--- /dev/null
+From 23fcc1a6f7c61074d2788e96112585c619fa677c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 10:44:33 +0930
+Subject: ARM: config: multi v7: Enable dependancies
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit cf8dd57bd0d62133e4ed9e1ad83af994fac34da5 ]
+
+Some drivers have not been built as they gained dependencies in kconfig but those
+dependencies were not added to the defconfig.
+
+The MSM pinctrl drivers fell out of the defconfig as of commit be117ca32261
+("pinctrl: qcom: Kconfig: Rework PINCTRL_MSM to be a depenency rather then a
+selected config"). Add PINCTRL_MSM so these stay enabled.
+
+EDAC depends on RAS, so enable it to ensure the EDAC drivers stay
+enabled.
+
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/multi_v7_defconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
+index d9abaae118dd..bd5775184c03 100644
+--- a/arch/arm/configs/multi_v7_defconfig
++++ b/arch/arm/configs/multi_v7_defconfig
+@@ -454,6 +454,7 @@ CONFIG_PINCTRL_STMFX=y
+ CONFIG_PINCTRL_PALMAS=y
+ CONFIG_PINCTRL_OWL=y
+ CONFIG_PINCTRL_S500=y
++CONFIG_PINCTRL_MSM=y
+ CONFIG_PINCTRL_APQ8064=y
+ CONFIG_PINCTRL_APQ8084=y
+ CONFIG_PINCTRL_IPQ8064=y
+@@ -1114,6 +1115,7 @@ CONFIG_PHY_DM816X_USB=m
+ CONFIG_OMAP_USB2=y
+ CONFIG_TI_PIPE3=y
+ CONFIG_TWL4030_USB=m
++CONFIG_RAS=y
+ CONFIG_NVMEM_IMX_OCOTP=y
+ CONFIG_ROCKCHIP_EFUSE=m
+ CONFIG_NVMEM_SUNXI_SID=y
+--
+2.33.0
+
--- /dev/null
+From 32dabe1794f5767b624925abcf461bac3f856e33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 10:44:34 +0930
+Subject: ARM: config: mutli v7: Reenable FB dependency
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 8c1768967e2733d55abf449d8abd6f1915ba3539 ]
+
+DRM_FBDEV_EMULATION previously selected FB and was default y as long as DRM
+was enabled. In commit f611b1e7624c ("drm: Avoid circular dependencies for
+CONFIG_FB") the select was replaced with a depends on FB, disabling the
+drivers that depended on it.
+
+Renable FB so we get back FB_EFI, FB_WM8505, FB_SH_MOBILE_LCDC, FB_SIMPLE and
+VIDEO_VIVID.
+
+It must be set to y and not a module as the test driver VIDEO_VIVID
+requires it to be built in.
+
+Link: https://lore.kernel.org/r/CAK8P3a18EdBKQdGDOZc9cPKsf=hY8==v2cO0DBE_tyd82Uq-Ng@mail.gmail.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/multi_v7_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
+index bd5775184c03..707fb2c2fdda 100644
+--- a/arch/arm/configs/multi_v7_defconfig
++++ b/arch/arm/configs/multi_v7_defconfig
+@@ -721,6 +721,7 @@ CONFIG_DRM_PL111=m
+ CONFIG_DRM_LIMA=m
+ CONFIG_DRM_PANFROST=m
+ CONFIG_DRM_ASPEED_GFX=m
++CONFIG_FB=y
+ CONFIG_FB_EFI=y
+ CONFIG_FB_WM8505=y
+ CONFIG_FB_SH_MOBILE_LCDC=y
+--
+2.33.0
+
--- /dev/null
+From ad70f4e9c49557322af2fedb59caca15e9448840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 15:13:58 +0300
+Subject: ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 4348cc10da6377a86940beb20ad357933b8f91bb ]
+
+Without a sensor node, the ISC will simply fail to probe, as the
+corresponding port node is missing.
+It is then logical to disable the node in the devicetree.
+If we add a port with a connection to a sensor endpoint, ISC can be enabled.
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20210902121358.503589-1-eugen.hristev@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+index 8034e5dacc80..949df688c5f1 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+@@ -71,7 +71,6 @@
+ isc: isc@f0008000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_isc_base &pinctrl_isc_data_8bit &pinctrl_isc_data_9_10 &pinctrl_isc_data_11_12>;
+- status = "okay";
+ };
+
+ qspi1: spi@f0024000 {
+--
+2.33.0
+
--- /dev/null
+From 22d9aebe296f6a8cc554d8d34ed3d38c52458b6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 13:42:38 -0500
+Subject: arm: dts: vexpress-v2p-ca9: Fix the SMB unit-address
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2e9edc07df2ec6f835222151fa4e536e9e54856a ]
+
+Based on 'ranges', the 'bus@4000000' node unit-address is off by 1 '0'.
+
+Link: https://lore.kernel.org/r/20210819184239.1192395-5-robh@kernel.org
+Cc: Andre Przywara <andre.przywara@arm.com>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/vexpress-v2m.dtsi | 2 +-
+ arch/arm/boot/dts/vexpress-v2p-ca9.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/vexpress-v2m.dtsi b/arch/arm/boot/dts/vexpress-v2m.dtsi
+index ec13ceb9ed36..79ba83d1f620 100644
+--- a/arch/arm/boot/dts/vexpress-v2m.dtsi
++++ b/arch/arm/boot/dts/vexpress-v2m.dtsi
+@@ -19,7 +19,7 @@
+ */
+
+ / {
+- bus@4000000 {
++ bus@40000000 {
+ motherboard {
+ model = "V2M-P1";
+ arm,hbi = <0x190>;
+diff --git a/arch/arm/boot/dts/vexpress-v2p-ca9.dts b/arch/arm/boot/dts/vexpress-v2p-ca9.dts
+index 4c5847955856..1317f0f58d53 100644
+--- a/arch/arm/boot/dts/vexpress-v2p-ca9.dts
++++ b/arch/arm/boot/dts/vexpress-v2p-ca9.dts
+@@ -295,7 +295,7 @@
+ };
+ };
+
+- smb: bus@4000000 {
++ smb: bus@40000000 {
+ compatible = "simple-bus";
+
+ #address-cells = <2>;
+--
+2.33.0
+
--- /dev/null
+From ce84bde87107084c2f58acf34005b42d4194d317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 16:22:07 +0900
+Subject: block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+[ Upstream commit 1dbdd99b511c966be9147ad72991a2856ac76f22 ]
+
+While debugging an issue we've found that $DEBUGFS/block/$disk/state
+doesn't decode QUEUE_FLAG_HCTX_ACTIVE but only displays its numerical
+value.
+
+Add QUEUE_FLAG(HCTX_ACTIVE) to the blk_queue_flag_name array so it'll get
+decoded properly.
+
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/4351076388918075bd80ef07756f9d2ce63be12c.1633332053.git.johannes.thumshirn@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 4b66d2776eda..3b38d15723de 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -129,6 +129,7 @@ static const char *const blk_queue_flag_name[] = {
+ QUEUE_FLAG_NAME(PCI_P2PDMA),
+ QUEUE_FLAG_NAME(ZONE_RESETALL),
+ QUEUE_FLAG_NAME(RQ_ALLOC_TIME),
++ QUEUE_FLAG_NAME(HCTX_ACTIVE),
+ QUEUE_FLAG_NAME(NOWAIT),
+ };
+ #undef QUEUE_FLAG_NAME
+--
+2.33.0
+
--- /dev/null
+From 4739041d3f21668ecf4d0dc5c73d782467e03d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Oct 2021 15:40:00 -0400
+Subject: drm/amdgpu/display: fix dependencies for DRM_AMD_DC_SI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 4702b34d1de9582df9dfa0e583ea28fff7de29df ]
+
+Depends on DRM_AMDGPU_SI and DRM_AMD_DC
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/Kconfig b/drivers/gpu/drm/amd/display/Kconfig
+index 7dffc04a557e..127667e549c1 100644
+--- a/drivers/gpu/drm/amd/display/Kconfig
++++ b/drivers/gpu/drm/amd/display/Kconfig
+@@ -25,6 +25,8 @@ config DRM_AMD_DC_HDCP
+
+ config DRM_AMD_DC_SI
+ bool "AMD DC support for Southern Islands ASICs"
++ depends on DRM_AMDGPU_SI
++ depends on DRM_AMD_DC
+ default n
+ help
+ Choose this option to enable new AMD DC support for SI asics
+--
+2.33.0
+
--- /dev/null
+From 26050dbdbe9ac9cf1ec3ec3b1b32fa57be17ec7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Sep 2021 15:42:35 +0800
+Subject: drm/amdgpu: init iommu after amdkfd device init
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 714d9e4574d54596973ee3b0624ee4a16264d700 ]
+
+This patch is to fix clinfo failure in Raven/Picasso:
+
+Number of platforms: 1
+ Platform Profile: FULL_PROFILE
+ Platform Version: OpenCL 2.2 AMD-APP (3364.0)
+ Platform Name: AMD Accelerated Parallel Processing
+ Platform Vendor: Advanced Micro Devices, Inc.
+ Platform Extensions: cl_khr_icd cl_amd_event_callback
+
+ Platform Name: AMD Accelerated Parallel Processing Number of devices: 0
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: James Zhu <James.Zhu@amd.com>
+Tested-by: James Zhu <James.Zhu@amd.com>
+Acked-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index d60096b3b2c2..cd8cc7d31b49 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2342,10 +2342,6 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ if (r)
+ goto init_failed;
+
+- r = amdgpu_amdkfd_resume_iommu(adev);
+- if (r)
+- goto init_failed;
+-
+ r = amdgpu_device_ip_hw_init_phase1(adev);
+ if (r)
+ goto init_failed;
+@@ -2384,6 +2380,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ if (!adev->gmc.xgmi.pending_reset)
+ amdgpu_amdkfd_device_init(adev);
+
++ r = amdgpu_amdkfd_resume_iommu(adev);
++ if (r)
++ goto init_failed;
++
+ amdgpu_fru_get_product_info(adev);
+
+ init_failed:
+--
+2.33.0
+
--- /dev/null
+From 26ceaba55ef4e4e4c0a236a3479aa877e66da6ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 13:20:44 -0400
+Subject: NFSD: Keep existing listeners on portlist error
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit c20106944eb679fa3ab7e686fe5f6ba30fbc51e5 ]
+
+If nfsd has existing listening sockets without any processes, then an error
+returned from svc_create_xprt() for an additional transport will remove
+those existing listeners. We're seeing this in practice when userspace
+attempts to create rpcrdma transports without having the rpcrdma modules
+present before creating nfsd kernel processes. Fix this by checking for
+existing sockets before calling nfsd_destroy().
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfsctl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 09ae1a0873d0..070e5dd03e26 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -793,7 +793,10 @@ out_close:
+ svc_xprt_put(xprt);
+ }
+ out_err:
+- nfsd_destroy(net);
++ if (!list_empty(&nn->nfsd_serv->sv_permsocks))
++ nn->nfsd_serv->sv_nrthreads--;
++ else
++ nfsd_destroy(net);
+ return err;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From c5e93f9c7038ada064e3e12e8ce4ad351929eefd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 01:55:25 +0530
+Subject: powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit b7540d62509453263604a155bf2d5f0ed450cba2 ]
+
+Emit similar instruction sequences to commit a048a07d7f4535
+("powerpc/64s: Add support for a store forwarding barrier at kernel
+entry/exit") when encountering BPF_NOSPEC.
+
+Mitigations are enabled depending on what the firmware advertises. In
+particular, we do not gate these mitigations based on current settings,
+just like in x86. Due to this, we don't need to take any action if
+mitigations are enabled or disabled at runtime.
+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/956570cbc191cd41f8274bed48ee757a86dac62a.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/net/bpf_jit64.h | 8 ++---
+ arch/powerpc/net/bpf_jit_comp64.c | 55 ++++++++++++++++++++++++++++---
+ 2 files changed, 55 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h
+index 7b713edfa7e2..b63b35e45e55 100644
+--- a/arch/powerpc/net/bpf_jit64.h
++++ b/arch/powerpc/net/bpf_jit64.h
+@@ -16,18 +16,18 @@
+ * with our redzone usage.
+ *
+ * [ prev sp ] <-------------
+- * [ nv gpr save area ] 6*8 |
++ * [ nv gpr save area ] 5*8 |
+ * [ tail_call_cnt ] 8 |
+- * [ local_tmp_var ] 8 |
++ * [ local_tmp_var ] 16 |
+ * fp (r31) --> [ ebpf stack space ] upto 512 |
+ * [ frame header ] 32/112 |
+ * sp (r1) ---> [ stack pointer ] --------------
+ */
+
+ /* for gpr non volatile registers BPG_REG_6 to 10 */
+-#define BPF_PPC_STACK_SAVE (6*8)
++#define BPF_PPC_STACK_SAVE (5*8)
+ /* for bpf JIT code internal usage */
+-#define BPF_PPC_STACK_LOCALS 16
++#define BPF_PPC_STACK_LOCALS 24
+ /* stack frame excluding BPF stack, ensure this is quadword aligned */
+ #define BPF_PPC_STACKFRAME (STACK_FRAME_MIN_SIZE + \
+ BPF_PPC_STACK_LOCALS + BPF_PPC_STACK_SAVE)
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 2ea1c3f6e287..8b5157ccfeba 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -15,6 +15,7 @@
+ #include <linux/if_vlan.h>
+ #include <asm/kprobes.h>
+ #include <linux/bpf.h>
++#include <asm/security_features.h>
+
+ #include "bpf_jit64.h"
+
+@@ -35,9 +36,9 @@ static inline bool bpf_has_stack_frame(struct codegen_context *ctx)
+ * [ prev sp ] <-------------
+ * [ ... ] |
+ * sp (r1) ---> [ stack pointer ] --------------
+- * [ nv gpr save area ] 6*8
++ * [ nv gpr save area ] 5*8
+ * [ tail_call_cnt ] 8
+- * [ local_tmp_var ] 8
++ * [ local_tmp_var ] 16
+ * [ unused red zone ] 208 bytes protected
+ */
+ static int bpf_jit_stack_local(struct codegen_context *ctx)
+@@ -45,12 +46,12 @@ static int bpf_jit_stack_local(struct codegen_context *ctx)
+ if (bpf_has_stack_frame(ctx))
+ return STACK_FRAME_MIN_SIZE + ctx->stack_size;
+ else
+- return -(BPF_PPC_STACK_SAVE + 16);
++ return -(BPF_PPC_STACK_SAVE + 24);
+ }
+
+ static int bpf_jit_stack_tailcallcnt(struct codegen_context *ctx)
+ {
+- return bpf_jit_stack_local(ctx) + 8;
++ return bpf_jit_stack_local(ctx) + 16;
+ }
+
+ static int bpf_jit_stack_offsetof(struct codegen_context *ctx, int reg)
+@@ -272,10 +273,33 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o
+ return 0;
+ }
+
++/*
++ * We spill into the redzone always, even if the bpf program has its own stackframe.
++ * Offsets hardcoded based on BPF_PPC_STACK_SAVE -- see bpf_jit_stack_local()
++ */
++void bpf_stf_barrier(void);
++
++asm (
++" .global bpf_stf_barrier ;"
++" bpf_stf_barrier: ;"
++" std 21,-64(1) ;"
++" std 22,-56(1) ;"
++" sync ;"
++" ld 21,-64(1) ;"
++" ld 22,-56(1) ;"
++" ori 31,31,0 ;"
++" .rept 14 ;"
++" b 1f ;"
++" 1: ;"
++" .endr ;"
++" blr ;"
++);
++
+ /* Assemble the body code between the prologue & epilogue */
+ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *ctx,
+ u32 *addrs, bool extra_pass)
+ {
++ enum stf_barrier_type stf_barrier = stf_barrier_type_get();
+ const struct bpf_insn *insn = fp->insnsi;
+ int flen = fp->len;
+ int i, ret;
+@@ -646,6 +670,29 @@ emit_clear:
+ * BPF_ST NOSPEC (speculation barrier)
+ */
+ case BPF_ST | BPF_NOSPEC:
++ if (!security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) ||
++ !security_ftr_enabled(SEC_FTR_STF_BARRIER))
++ break;
++
++ switch (stf_barrier) {
++ case STF_BARRIER_EIEIO:
++ EMIT(PPC_RAW_EIEIO() | 0x02000000);
++ break;
++ case STF_BARRIER_SYNC_ORI:
++ EMIT(PPC_RAW_SYNC());
++ EMIT(PPC_RAW_LD(b2p[TMP_REG_1], _R13, 0));
++ EMIT(PPC_RAW_ORI(_R31, _R31, 0));
++ break;
++ case STF_BARRIER_FALLBACK:
++ EMIT(PPC_RAW_MFLR(b2p[TMP_REG_1]));
++ PPC_LI64(12, dereference_kernel_function_descriptor(bpf_stf_barrier));
++ EMIT(PPC_RAW_MTCTR(12));
++ EMIT(PPC_RAW_BCTRL());
++ EMIT(PPC_RAW_MTLR(b2p[TMP_REG_1]));
++ break;
++ case STF_BARRIER_NONE:
++ break;
++ }
+ break;
+
+ /*
+--
+2.33.0
+
--- /dev/null
+From 369cb852523e1b5cc62bfa95d103410914d17379 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 01:55:21 +0530
+Subject: powerpc/bpf: Validate branch ranges
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 3832ba4e283d7052b783dab8311df7e3590fed93 ]
+
+Add checks to ensure that we never emit branch instructions with
+truncated branch offsets.
+
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Song Liu <songliubraving@fb.com>
+Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/net/bpf_jit.h | 26 ++++++++++++++++++++------
+ arch/powerpc/net/bpf_jit_comp.c | 6 +++++-
+ arch/powerpc/net/bpf_jit_comp32.c | 8 ++++++--
+ arch/powerpc/net/bpf_jit_comp64.c | 8 ++++++--
+ 4 files changed, 37 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
+index 935ea95b6635..7e9b978b768e 100644
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -24,16 +24,30 @@
+ #define EMIT(instr) PLANT_INSTR(image, ctx->idx, instr)
+
+ /* Long jump; (unconditional 'branch') */
+-#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \
+- (((dest) - (ctx->idx * 4)) & 0x03fffffc))
++#define PPC_JMP(dest) \
++ do { \
++ long offset = (long)(dest) - (ctx->idx * 4); \
++ if (!is_offset_in_branch_range(offset)) { \
++ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
++ return -ERANGE; \
++ } \
++ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \
++ } while (0)
++
+ /* blr; (unconditional 'branch' with link) to absolute address */
+ #define PPC_BL_ABS(dest) EMIT(PPC_INST_BL | \
+ (((dest) - (unsigned long)(image + ctx->idx)) & 0x03fffffc))
+ /* "cond" here covers BO:BI fields. */
+-#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \
+- (((cond) & 0x3ff) << 16) | \
+- (((dest) - (ctx->idx * 4)) & \
+- 0xfffc))
++#define PPC_BCC_SHORT(cond, dest) \
++ do { \
++ long offset = (long)(dest) - (ctx->idx * 4); \
++ if (!is_offset_in_cond_branch_range(offset)) { \
++ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
++ return -ERANGE; \
++ } \
++ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \
++ } while (0)
++
+ /* Sign-extended 32-bit immediate load */
+ #define PPC_LI32(d, i) do { \
+ if ((int)(uintptr_t)(i) >= -32768 && \
+diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
+index 53aefee3fe70..fcbf7a917c56 100644
+--- a/arch/powerpc/net/bpf_jit_comp.c
++++ b/arch/powerpc/net/bpf_jit_comp.c
+@@ -210,7 +210,11 @@ skip_init_ctx:
+ /* Now build the prologue, body code & epilogue for real. */
+ cgctx.idx = 0;
+ bpf_jit_build_prologue(code_base, &cgctx);
+- bpf_jit_build_body(fp, code_base, &cgctx, addrs, extra_pass);
++ if (bpf_jit_build_body(fp, code_base, &cgctx, addrs, extra_pass)) {
++ bpf_jit_binary_free(bpf_hdr);
++ fp = org_fp;
++ goto out_addrs;
++ }
+ bpf_jit_build_epilogue(code_base, &cgctx);
+
+ if (bpf_jit_enable > 1)
+diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c
+index a7759aa8043d..0da31d41d413 100644
+--- a/arch/powerpc/net/bpf_jit_comp32.c
++++ b/arch/powerpc/net/bpf_jit_comp32.c
+@@ -200,7 +200,7 @@ void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 fun
+ }
+ }
+
+-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
++static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
+ {
+ /*
+ * By now, the eBPF program has already setup parameters in r3-r6
+@@ -261,7 +261,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ bpf_jit_emit_common_epilogue(image, ctx);
+
+ EMIT(PPC_RAW_BCTR());
++
+ /* out: */
++ return 0;
+ }
+
+ /* Assemble the body code between the prologue & epilogue */
+@@ -1090,7 +1092,9 @@ cond_branch:
+ */
+ case BPF_JMP | BPF_TAIL_CALL:
+ ctx->seen |= SEEN_TAILCALL;
+- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ if (ret < 0)
++ return ret;
+ break;
+
+ default:
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index dff4a2930970..2ea1c3f6e287 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -206,7 +206,7 @@ void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 fun
+ EMIT(PPC_RAW_BCTRL());
+ }
+
+-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
++static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
+ {
+ /*
+ * By now, the eBPF program has already setup parameters in r3, r4 and r5
+@@ -267,7 +267,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ bpf_jit_emit_common_epilogue(image, ctx);
+
+ EMIT(PPC_RAW_BCTR());
++
+ /* out: */
++ return 0;
+ }
+
+ /* Assemble the body code between the prologue & epilogue */
+@@ -1006,7 +1008,9 @@ cond_branch:
+ */
+ case BPF_JMP | BPF_TAIL_CALL:
+ ctx->seen |= SEEN_TAILCALL;
+- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ if (ret < 0)
++ return ret;
+ break;
+
+ default:
+--
+2.33.0
+
--- /dev/null
+From 9502bea59e1ac97684e8ce55e2c7e606088f8a8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 01:55:20 +0530
+Subject: powerpc/lib: Add helper to check if offset is within conditional
+ branch range
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 4549c3ea3160fa8b3f37dfe2f957657bb265eda9 ]
+
+Add a helper to check if a given offset is within the branch range for a
+powerpc conditional branch instruction, and update some sites to use the
+new helper.
+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/442b69a34ced32ca346a0d9a855f3f6cfdbbbd41.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/code-patching.h | 1 +
+ arch/powerpc/lib/code-patching.c | 7 ++++++-
+ arch/powerpc/net/bpf_jit.h | 7 +------
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
+index a95f63788c6b..4ba834599c4d 100644
+--- a/arch/powerpc/include/asm/code-patching.h
++++ b/arch/powerpc/include/asm/code-patching.h
+@@ -23,6 +23,7 @@
+ #define BRANCH_ABSOLUTE 0x2
+
+ bool is_offset_in_branch_range(long offset);
++bool is_offset_in_cond_branch_range(long offset);
+ int create_branch(struct ppc_inst *instr, const u32 *addr,
+ unsigned long target, int flags);
+ int create_cond_branch(struct ppc_inst *instr, const u32 *addr,
+diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
+index f9a3019e37b4..c5ed98823835 100644
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -228,6 +228,11 @@ bool is_offset_in_branch_range(long offset)
+ return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
+ }
+
++bool is_offset_in_cond_branch_range(long offset)
++{
++ return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3);
++}
++
+ /*
+ * Helper to check if a given instruction is a conditional branch
+ * Derived from the conditional checks in analyse_instr()
+@@ -280,7 +285,7 @@ int create_cond_branch(struct ppc_inst *instr, const u32 *addr,
+ offset = offset - (unsigned long)addr;
+
+ /* Check we can represent the target in the instruction format */
+- if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
++ if (!is_offset_in_cond_branch_range(offset))
+ return 1;
+
+ /* Mask out the flags and target, so they don't step on each other. */
+diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
+index 99fad093f43e..935ea95b6635 100644
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -78,11 +78,6 @@
+ #define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0)
+ #endif
+
+-static inline bool is_nearbranch(int offset)
+-{
+- return (offset < 32768) && (offset >= -32768);
+-}
+-
+ /*
+ * The fly in the ointment of code size changing from pass to pass is
+ * avoided by padding the short branch case with a NOP. If code size differs
+@@ -91,7 +86,7 @@ static inline bool is_nearbranch(int offset)
+ * state.
+ */
+ #define PPC_BCC(cond, dest) do { \
+- if (is_nearbranch((dest) - (ctx->idx * 4))) { \
++ if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) { \
+ PPC_BCC_SHORT(cond, dest); \
+ EMIT(PPC_RAW_NOP()); \
+ } else { \
+--
+2.33.0
+
--- /dev/null
+From c87e8ee05395d2243ba25ba6a639f6f5ea55c427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 01:55:24 +0530
+Subject: powerpc/security: Add a helper to query stf_barrier type
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 030905920f32e91a52794937f67434ac0b3ea41a ]
+
+Add a helper to return the stf_barrier type for the current processor.
+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/3bd5d7f96ea1547991ac2ce3137dc2b220bae285.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/security_features.h | 5 +++++
+ arch/powerpc/kernel/security.c | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
+index 792eefaf230b..27574f218b37 100644
+--- a/arch/powerpc/include/asm/security_features.h
++++ b/arch/powerpc/include/asm/security_features.h
+@@ -39,6 +39,11 @@ static inline bool security_ftr_enabled(u64 feature)
+ return !!(powerpc_security_features & feature);
+ }
+
++#ifdef CONFIG_PPC_BOOK3S_64
++enum stf_barrier_type stf_barrier_type_get(void);
++#else
++static inline enum stf_barrier_type stf_barrier_type_get(void) { return STF_BARRIER_NONE; }
++#endif
+
+ // Features indicating support for Spectre/Meltdown mitigations
+
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index cc51fa52e783..e723ff77cc9b 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -263,6 +263,11 @@ static int __init handle_no_stf_barrier(char *p)
+
+ early_param("no_stf_barrier", handle_no_stf_barrier);
+
++enum stf_barrier_type stf_barrier_type_get(void)
++{
++ return stf_enabled_flush_types;
++}
++
+ /* This is the generic flag used by other architectures */
+ static int __init handle_ssbd(char *p)
+ {
+--
+2.33.0
+
--- /dev/null
+From 8a98ab022cf83e0579e1314418f0b998d7853f9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 14:28:58 +0800
+Subject: r8152: avoid to resubmit rx immediately
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit baf33d7a75642b4b38a87fdf1cd96b506df4849f ]
+
+For the situation that the disconnect event comes very late when the
+device is unplugged, the driver would resubmit the RX bulk transfer
+after getting the callback with -EPROTO immediately and continually.
+Finally, soft lockup occurs.
+
+This patch avoids to resubmit RX immediately. It uses a workqueue to
+schedule the RX NAPI. And the NAPI would resubmit the RX. It let the
+disconnect event have opportunity to stop the submission before soft
+lockup.
+
+Reported-by: Jason-ch Chen <jason-ch.chen@mediatek.com>
+Tested-by: Jason-ch Chen <jason-ch.chen@mediatek.com>
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 79832374f78d..92fca5e9ed03 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -767,6 +767,7 @@ enum rtl8152_flags {
+ PHY_RESET,
+ SCHEDULE_TASKLET,
+ GREEN_ETHERNET,
++ RX_EPROTO,
+ };
+
+ #define DEVICE_ID_THINKPAD_THUNDERBOLT3_DOCK_GEN2 0x3082
+@@ -1770,6 +1771,14 @@ static void read_bulk_callback(struct urb *urb)
+ rtl_set_unplug(tp);
+ netif_device_detach(tp->netdev);
+ return;
++ case -EPROTO:
++ urb->actual_length = 0;
++ spin_lock_irqsave(&tp->rx_lock, flags);
++ list_add_tail(&agg->list, &tp->rx_done);
++ spin_unlock_irqrestore(&tp->rx_lock, flags);
++ set_bit(RX_EPROTO, &tp->flags);
++ schedule_delayed_work(&tp->schedule, 1);
++ return;
+ case -ENOENT:
+ return; /* the urb is in unlink state */
+ case -ETIME:
+@@ -2425,6 +2434,7 @@ static int rx_bottom(struct r8152 *tp, int budget)
+ if (list_empty(&tp->rx_done))
+ goto out1;
+
++ clear_bit(RX_EPROTO, &tp->flags);
+ INIT_LIST_HEAD(&rx_queue);
+ spin_lock_irqsave(&tp->rx_lock, flags);
+ list_splice_init(&tp->rx_done, &rx_queue);
+@@ -2441,7 +2451,7 @@ static int rx_bottom(struct r8152 *tp, int budget)
+
+ agg = list_entry(cursor, struct rx_agg, list);
+ urb = agg->urb;
+- if (urb->actual_length < ETH_ZLEN)
++ if (urb->status != 0 || urb->actual_length < ETH_ZLEN)
+ goto submit;
+
+ agg_free = rtl_get_free_rx(tp, GFP_ATOMIC);
+@@ -6643,6 +6653,10 @@ static void rtl_work_func_t(struct work_struct *work)
+ netif_carrier_ok(tp->netdev))
+ tasklet_schedule(&tp->tx_tl);
+
++ if (test_and_clear_bit(RX_EPROTO, &tp->flags) &&
++ !list_empty(&tp->rx_done))
++ napi_schedule(&tp->napi);
++
+ mutex_unlock(&tp->control);
+
+ out1:
+--
+2.33.0
+
block-mq-deadline-move-dd_queued-to-fix-defined-but-not-used-warning.patch
parisc-math-emu-fix-fall-through-warnings.patch
sh-pgtable-3level-fix-cast-to-pointer-from-integer-of-different-size.patch
+arm-dts-vexpress-v2p-ca9-fix-the-smb-unit-address.patch
+arm-config-multi-v7-enable-dependancies.patch
+arm-config-mutli-v7-reenable-fb-dependency.patch
+arm-dts-at91-sama5d2_som1_ek-disable-isc-node-by-def.patch
+block-decode-queue_flag_hctx_active-in-debugfs-outpu.patch
+xen-x86-prevent-pvh-type-from-getting-clobbered.patch
+r8152-avoid-to-resubmit-rx-immediately.patch
+drm-amdgpu-display-fix-dependencies-for-drm_amd_dc_s.patch
+drm-amdgpu-init-iommu-after-amdkfd-device-init.patch
+xtensa-xtfpga-use-config_use_of-instead-of-config_of.patch
+xtensa-xtfpga-try-software-restart-before-simulating.patch
+nfsd-keep-existing-listeners-on-portlist-error.patch
+powerpc-lib-add-helper-to-check-if-offset-is-within-.patch
+powerpc-bpf-validate-branch-ranges.patch
+powerpc-security-add-a-helper-to-query-stf_barrier-t.patch
+powerpc-bpf-emit-stf-barrier-instruction-sequences-f.patch
--- /dev/null
+From 6b82eb1221a5ae4472fdd8d6d61e038faf97b8bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 14:16:15 +0200
+Subject: xen/x86: prevent PVH type from getting clobbered
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 9172b5c4a778da1f855b2e3780b1afabb3cfd523 ]
+
+Like xen_start_flags, xen_domain_type gets set before .bss gets cleared.
+Hence this variable also needs to be prevented from getting put in .bss,
+which is possible because XEN_NATIVE is an enumerator evaluating to
+zero. Any use prior to init_hvm_pv_info() setting the variable again
+would lead to wrong decisions; one such case is xenboot_console_setup()
+when called as a result of "earlyprintk=xen".
+
+Use __ro_after_init as more applicable than either __section(".data") or
+__read_mostly.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+
+Link: https://lore.kernel.org/r/d301677b-6f22-5ae6-bd36-458e1f323d0b@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/enlighten.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index c79bd0af2e8c..f252faf5028f 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -52,9 +52,6 @@ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
+ DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
+ EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
+
+-enum xen_domain_type xen_domain_type = XEN_NATIVE;
+-EXPORT_SYMBOL_GPL(xen_domain_type);
+-
+ unsigned long *machine_to_phys_mapping = (void *)MACH2PHYS_VIRT_START;
+ EXPORT_SYMBOL(machine_to_phys_mapping);
+ unsigned long machine_to_phys_nr;
+@@ -69,9 +66,11 @@ __read_mostly int xen_have_vector_callback;
+ EXPORT_SYMBOL_GPL(xen_have_vector_callback);
+
+ /*
+- * NB: needs to live in .data because it's used by xen_prepare_pvh which runs
+- * before clearing the bss.
++ * NB: These need to live in .data or alike because they're used by
++ * xen_prepare_pvh() which runs before clearing the bss.
+ */
++enum xen_domain_type __ro_after_init xen_domain_type = XEN_NATIVE;
++EXPORT_SYMBOL_GPL(xen_domain_type);
+ uint32_t xen_start_flags __section(".data") = 0;
+ EXPORT_SYMBOL(xen_start_flags);
+
+--
+2.33.0
+
--- /dev/null
+From 8909b28ea5caeb111b5bc6b8089835ac5d15b854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Aug 2021 10:36:59 -0700
+Subject: xtensa: xtfpga: Try software restart before simulating CPU reset
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 012e974501a270d8dfd4ee2039e1fdf7579c907e ]
+
+Rebooting xtensa images loaded with the '-kernel' option in qemu does
+not work. When executing a reboot command, the qemu session either hangs
+or experiences an endless sequence of error messages.
+
+ Kernel panic - not syncing: Unrecoverable error in exception handler
+
+Reset code jumps to the CPU restart address, but Linux can not recover
+from there because code and data in the kernel init sections have been
+discarded and overwritten at this point.
+
+XTFPGA platforms have a means to reset the CPU by writing 0xdead into a
+specific FPGA IO address. When used in QEMU the kernel image loaded with
+the '-kernel' option gets restored to its original state allowing the
+machine to boot successfully.
+
+Use that mechanism to attempt a platform reset. If it does not work,
+fall back to the existing mechanism.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/platforms/xtfpga/setup.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
+index 59b7f11f2a3e..538e6748e85a 100644
+--- a/arch/xtensa/platforms/xtfpga/setup.c
++++ b/arch/xtensa/platforms/xtfpga/setup.c
+@@ -51,8 +51,12 @@ void platform_power_off(void)
+
+ void platform_restart(void)
+ {
+- /* Flush and reset the mmu, simulate a processor reset, and
+- * jump to the reset vector. */
++ /* Try software reset first. */
++ WRITE_ONCE(*(u32 *)XTFPGA_SWRST_VADDR, 0xdead);
++
++ /* If software reset did not work, flush and reset the mmu,
++ * simulate a processor reset, and jump to the reset vector.
++ */
+ cpu_reset();
+ /* control never gets here */
+ }
+--
+2.33.0
+
--- /dev/null
+From c3c919ebdcdc7a9ead25e47d86ac09a6da7f0cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 11:36:01 -0700
+Subject: xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+[ Upstream commit f3d7c2cdf6dc0d5402ec29c3673893b3542c5ad1 ]
+
+Use platform data to initialize xtfpga device drivers when CONFIG_USE_OF
+is not selected. This fixes xtfpga networking when CONFIG_USE_OF is not
+selected but CONFIG_OF is.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/platforms/xtfpga/setup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
+index 4f7d6142d41f..59b7f11f2a3e 100644
+--- a/arch/xtensa/platforms/xtfpga/setup.c
++++ b/arch/xtensa/platforms/xtfpga/setup.c
+@@ -66,7 +66,7 @@ void __init platform_calibrate_ccount(void)
+
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ static void __init xtfpga_clk_setup(struct device_node *np)
+ {
+@@ -284,4 +284,4 @@ static int __init xtavnet_init(void)
+ */
+ arch_initcall(xtavnet_init);
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
