registered)
++ return 0;
++
+ if (!rfkill->persistent) {
+ cur = !!(rfkill->state & RFKILL_BLOCK_SW);
+ rfkill_set_block(rfkill, cur);
+--
+2.27.0
+
--- /dev/null
+From d575d2a0f7da42134564f139773d42374e3d79b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 19:19:32 +0100
+Subject: RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit b1e678bf290db5a76f1b6a9f7c381310e03440d6 ]
+
+dma_virt_ops requires that all pages have a kernel virtual address.
+Introduce a INFINIBAND_VIRT_DMA Kconfig symbol that depends on !HIGHMEM
+and make all three drivers depend on the new symbol.
+
+Also remove the ARCH_DMA_ADDR_T_64BIT dependency, which has been obsolete
+since commit 4965a68780c5 ("arch: define the ARCH_DMA_ADDR_T_64BIT config
+symbol in lib/Kconfig")
+
+Fixes: 551199aca1c3 ("lib/dma-virt: Add dma_virt_ops")
+Link: https://lore.kernel.org/r/20201106181941.1878556-2-hch@lst.de
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/Kconfig | 3 +++
+ drivers/infiniband/sw/rdmavt/Kconfig | 3 ++-
+ drivers/infiniband/sw/rxe/Kconfig | 2 +-
+ drivers/infiniband/sw/siw/Kconfig | 1 +
+ 4 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
+index b44b1c322ec82..786ee0e4e8855 100644
+--- a/drivers/infiniband/Kconfig
++++ b/drivers/infiniband/Kconfig
+@@ -80,6 +80,9 @@ config INFINIBAND_ADDR_TRANS_CONFIGFS
+ This allows the user to config the default GID type that the CM
+ uses for each device, when initiaing new connections.
+
++config INFINIBAND_VIRT_DMA
++ def_bool !HIGHMEM
++
+ if INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ source "drivers/infiniband/hw/mthca/Kconfig"
+ source "drivers/infiniband/hw/qib/Kconfig"
+diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
+index 1f2759c72108a..a297f13eb6664 100644
+--- a/drivers/infiniband/sw/rdmavt/Kconfig
++++ b/drivers/infiniband/sw/rdmavt/Kconfig
+@@ -1,7 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config INFINIBAND_RDMAVT
+ tristate "RDMA verbs transport library"
+- depends on X86_64 && ARCH_DMA_ADDR_T_64BIT
++ depends on INFINIBAND_VIRT_DMA
++ depends on X86_64
+ depends on PCI
+ select DMA_VIRT_OPS
+ ---help---
+diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
+index d9bcfe7405888..71a773f607bbc 100644
+--- a/drivers/infiniband/sw/rxe/Kconfig
++++ b/drivers/infiniband/sw/rxe/Kconfig
+@@ -2,7 +2,7 @@
+ config RDMA_RXE
+ tristate "Software RDMA over Ethernet (RoCE) driver"
+ depends on INET && PCI && INFINIBAND
+- depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
++ depends on INFINIBAND_VIRT_DMA
+ select NET_UDP_TUNNEL
+ select CRYPTO_CRC32
+ select DMA_VIRT_OPS
+diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig
+index b622fc62f2cd6..3450ba5081df5 100644
+--- a/drivers/infiniband/sw/siw/Kconfig
++++ b/drivers/infiniband/sw/siw/Kconfig
+@@ -1,6 +1,7 @@
+ config RDMA_SIW
+ tristate "Software RDMA over TCP/IP (iWARP) driver"
+ depends on INET && INFINIBAND && LIBCRC32C
++ depends on INFINIBAND_VIRT_DMA
+ select DMA_VIRT_OPS
+ help
+ This driver implements the iWARP RDMA transport over
+--
+2.27.0
+
--- /dev/null
+From fa91b3050f9d3287be4c5d74a3b43ca4bc56a0e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 18:16:33 +0800
+Subject: selftests/bpf: Fix error return code in run_getsockopt_test()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 2acc3c1bc8e98bc66b1badec42e9ea205b4fcdaa ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 65b4414a05eb ("selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201116101633.64627-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/sockopt_multi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
+index 29188d6f5c8de..51fac975b3163 100644
+--- a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
++++ b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
+@@ -138,7 +138,8 @@ static int run_getsockopt_test(struct bpf_object *obj, int cg_parent,
+ */
+
+ buf = 0x40;
+- if (setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1) < 0) {
++ err = setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1);
++ if (err < 0) {
+ log_err("Failed to call setsockopt(IP_TOS)");
+ goto detach;
+ }
+--
+2.27.0
+
gfs2-fix-possible-reference-leak-in-gfs2_check_blk_t.patch
hwmon-pwm-fan-fix-rpm-calculation.patch
compiler.h-fix-barrier_data-on-clang.patch
+arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch
+arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch
+arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch
+arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch
+arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch
+arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch
+revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch
+arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch
+arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch
+arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch
+arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch
+arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch
+arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch
+arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch
+arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch
+input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch
+mips-export-has_transparent_hugepage-for-modules.patch
+arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch
+arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch
+arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch
+swiotlb-using-size_max-needs-limits.h-included.patch
+arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch
+arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch
+input-resistive-adc-touch-fix-kconfig-dependency-on-.patch
+rfkill-fix-use-after-free-in-rfkill_resume.patch
+rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch
+rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch
+perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch
+tools-bpftool-add-missing-close-before-bpftool-net-a.patch
+ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch-19704
+can-dev-can_restart-post-buffer-from-the-right-conte.patch
+can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch
+can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch
+can-peak_usb-fix-potential-integer-overflow-on-shift.patch
+can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch
+can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch
+can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch
+can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch
+can-m_can-m_can_handle_state_change-fix-state-change.patch
+can-m_can-m_can_class_free_dev-introduce-new-functio.patch
+can-m_can-m_can_stop-set-device-to-software-init-mod.patch
+asoc-qcom-lpass-platform-fix-memory-leak.patch
+selftests-bpf-fix-error-return-code-in-run_getsockop.patch
+mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch
+drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch
+net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch
+bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch
+bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch
+can-kvaser_pciefd-fix-kcan-bittiming-limits.patch
+can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch
+iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch
+iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch
+can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch
+can-m_can-process-interrupt-only-when-not-runtime-su.patch
+xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch
+xfs-strengthen-rmap-record-flags-checking.patch
+xfs-return-corresponding-errcode-if-xfs_initialize_p.patch
+regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
+fail_function-remove-a-redundant-mutex-unlock.patch
+xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch
+bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch
+bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch
+bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch
+bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch
+efi-x86-free-efi_pgd-with-free_pages.patch
+libfs-fix-error-cast-of-negative-value-in-simple_att.patch
+hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch
+hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch
+hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch
--- /dev/null
+From 3848b8eebbf88639c27cc7c34670e81d1718fd12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 12:43:27 +1100
+Subject: swiotlb: using SIZE_MAX needs limits.h included
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+[ Upstream commit f51778db088b2407ec177f2f4da0f6290602aa3f ]
+
+After merging the drm-misc tree, linux-next build (arm
+multi_v7_defconfig) failed like this:
+
+In file included from drivers/gpu/drm/nouveau/nouveau_ttm.c:26:
+include/linux/swiotlb.h: In function 'swiotlb_max_mapping_size':
+include/linux/swiotlb.h:99:9: error: 'SIZE_MAX' undeclared (first use in this function)
+ 99 | return SIZE_MAX;
+ | ^~~~~~~~
+include/linux/swiotlb.h:7:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'?
+ 6 | #include <linux/init.h>
+ +++ |+#include <stdint.h>
+ 7 | #include <linux/types.h>
+include/linux/swiotlb.h:99:9: note: each undeclared identifier is reported only once for each function it appears in
+ 99 | return SIZE_MAX;
+ | ^~~~~~~~
+
+Caused by commit
+
+ abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")
+
+but only exposed by commit "drm/nouveu: fix swiotlb include"
+
+Fix it by including linux/limits.h as appropriate.
+
+Fixes: abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Link: https://lore.kernel.org/r/20201102124327.2f82b2a7@canb.auug.org.au
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swiotlb.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
+index cde3dc18e21a2..0a8fced6aaec4 100644
+--- a/include/linux/swiotlb.h
++++ b/include/linux/swiotlb.h
+@@ -5,6 +5,7 @@
+ #include <linux/dma-direction.h>
+ #include <linux/init.h>
+ #include <linux/types.h>
++#include <linux/limits.h>
+
+ struct device;
+ struct page;
+--
+2.27.0
+
--- /dev/null
+From c1c285ab009df3f1b8cfee19b9f493cb8321cb39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 19:51:52 +0800
+Subject: tools, bpftool: Add missing close before bpftool net attach exit
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 50431b45685b600fc2851a3f2b53e24643efe6d3 ]
+
+progfd is created by prog_parse_fd() in do_attach() and before the latter
+returns in case of success, the file descriptor should be closed.
+
+Fixes: 04949ccc273e ("tools: bpftool: add net attach command to attach XDP on interface")
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201113115152.53178-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/net.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
+index 4f52d31516166..bb311ccc6c487 100644
+--- a/tools/bpf/bpftool/net.c
++++ b/tools/bpf/bpftool/net.c
+@@ -312,8 +312,8 @@ static int do_attach(int argc, char **argv)
+
+ ifindex = net_parse_dev(&argc, &argv);
+ if (ifindex < 1) {
+- close(progfd);
+- return -EINVAL;
++ err = -EINVAL;
++ goto cleanup;
+ }
+
+ if (argc) {
+@@ -321,8 +321,8 @@ static int do_attach(int argc, char **argv)
+ overwrite = true;
+ } else {
+ p_err("expected 'overwrite', got: '%s'?", *argv);
+- close(progfd);
+- return -EINVAL;
++ err = -EINVAL;
++ goto cleanup;
+ }
+ }
+
+@@ -330,17 +330,17 @@ static int do_attach(int argc, char **argv)
+ if (is_prefix("xdp", attach_type_strings[attach_type]))
+ err = do_attach_detach_xdp(progfd, attach_type, ifindex,
+ overwrite);
+-
+- if (err < 0) {
++ if (err) {
+ p_err("interface %s attach failed: %s",
+ attach_type_strings[attach_type], strerror(-err));
+- return err;
++ goto cleanup;
+ }
+
+ if (json_output)
+ jsonw_null(json_wtr);
+-
+- return 0;
++cleanup:
++ close(progfd);
++ return err;
+ }
+
+ static int do_detach(int argc, char **argv)
+--
+2.27.0
+
--- /dev/null
+From 8a45b87c7cacf03a6edecadcb35d8ad547ad898e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:32:41 -0800
+Subject: xfs: fix the minrecs logic when dealing with inode root child blocks
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit e95b6c3ef1311dd7b20467d932a24b6d0fd88395 ]
+
+The comment and logic in xchk_btree_check_minrecs for dealing with
+inode-rooted btrees isn't quite correct. While the direct children of
+the inode root are allowed to have fewer records than what would
+normally be allowed for a regular ondisk btree block, this is only true
+if there is only one child block and the number of records don't fit in
+the inode root.
+
+Fixes: 08a3a692ef58 ("xfs: btree scrub should check minrecs")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/btree.c | 45 ++++++++++++++++++++++++++------------------
+ 1 file changed, 27 insertions(+), 18 deletions(-)
+
+diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
+index f52a7b8256f96..debf392e05156 100644
+--- a/fs/xfs/scrub/btree.c
++++ b/fs/xfs/scrub/btree.c
+@@ -452,32 +452,41 @@ xchk_btree_check_minrecs(
+ int level,
+ struct xfs_btree_block *block)
+ {
+- unsigned int numrecs;
+- int ok_level;
+-
+- numrecs = be16_to_cpu(block->bb_numrecs);
++ struct xfs_btree_cur *cur = bs->cur;
++ unsigned int root_level = cur->bc_nlevels - 1;
++ unsigned int numrecs = be16_to_cpu(block->bb_numrecs);
+
+ /* More records than minrecs means the block is ok. */
+- if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level))
++ if (numrecs >= cur->bc_ops->get_minrecs(cur, level))
+ return;
+
+ /*
+- * Certain btree blocks /can/ have fewer than minrecs records. Any
+- * level greater than or equal to the level of the highest dedicated
+- * btree block are allowed to violate this constraint.
+- *
+- * For a btree rooted in a block, the btree root can have fewer than
+- * minrecs records. If the btree is rooted in an inode and does not
+- * store records in the root, the direct children of the root and the
+- * root itself can have fewer than minrecs records.
++ * For btrees rooted in the inode, it's possible that the root block
++ * contents spilled into a regular ondisk block because there wasn't
++ * enough space in the inode root. The number of records in that
++ * child block might be less than the standard minrecs, but that's ok
++ * provided that there's only one direct child of the root.
+ */
+- ok_level = bs->cur->bc_nlevels - 1;
+- if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
+- ok_level--;
+- if (level >= ok_level)
++ if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) &&
++ level == cur->bc_nlevels - 2) {
++ struct xfs_btree_block *root_block;
++ struct xfs_buf *root_bp;
++ int root_maxrecs;
++
++ root_block = xfs_btree_get_block(cur, root_level, &root_bp);
++ root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level);
++ if (be16_to_cpu(root_block->bb_numrecs) != 1 ||
++ numrecs <= root_maxrecs)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ return;
++ }
+
+- xchk_btree_set_corrupt(bs->sc, bs->cur, level);
++ /*
++ * Otherwise, only the root level is allowed to have fewer than minrecs
++ * records or keyptrs.
++ */
++ if (level < root_level)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 86b2bcd8ad0eae1375a4a9f23692680cddab8ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:21:26 -0800
+Subject: xfs: return corresponding errcode if xfs_initialize_perag() fail
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 595189c25c28a55523354336bf24453242c81c15 ]
+
+In xfs_initialize_perag(), if kmem_zalloc(), xfs_buf_hash_init(), or
+radix_tree_preload() failed, the returned value 'error' is not set
+accordingly.
+
+Reported-as-fixing: 8b26c5825e02 ("xfs: handle ENOMEM correctly during initialisation of perag structures")
+Fixes: 9b2471797942 ("xfs: cache unlinked pointers in an rhashtable")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_mount.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
+index ba5b6f3b2b88a..5a0ce0c2c4bbd 100644
+--- a/fs/xfs/xfs_mount.c
++++ b/fs/xfs/xfs_mount.c
+@@ -195,21 +195,26 @@ xfs_initialize_perag(
+ }
+
+ pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL);
+- if (!pag)
++ if (!pag) {
++ error = -ENOMEM;
+ goto out_unwind_new_pags;
++ }
+ pag->pag_agno = index;
+ pag->pag_mount = mp;
+ spin_lock_init(&pag->pag_ici_lock);
+ mutex_init(&pag->pag_ici_reclaim_lock);
+ INIT_RADIX_TREE(&pag->pag_ici_root, GFP_ATOMIC);
+- if (xfs_buf_hash_init(pag))
++
++ error = xfs_buf_hash_init(pag);
++ if (error)
+ goto out_free_pag;
+ init_waitqueue_head(&pag->pagb_wait);
+ spin_lock_init(&pag->pagb_lock);
+ pag->pagb_count = 0;
+ pag->pagb_tree = RB_ROOT;
+
+- if (radix_tree_preload(GFP_NOFS))
++ error = radix_tree_preload(GFP_NOFS);
++ if (error)
+ goto out_hash_destroy;
+
+ spin_lock(&mp->m_perag_lock);
+--
+2.27.0
+
--- /dev/null
+From ffb5b38055d38aca5773188e3831c3b7bdb91526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 15:17:50 -0800
+Subject: xfs: revert "xfs: fix rmap key and record comparison functions"
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ]
+
+This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f.
+
+Your maintainer committed a major braino in the rmap code by adding the
+attr fork, bmbt, and unwritten extent usage bits into rmap record key
+comparisons. While XFS uses the usage bits *in the rmap records* for
+cross-referencing metadata in xfs_scrub and xfs_repair, it only needs
+the owner and offset information to distinguish between reverse mappings
+of the same physical extent into the data fork of a file at multiple
+offsets. The other bits are not important for key comparisons for index
+lookups, and never have been.
+
+Eric Sandeen reports that this causes regressions in generic/299, so
+undo this patch before it does more damage.
+
+Reported-by: Eric Sandeen <sandeen@sandeen.net>
+Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
+index 3780609c7860c..fc78efa52c94e 100644
+--- a/fs/xfs/libxfs/xfs_rmap_btree.c
++++ b/fs/xfs/libxfs/xfs_rmap_btree.c
+@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp->rm_offset);
+- y = xfs_rmap_irec_offset_pack(rec);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
++ y = rec->rm_offset;
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp1->rm_offset);
+- y = be64_to_cpu(kp2->rm_offset);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(k1->rmap.rm_offset);
+- b = be64_to_cpu(k2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(r1->rmap.rm_offset);
+- b = be64_to_cpu(r2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From d0e5b29e878abc33e4ee922726aab0771fdec3b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:32:41 -0800
+Subject: xfs: strengthen rmap record flags checking
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 498fe261f0d6d5189f8e11d283705dd97b474b54 ]
+
+We always know the correct state of the rmap record flags (attr, bmbt,
+unwritten) so check them by direct comparison.
+
+Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/bmap.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index ec580c0d70fa3..52892f41eb2d8 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -218,13 +218,13 @@ xchk_bmap_xref_rmap(
+ * which doesn't track unwritten state.
+ */
+ if (owner != XFS_RMAP_OWN_COW &&
+- irec->br_state == XFS_EXT_UNWRITTEN &&
+- !(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
++ !!(irec->br_state == XFS_EXT_UNWRITTEN) !=
++ !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+
+- if (info->whichfork == XFS_ATTR_FORK &&
+- !(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
++ if (!!(info->whichfork == XFS_ATTR_FORK) !=
++ !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+ if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
