--- /dev/null
+From 8563af973a0b127e5fef22dd255ce2936d45e6ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 21:40:26 +0800
+Subject: arm64: kexec_file: use more system keyrings to verify kernel image
+ signature
+
+From: Coiby Xu <coxu@redhat.com>
+
+[ Upstream commit 0d519cadf75184a24313568e7f489a7fc9b1be3b ]
+
+Currently, when loading a kernel image via the kexec_file_load() system
+call, arm64 can only use the .builtin_trusted_keys keyring to verify
+a signature whereas x86 can use three more keyrings i.e.
+.secondary_trusted_keys, .machine and .platform keyrings. For example,
+one resulting problem is kexec'ing a kernel image would be rejected
+with the error "Lockdown: kexec: kexec of unsigned images is restricted;
+see man kernel_lockdown.7".
+
+This patch set enables arm64 to make use of the same keyrings as x86 to
+verify the signature kexec'ed kernel image.
+
+Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
+Cc: stable@vger.kernel.org # 105e10e2cf1c: kexec_file: drop weak attribute from functions
+Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
+Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: kexec@lists.infradead.org
+Cc: keyrings@vger.kernel.org
+Cc: linux-security-module@vger.kernel.org
+Co-developed-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Coiby Xu <coxu@redhat.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/kexec_image.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
+index 9ec34690e255..5ed6a585f21f 100644
+--- a/arch/arm64/kernel/kexec_image.c
++++ b/arch/arm64/kernel/kexec_image.c
+@@ -14,7 +14,6 @@
+ #include <linux/kexec.h>
+ #include <linux/pe.h>
+ #include <linux/string.h>
+-#include <linux/verification.h>
+ #include <asm/byteorder.h>
+ #include <asm/cpufeature.h>
+ #include <asm/image.h>
+@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
+ return NULL;
+ }
+
+-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
+-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
+-{
+- return verify_pefile_signature(kernel, kernel_len, NULL,
+- VERIFYING_KEXEC_PE_SIGNATURE);
+-}
+-#endif
+-
+ const struct kexec_file_ops kexec_image_ops = {
+ .probe = image_probe,
+ .load = image_load,
+ #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
+- .verify_sig = image_verify_sig,
++ .verify_sig = kexec_kernel_verify_pe_sig,
+ #endif
+ };
+--
+2.35.1
+
--- /dev/null
+From d2fdbf144987da632fbf09374518091755a1d71d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Sep 2022 09:53:25 -0700
+Subject: block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN
+ for nowait
+
+From: Stefan Roesch <shr@fb.com>
+
+[ Upstream commit 56f99b8d06ef1ed1c9730948f9f05ac2b930a20b ]
+
+Today blk_queue_enter() and __bio_queue_enter() return -EBUSY for the
+nowait code path. This is not correct: they should return -EAGAIN
+instead.
+
+This problem was detected by fio. The following command exposed the
+above problem:
+
+t/io_uring -p0 -d128 -b4096 -s32 -c32 -F1 -B0 -R0 -X1 -n24 -P1 -u1 -O0 /dev/ng0n1
+
+By applying the patch, the retry case is handled correctly in the slow
+path.
+
+Signed-off-by: Stefan Roesch <shr@fb.com>
+Fixes: bfd343aa1718 ("blk-mq: don't wait in blk_mq_queue_enter() if __GFP_WAIT isn't set")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 5009b9f1c3c9..13e1fca1e923 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -447,7 +447,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
+
+ while (!blk_try_enter_queue(q, pm)) {
+ if (flags & BLK_MQ_REQ_NOWAIT)
+- return -EBUSY;
++ return -EAGAIN;
+
+ /*
+ * read pair of barrier in blk_freeze_queue_start(), we need to
+@@ -478,7 +478,7 @@ static inline int bio_queue_enter(struct bio *bio)
+ if (test_bit(GD_DEAD, &disk->state))
+ goto dead;
+ bio_wouldblock_error(bio);
+- return -EBUSY;
++ return -EAGAIN;
+ }
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From cc44f0ea373abad530aa9d9a5a86065651495c30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 16:51:03 +0100
+Subject: drm/meson: Correct OSD1 global alpha value
+
+From: Stuart Menefy <stuart.menefy@mathembedded.com>
+
+[ Upstream commit 6836829c8ea453c9e3e518e61539e35881c8ed5f ]
+
+VIU_OSD1_CTRL_STAT.GLOBAL_ALPHA is a 9 bit field, so the maximum
+value is 0x100 not 0xff.
+
+This matches the vendor kernel.
+
+Signed-off-by: Stuart Menefy <stuart.menefy@mathembedded.com>
+Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220908155103.686904-1-stuart.menefy@mathembedded.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
+index 8640a8a8a469..44aa52629443 100644
+--- a/drivers/gpu/drm/meson/meson_plane.c
++++ b/drivers/gpu/drm/meson/meson_plane.c
+@@ -168,7 +168,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
+
+ /* Enable OSD and BLK0, set max global alpha */
+ priv->viu.osd1_ctrl_stat = OSD_ENABLE |
+- (0xFF << OSD_GLOBAL_ALPHA_SHIFT) |
++ (0x100 << OSD_GLOBAL_ALPHA_SHIFT) |
+ OSD_BLK0_ENABLE;
+
+ priv->viu.osd1_ctrl_stat2 = readl(priv->io_base +
+--
+2.35.1
+
--- /dev/null
+From c60c09fb70056b27d0f487e7b49d8eb72a515ba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 16:52:43 +0100
+Subject: drm/meson: Fix OSD1 RGB to YCbCr coefficient
+
+From: Stuart Menefy <stuart.menefy@mathembedded.com>
+
+[ Upstream commit 6463d3930ba5b6addcfc8f80a4543976a2fc7656 ]
+
+VPP_WRAP_OSD1_MATRIX_COEF22.Coeff22 is documented as being bits 0-12,
+not 16-28.
+
+Without this the output tends to have a pink hue, changing it results
+in better color accuracy.
+
+The vendor kernel doesn't use this register. However the code which
+sets VIU2_OSD1_MATRIX_COEF22 also uses bits 0-12. There is a slightly
+different style of registers for configuring some of the other matrices,
+which do use bits 16-28 for this coefficient, but those have names
+ending in MATRIX_COEF22_30, and this is not one of those.
+
+Signed-off-by: Stuart Menefy <stuart.menefy@mathembedded.com>
+Fixes: 728883948b0d ("drm/meson: Add G12A Support for VIU setup")
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220908155243.687143-1-stuart.menefy@mathembedded.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_viu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
+index bb7e109534de..d4b907889a21 100644
+--- a/drivers/gpu/drm/meson/meson_viu.c
++++ b/drivers/gpu/drm/meson/meson_viu.c
+@@ -94,7 +94,7 @@ static void meson_viu_set_g12a_osd1_matrix(struct meson_drm *priv,
+ priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF11_12));
+ writel(((m[9] & 0x1fff) << 16) | (m[10] & 0x1fff),
+ priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF20_21));
+- writel((m[11] & 0x1fff) << 16,
++ writel((m[11] & 0x1fff),
+ priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF22));
+
+ writel(((m[18] & 0xfff) << 16) | (m[19] & 0xfff),
+--
+2.35.1
+
--- /dev/null
+From 521d8684a84a9bdb5ff0e67774979ab3a5ce1dc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 20:32:00 +0800
+Subject: drm/tegra: vic: Fix build warning when CONFIG_PM=n
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit b5d5288a46876f6767950449aea310f71ac86277 ]
+
+drivers/gpu/drm/tegra/vic.c:326:12: error: ‘vic_runtime_suspend’ defined but not used [-Werror=unused-function]
+ static int vic_runtime_suspend(struct device *dev)
+ ^~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/tegra/vic.c:292:12: error: ‘vic_runtime_resume’ defined but not used [-Werror=unused-function]
+ static int vic_runtime_resume(struct device *dev)
+ ^~~~~~~~~~~~~~~~~~
+
+Mark it as __maybe_unused.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: c7860cbee998 ("drm/tegra: Fix vmapping of prime buffers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/vic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/vic.c b/drivers/gpu/drm/tegra/vic.c
+index da4af5371991..d3e2fab91086 100644
+--- a/drivers/gpu/drm/tegra/vic.c
++++ b/drivers/gpu/drm/tegra/vic.c
+@@ -275,7 +275,7 @@ static int vic_load_firmware(struct vic *vic)
+ }
+
+
+-static int vic_runtime_resume(struct device *dev)
++static int __maybe_unused vic_runtime_resume(struct device *dev)
+ {
+ struct vic *vic = dev_get_drvdata(dev);
+ int err;
+@@ -309,7 +309,7 @@ static int vic_runtime_resume(struct device *dev)
+ return err;
+ }
+
+-static int vic_runtime_suspend(struct device *dev)
++static int __maybe_unused vic_runtime_suspend(struct device *dev)
+ {
+ struct vic *vic = dev_get_drvdata(dev);
+ int err;
+--
+2.35.1
+
--- /dev/null
+From db5dffb080bb8378897fdd999b8e9c6e67a8fab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Sep 2022 12:54:31 +0200
+Subject: gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in
+ mpc85xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 279c12df8d2efb28def9d037f288cbfb97c30fe2 ]
+
+Commit e39d5ef67804 ("powerpc/5xxx: extend mpc8xxx_gpio driver to support
+mpc512x gpios") implemented support for IRQ_TYPE_LEVEL_LOW flow type in
+mpc512x via falling edge type. Do same for mpc85xx which support was added
+in commit 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio").
+
+Fixes probing of lm90 hwmon driver on mpc85xx based board which use level
+interrupt. Without it kernel prints error and refuse lm90 to work:
+
+ [ 15.258370] genirq: Setting trigger mode 8 for irq 49 failed (mpc8xxx_irq_set_type+0x0/0xf8)
+ [ 15.267168] lm90 0-004c: cannot request IRQ 49
+ [ 15.272708] lm90: probe of 0-004c failed with error -22
+
+Fixes: 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mpc8xxx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index a964e25ea620..763256efddc2 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -172,6 +172,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type)
+
+ switch (flow_type) {
+ case IRQ_TYPE_EDGE_FALLING:
++ case IRQ_TYPE_LEVEL_LOW:
+ raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags);
+ gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR,
+ gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR)
+--
+2.35.1
+
--- /dev/null
+From cdde9757b81e28c67e2d178af9f7c8aef120b129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Aug 2022 14:49:05 -0400
+Subject: NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 2a9d683b48c8a87e61a4215792d44c90bcbbb536 ]
+
+The NFSv4.0 protocol only supports open() by name. It cannot therefore
+be used with open_by_handle() and friends, nor can it be re-exported by
+knfsd.
+
+Reported-by: Chuck Lever III <chuck.lever@oracle.com>
+Fixes: 20fa19027286 ("nfs: add export operations")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index e65c83494c05..a847011f36c9 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1046,22 +1046,31 @@ static void nfs_fill_super(struct super_block *sb, struct nfs_fs_context *ctx)
+ if (ctx->bsize)
+ sb->s_blocksize = nfs_block_size(ctx->bsize, &sb->s_blocksize_bits);
+
+- if (server->nfs_client->rpc_ops->version != 2) {
+- /* The VFS shouldn't apply the umask to mode bits. We will do
+- * so ourselves when necessary.
++ switch (server->nfs_client->rpc_ops->version) {
++ case 2:
++ sb->s_time_gran = 1000;
++ sb->s_time_min = 0;
++ sb->s_time_max = U32_MAX;
++ break;
++ case 3:
++ /*
++ * The VFS shouldn't apply the umask to mode bits.
++ * We will do so ourselves when necessary.
+ */
+ sb->s_flags |= SB_POSIXACL;
+ sb->s_time_gran = 1;
+- sb->s_export_op = &nfs_export_ops;
+- } else
+- sb->s_time_gran = 1000;
+-
+- if (server->nfs_client->rpc_ops->version != 4) {
+ sb->s_time_min = 0;
+ sb->s_time_max = U32_MAX;
+- } else {
++ sb->s_export_op = &nfs_export_ops;
++ break;
++ case 4:
++ sb->s_flags |= SB_POSIXACL;
++ sb->s_time_gran = 1;
+ sb->s_time_min = S64_MIN;
+ sb->s_time_max = S64_MAX;
++ if (server->caps & NFS_CAP_ATOMIC_OPEN_V1)
++ sb->s_export_op = &nfs_export_ops;
++ break;
+ }
+
+ sb->s_magic = NFS_SUPER_MAGIC;
+--
+2.35.1
+
--- /dev/null
+From a03aaca34c09a5435f30660a786e82c7abbc24c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Aug 2022 23:34:16 +0300
+Subject: of: fdt: fix off-by-one error in unflatten_dt_nodes()
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 2f945a792f67815abca26fa8a5e863ccf3fa1181 ]
+
+Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
+forgot to fix up the depth check in the loop body in unflatten_dt_nodes()
+which makes it possible to overflow the nps[] buffer...
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE static
+analysis tool.
+
+Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index d245628b15dd..338171c978cc 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -313,7 +313,7 @@ static int unflatten_dt_nodes(const void *blob,
+ for (offset = 0;
+ offset >= 0 && depth >= initial_depth;
+ offset = fdt_next_node(blob, offset, &depth)) {
+- if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
++ if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1))
+ continue;
+
+ if (!IS_ENABLED(CONFIG_OF_KOBJ) &&
+--
+2.35.1
+
--- /dev/null
+From f045115bfb5753d11dbecc2549fcc4b8a12b69b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Aug 2022 20:26:44 +0800
+Subject: pinctrl: qcom: sc8180x: Fix gpio_wakeirq_map
+
+From: Molly Sophia <mollysophia379@gmail.com>
+
+[ Upstream commit 6124cec530c7d8faab96d340ab2df5161e5d1c8a ]
+
+Currently in the wakeirq_map, gpio36 and gpio37 have the same wakeirq
+number, resulting in gpio37 being unable to trigger interrupts.
+It looks like that this is a typo in the wakeirq map. So fix it.
+
+Signed-off-by: Molly Sophia <mollysophia379@gmail.com>
+Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver")
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220807122645.13830-2-mollysophia379@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-sc8180x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-sc8180x.c b/drivers/pinctrl/qcom/pinctrl-sc8180x.c
+index 0d9654b4ab60..32a2d8c5ceae 100644
+--- a/drivers/pinctrl/qcom/pinctrl-sc8180x.c
++++ b/drivers/pinctrl/qcom/pinctrl-sc8180x.c
+@@ -1582,7 +1582,7 @@ static const int sc8180x_acpi_reserved_gpios[] = {
+ static const struct msm_gpio_wakeirq_map sc8180x_pdc_map[] = {
+ { 3, 31 }, { 5, 32 }, { 8, 33 }, { 9, 34 }, { 10, 100 }, { 12, 104 },
+ { 24, 37 }, { 26, 38 }, { 27, 41 }, { 28, 42 }, { 30, 39 }, { 36, 43 },
+- { 37, 43 }, { 38, 45 }, { 39, 118 }, { 39, 125 }, { 41, 47 },
++ { 37, 44 }, { 38, 45 }, { 39, 118 }, { 39, 125 }, { 41, 47 },
+ { 42, 48 }, { 46, 50 }, { 47, 49 }, { 48, 51 }, { 49, 53 }, { 50, 52 },
+ { 51, 116 }, { 51, 123 }, { 53, 54 }, { 54, 55 }, { 55, 56 },
+ { 56, 57 }, { 58, 58 }, { 60, 60 }, { 68, 62 }, { 70, 63 }, { 76, 86 },
+--
+2.35.1
+
--- /dev/null
+From 3d20ad47b3d06ec5c9f02cbf6132077cf7d40228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Aug 2022 20:26:45 +0800
+Subject: pinctrl: qcom: sc8180x: Fix wrong pin numbers
+
+From: Molly Sophia <mollysophia379@gmail.com>
+
+[ Upstream commit 48ec73395887694f13c9452b4dcfb43710451757 ]
+
+The pin numbers for UFS_RESET and SDC2_* are not
+consistent in the pinctrl driver for sc8180x.
+So fix it.
+
+Signed-off-by: Molly Sophia <mollysophia379@gmail.com>
+Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver")
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220807122645.13830-3-mollysophia379@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-sc8180x.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-sc8180x.c b/drivers/pinctrl/qcom/pinctrl-sc8180x.c
+index 32a2d8c5ceae..a4725ff12da0 100644
+--- a/drivers/pinctrl/qcom/pinctrl-sc8180x.c
++++ b/drivers/pinctrl/qcom/pinctrl-sc8180x.c
+@@ -530,10 +530,10 @@ DECLARE_MSM_GPIO_PINS(187);
+ DECLARE_MSM_GPIO_PINS(188);
+ DECLARE_MSM_GPIO_PINS(189);
+
+-static const unsigned int sdc2_clk_pins[] = { 190 };
+-static const unsigned int sdc2_cmd_pins[] = { 191 };
+-static const unsigned int sdc2_data_pins[] = { 192 };
+-static const unsigned int ufs_reset_pins[] = { 193 };
++static const unsigned int ufs_reset_pins[] = { 190 };
++static const unsigned int sdc2_clk_pins[] = { 191 };
++static const unsigned int sdc2_cmd_pins[] = { 192 };
++static const unsigned int sdc2_data_pins[] = { 193 };
+
+ enum sc8180x_functions {
+ msm_mux_adsp_ext,
+--
+2.35.1
+
--- /dev/null
+From 2d274b0082f37f92efc088fcf4608179d888843a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Aug 2022 02:51:20 +0000
+Subject: pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: João H. Spies <jhlspies@gmail.com>
+
+[ Upstream commit b871656aa4f54e04207f62bdd0d7572be1d86b36 ]
+
+Switching between falling/rising edges for IRQ_TYPE_EDGE_BOTH on pins that
+require debounce can cause the device to lose events due to a desync
+between pin state and irq type.
+
+This problem is resolved by switching between IRQ_TYPE_LEVEL_LOW and
+IRQ_TYPE_LEVEL_HIGH instead.
+
+Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio")
+Signed-off-by: João H. Spies <jhlspies@gmail.com>
+Link: https://lore.kernel.org/r/20220808025121.110223-1-jhlspies@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-rockchip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c
+index 22b8f0aa80f1..f31b0947eaaa 100644
+--- a/drivers/gpio/gpio-rockchip.c
++++ b/drivers/gpio/gpio-rockchip.c
+@@ -418,11 +418,11 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
+ goto out;
+ } else {
+ bank->toggle_edge_mode |= mask;
+- level |= mask;
++ level &= ~mask;
+
+ /*
+ * Determine gpio state. If 1 next interrupt should be
+- * falling otherwise rising.
++ * low otherwise high.
+ */
+ data = readl(bank->reg_base + bank->gpio_regs->ext_port);
+ if (data & mask)
+--
+2.35.1
+
--- /dev/null
+From 0efbe4e17bf54d85201813cee1ad478c588147fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Aug 2022 10:45:41 +0800
+Subject: pinctrl: sunxi: Fix name for A100 R_PIO
+
+From: Michael Wu <michael@allwinnertech.com>
+
+[ Upstream commit 76648c867c6c03b8a468d9c9222025873ecc613d ]
+
+The name of A100 R_PIO driver should be sun50i-a100-r-pinctrl,
+not sun50iw10p1-r-pinctrl.
+
+Fixes: 473436e7647d6 ("pinctrl: sunxi: add support for the Allwinner A100 pin controller")
+Signed-off-by: Michael Wu <michael@allwinnertech.com>
+Acked-by: Samuel Holland <samuel@sholland.org>
+Link: https://lore.kernel.org/r/20220819024541.74191-1-michael@allwinnertech.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
+index 21054fcacd34..18088f6f44b2 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
+@@ -98,7 +98,7 @@ MODULE_DEVICE_TABLE(of, a100_r_pinctrl_match);
+ static struct platform_driver a100_r_pinctrl_driver = {
+ .probe = a100_r_pinctrl_probe,
+ .driver = {
+- .name = "sun50iw10p1-r-pinctrl",
++ .name = "sun50i-a100-r-pinctrl",
+ .of_match_table = a100_r_pinctrl_match,
+ },
+ };
+--
+2.35.1
+
--- /dev/null
+From d6fb10176b9f161716f355ba192f3a3f7ee40178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Apr 2022 12:46:42 +0200
+Subject: serial: atmel: remove redundant assignment in rs485_config
+
+From: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+
+[ Upstream commit 60efd0513916f195dd85bfbf21653f74f9ab019c ]
+
+In uart_set_rs485_config() the serial core already assigns the passed
+serial_rs485 struct to the uart port.
+
+So remove the assignment from the drivers rs485_config() function to avoid
+redundancy.
+
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Link: https://lore.kernel.org/r/20220410104642.32195-10-LinoSanfilippo@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 692a8ebcfc24 ("tty: serial: atmel: Preserve previous USART mode if RS485 disabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/atmel_serial.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index dd350c590880..92383c8610ee 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -298,11 +298,9 @@ static int atmel_config_rs485(struct uart_port *port,
+ /* Resetting serial mode to RS232 (0x0) */
+ mode &= ~ATMEL_US_USMODE;
+
+- port->rs485 = *rs485conf;
+-
+ if (rs485conf->flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+- if (port->rs485.flags & SER_RS485_RX_DURING_TX)
++ if (rs485conf->flags & SER_RS485_RX_DURING_TX)
+ atmel_port->tx_done_mask = ATMEL_US_TXRDY;
+ else
+ atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+--
+2.35.1
+
usb-gadget-f_uac2-fix-superspeed-transfer.patch
rdma-irdma-use-s-g-array-in-post-send-only-when-its-valid.patch
input-goodix-add-compatible-string-for-gt1158.patch
+drm-tegra-vic-fix-build-warning-when-config_pm-n.patch
+arm64-kexec_file-use-more-system-keyrings-to-verify-.patch
+usb-gadget-fix-use-after-free-read-in-usb_udc_uevent.patch
+serial-atmel-remove-redundant-assignment-in-rs485_co.patch
+tty-serial-atmel-preserve-previous-usart-mode-if-rs4.patch
+of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch
+pinctrl-qcom-sc8180x-fix-gpio_wakeirq_map.patch
+pinctrl-qcom-sc8180x-fix-wrong-pin-numbers.patch
+pinctrl-rockchip-enhance-support-for-irq_type_edge_b.patch
+pinctrl-sunxi-fix-name-for-a100-r_pio.patch
+nfsv4-turn-off-open-by-filehandle-and-nfs-re-export-.patch
+gpio-mpc8xxx-fix-support-for-irq_type_level_low-flow.patch
+drm-meson-correct-osd1-global-alpha-value.patch
+drm-meson-fix-osd1-rgb-to-ycbcr-coefficient.patch
+block-blk_queue_enter-__bio_queue_enter-must-return-.patch
--- /dev/null
+From 4f3d08ceb9ff4501d58bcae56cda96adb22c2aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 17:29:03 +0300
+Subject: tty: serial: atmel: Preserve previous USART mode if RS485 disabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sergiu Moga <sergiu.moga@microchip.com>
+
+[ Upstream commit 692a8ebcfc24f4a5bea0eb2967e450f584193da6 ]
+
+Whenever the atmel_rs485_config() driver method would be called,
+the USART mode is reset to normal mode before even checking if
+RS485 flag is set, thus resulting in losing the previous USART
+mode in the case where the checking fails.
+
+Some tools, such as `linux-serial-test`, lead to the driver calling
+this method when doing the setup of the serial port: after setting the
+port mode (Hardware Flow Control, Normal Mode, RS485 Mode, etc.),
+`linux-serial-test` tries to enable/disable RS485 depending on
+the commandline arguments that were passed.
+
+Example of how this issue could reveal itself:
+When doing a serial communication with Hardware Flow Control through
+`linux-serial-test`, the tool would lead to the driver roughly doing
+the following:
+- set the corresponding bit to 1 (ATMEL_US_USMODE_HWHS bit in the
+ATMEL_US_MR register) through the atmel_set_termios() to enable
+Hardware Flow Control
+- disable RS485 through the atmel_config_rs485() method
+Thus, when the latter is called, the mode will be reset and the
+previously set bit is unset, leaving USART in normal mode instead of
+the expected Hardware Flow Control mode.
+
+This fix ensures that this reset is only done if the checking for
+RS485 succeeds and that the previous mode is preserved otherwise.
+
+Fixes: e8faff7330a35 ("ARM: 6092/1: atmel_serial: support for RS485 communications")
+Cc: stable <stable@kernel.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sergiu Moga <sergiu.moga@microchip.com>
+Link: https://lore.kernel.org/r/20220824142902.502596-1-sergiu.moga@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/atmel_serial.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 92383c8610ee..c0a86558ceaa 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -295,9 +295,6 @@ static int atmel_config_rs485(struct uart_port *port,
+
+ mode = atmel_uart_readl(port, ATMEL_US_MR);
+
+- /* Resetting serial mode to RS232 (0x0) */
+- mode &= ~ATMEL_US_USMODE;
+-
+ if (rs485conf->flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+ if (rs485conf->flags & SER_RS485_RX_DURING_TX)
+@@ -307,6 +304,7 @@ static int atmel_config_rs485(struct uart_port *port,
+
+ atmel_uart_writel(port, ATMEL_US_TTGR,
+ rs485conf->delay_rts_after_send);
++ mode &= ~ATMEL_US_USMODE;
+ mode |= ATMEL_US_USMODE_RS485;
+ } else {
+ dev_dbg(port->dev, "Setting UART to RS232\n");
+--
+2.35.1
+
--- /dev/null
+From 4ec57709f69f35643cc6d375e876e352e732b99f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jul 2022 11:07:10 -0400
+Subject: USB: gadget: Fix use-after-free Read in usb_udc_uevent()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+[ Upstream commit 2191c00855b03aa59c20e698be713d952d51fc18 ]
+
+The syzbot fuzzer found a race between uevent callbacks and gadget
+driver unregistration that can cause a use-after-free bug:
+
+---------------------------------------------------------------
+BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130
+drivers/usb/gadget/udc/core.c:1732
+Read of size 8 at addr ffff888078ce2050 by task udevd/2968
+
+CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
+06/29/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:317 [inline]
+ print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
+ kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
+ usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732
+ dev_uevent+0x290/0x770 drivers/base/core.c:2424
+---------------------------------------------------------------
+
+The bug occurs because usb_udc_uevent() dereferences udc->driver but
+does so without acquiring the udc_lock mutex, which protects this
+field. If the gadget driver is unbound from the udc concurrently with
+uevent processing, the driver structure may be accessed after it has
+been deallocated.
+
+To prevent the race, we make sure that the routine holds the mutex
+around the racing accesses.
+
+Link: <https://lore.kernel.org/all/0000000000004de90405a719c951@google.com>
+CC: stable@vger.kernel.org # fc274c1e9973
+Reported-and-tested-by: syzbot+b0de012ceb1e2a97891b@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/YtlrnhHyrHsSky9m@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index 61099f2d057d..eb3895ad7136 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1739,13 +1739,14 @@ static int usb_udc_uevent(struct device *dev, struct kobj_uevent_env *env)
+ return ret;
+ }
+
+- if (udc->driver) {
++ mutex_lock(&udc_lock);
++ if (udc->driver)
+ ret = add_uevent_var(env, "USB_UDC_DRIVER=%s",
+ udc->driver->function);
+- if (ret) {
+- dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n");
+- return ret;
+- }
++ mutex_unlock(&udc_lock);
++ if (ret) {
++ dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n");
++ return ret;
+ }
+
+ return 0;
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
