--- /dev/null
+From c361eb4b7023c4019e733a6a33506f2c38cbaec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Jul 2021 12:23:41 +0800
+Subject: ALSA: usb-audio: fix incorrect clock source setting
+
+From: chihhao.chen <chihhao.chen@mediatek.com>
+
+[ Upstream commit 4511781f95da0a3b2bad34f3f5e3967e80cd2d18 ]
+
+The following scenario describes an echo test for
+Samsung USBC Headset (AKG) with VID/PID (0x04e8/0xa051).
+
+We first start a capture stream(USB IN transfer) in 96Khz/24bit/1ch mode.
+In clock find source function, we get value 0x2 for clock selector
+and 0x1 for clock source.
+
+Kernel-4.14 behavior
+Since clock source is valid so clock selector was not set again.
+We pass through this function and start a playback stream(USB OUT transfer)
+in 48Khz/32bit/2ch mode. This time we get value 0x1 for clock selector
+and 0x1 for clock source. Finally clock id with this setting is 0x9.
+
+Kernel-5.10 behavior
+Clock selector was always set one more time even it is valid.
+When we start a playback stream, we will get 0x2 for clock selector
+and 0x1 for clock source. In this case clock id becomes 0xA.
+This is an incorrect clock source setting and results in severe noises.
+We see wrong data rate in USB IN transfer.
+(From 288 bytes/ms becomes 144 bytes/ms) It should keep in 288 bytes/ms.
+
+This earphone works fine on older kernel version load because
+this is a newly-added behavior.
+
+Fixes: d2e8f641257d ("ALSA: usb-audio: Explicitly set up the clock selector")
+Signed-off-by: chihhao.chen <chihhao.chen@mediatek.com>
+Link: https://lore.kernel.org/r/1627100621-19225-1-git-send-email-chihhao.chen@mediatek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/clock.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index 17bbde73d4d1..14772209194b 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -325,6 +325,12 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip,
+ selector->baCSourceID[ret - 1],
+ visited, validate);
+ if (ret > 0) {
++ /*
++ * For Samsung USBC Headset (AKG), setting clock selector again
++ * will result in incorrect default clock setting problems
++ */
++ if (chip->usb_id == USB_ID(0x04e8, 0xa051))
++ return ret;
+ err = uac_clock_selector_set_val(chip, entity_id, cur);
+ if (err < 0)
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 8bae6a17d2b31cb2c6caf7b779c28937804060ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 15:15:25 +0200
+Subject: ARM: dts: am437x-l4: fix typo in can@0 node
+
+From: Dario Binacchi <dariobin@libero.it>
+
+[ Upstream commit 0162a9964365fd26e34575e121b17d021204c481 ]
+
+Replace clock-name with clock-names.
+
+Fixes: 2a4117df9b43 ("ARM: dts: Fix dcan driver probe failed on am437x platform")
+Signed-off-by: Dario Binacchi <dariobin@libero.it>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am437x-l4.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi
+index a6f19ae7d3e6..f73ecec1995a 100644
+--- a/arch/arm/boot/dts/am437x-l4.dtsi
++++ b/arch/arm/boot/dts/am437x-l4.dtsi
+@@ -1595,7 +1595,7 @@
+ compatible = "ti,am4372-d_can", "ti,am3352-d_can";
+ reg = <0x0 0x2000>;
+ clocks = <&dcan1_fck>;
+- clock-name = "fck";
++ clock-names = "fck";
+ syscon-raminit = <&scm_conf 0x644 1>;
+ interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+--
+2.30.2
+
--- /dev/null
+From d98f44abcb12e3854522230dd124be57c48d21aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 23:21:07 +0300
+Subject: ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
+
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+
+[ Upstream commit 828db68f4ff1ab6982a36a56522b585160dc8c8e ]
+
+NXP and AzureWave don't recommend using SDIO bus mode 3.3V@50MHz due
+to noise affecting the wireless throughput. Colibri iMX6ULL uses only
+3.3V signaling for Wi-Fi module AW-CM276NF.
+
+Limit the SDIO Clock on Colibri iMX6ULL to 25MHz.
+
+Fixes: c2e4987e0e02 ("ARM: dts: imx6ull: add Toradex Colibri iMX6ULL support")
+Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+index a0545431b3dc..9f1e38282bee 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+@@ -43,6 +43,7 @@
+ assigned-clock-rates = <0>, <198000000>;
+ cap-power-off-card;
+ keep-power-in-suspend;
++ max-frequency = <25000000>;
+ mmc-pwrseq = <&wifi_pwrseq>;
+ no-1-8-v;
+ non-removable;
+--
+2.30.2
+
--- /dev/null
+From 865c892dc28358b8db57924c1f40120a699efc7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jul 2021 23:43:02 +0200
+Subject: ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out
+ pins
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 3d9e30a52047f2d464efdfd1d561ae1f707a0286 ]
+
+The pinctrl_power_button/pinctrl_power_out each define single GPIO
+pinmux, except it is exactly the other one than the matching gpio-keys
+and gpio-poweroff DT nodes use for that functionality. Swap the two
+GPIOs to correct this error.
+
+Fixes: 50d29fdb765d ("ARM: dts: imx53: Add power GPIOs on M53Menlo")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-m53menlo.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index f98691ae4415..d3082b9774e4 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -388,13 +388,13 @@
+
+ pinctrl_power_button: powerbutgrp {
+ fsl,pins = <
+- MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4
++ MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4
+ >;
+ };
+
+ pinctrl_power_out: poweroutgrp {
+ fsl,pins = <
+- MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4
++ MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4
+ >;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 4a481c8e0448acc406fc39b426212acaf4d1d1e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 14:13:53 +0200
+Subject: ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit fd8e83884fdd7b5fc411f201a58d8d01890198a2 ]
+
+The AR803x PHY used on this modules seems to require the reset line to
+be asserted for around 10ms in order to avoid rare cases where the PHY
+gets stuck in an incoherent state that prevents it to function
+correctly.
+
+The previous value of 2ms was found to be problematic on some setups,
+causing intermittent issues where the PHY would be unresponsive
+every once in a while on some sytems, with a low occurrence (it typically
+took around 30 consecutive reboots to encounter the issue).
+
+Bumping the delay to the 10ms makes the issue dissapear, with more than
+2500 consecutive reboots performed without the issue showing-up.
+
+Fixes: 208d7baf8085 ("ARM: imx: initial SolidRun HummingBoard support")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Tested-by: Hervé Codina <herve.codina@bootlin.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+index 0ad8ccde0cf8..f86efd0ccc40 100644
+--- a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+@@ -54,7 +54,13 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_microsom_enet_ar8035>;
+ phy-mode = "rgmii-id";
+- phy-reset-duration = <2>;
++
++ /*
++ * The PHY seems to require a long-enough reset duration to avoid
++ * some rare issues where the PHY gets stuck in an inconsistent and
++ * non-functional state at boot-up. 10ms proved to be fine .
++ */
++ phy-reset-duration = <10>;
+ phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>;
+ status = "okay";
+
+--
+2.30.2
+
--- /dev/null
+From f32ae92262b816c3ec223f3d88b845aca2748982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 20:12:53 +0200
+Subject: ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 36862c1ebc92a7e6fcc55002965c44b8ad17d4ca ]
+
+The LAN8710 Energy Detect Power Down (EDPD) functionality might cause
+unreliable cable detection. There are multiple accounts of this in the
+SMSC PHY driver patches which attempted to make EDPD reliable, however
+it seems there is always some sort of corner case left. Unfortunatelly,
+there is no errata documented which would confirm this to be a silicon
+bug on the LAN87xx series of PHYs (LAN8700, LAN8710, LAN8720 at least).
+
+Disable EDPD on the DHCOM SoM, just like multiple other boards already
+do as well, to make the cable detection reliable.
+
+Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+index 8349c9099e30..8c41f819f776 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+@@ -140,6 +140,7 @@
+ reset-gpios = <&gpioh 3 GPIO_ACTIVE_LOW>;
+ reset-assert-us = <500>;
+ reset-deassert-us = <500>;
++ smsc,disable-energy-detect;
+ interrupt-parent = <&gpioi>;
+ interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+ };
+--
+2.30.2
+
--- /dev/null
+From 0799af93f83e625cd8f855173e73cdbe49275874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 20:10:40 +0200
+Subject: ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 15f68f027ebd961b99a1c420f96ff3838c5e4450 ]
+
+While 7e5f3155dcbb4 ("ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2")
+fixed the LED0 assignment on the PDK2 board, the same commit did not
+update the touchscreen IRQ line assignment, which is the same GPIO line,
+shared between the LED0 output and touchscreen IRQ input. To make this
+more convoluted, the same EXTI input (not the same GPIO line) is shared
+between Button B which is Active-Low IRQ, and touchscreen IRQ which is
+Edge-Falling IRQ, which cannot be used at the same time. In case the LCD
+board with touchscreen is in use, which is the case here, LED0 must be
+disabled, Button B must be polled, so the touchscreen interrupt works as
+it should.
+
+Update the touchscreen IRQ line assignment, disable LED0 and use polled
+GPIO button driver for Button B, since the DT here describes baseboard
+with LCD board.
+
+Fixes: 7e5f3155dcbb4 ("ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 24 +++++++++++--------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+index c5ea08fec535..6cf1c8b4c6e2 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+@@ -37,7 +37,7 @@
+ poll-interval = <20>;
+
+ /*
+- * The EXTi IRQ line 3 is shared with touchscreen and ethernet,
++ * The EXTi IRQ line 3 is shared with ethernet,
+ * so mark this as polled GPIO key.
+ */
+ button-0 {
+@@ -46,6 +46,16 @@
+ gpios = <&gpiof 3 GPIO_ACTIVE_LOW>;
+ };
+
++ /*
++ * The EXTi IRQ line 6 is shared with touchscreen,
++ * so mark this as polled GPIO key.
++ */
++ button-1 {
++ label = "TA2-GPIO-B";
++ linux,code = <KEY_B>;
++ gpios = <&gpiod 6 GPIO_ACTIVE_LOW>;
++ };
++
+ /*
+ * The EXTi IRQ line 0 is shared with PMIC,
+ * so mark this as polled GPIO key.
+@@ -60,13 +70,6 @@
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- button-1 {
+- label = "TA2-GPIO-B";
+- linux,code = <KEY_B>;
+- gpios = <&gpiod 6 GPIO_ACTIVE_LOW>;
+- wakeup-source;
+- };
+-
+ button-3 {
+ label = "TA4-GPIO-D";
+ linux,code = <KEY_D>;
+@@ -82,6 +85,7 @@
+ label = "green:led5";
+ gpios = <&gpioc 6 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
++ status = "disabled";
+ };
+
+ led-1 {
+@@ -185,8 +189,8 @@
+ touchscreen@38 {
+ compatible = "edt,edt-ft5406";
+ reg = <0x38>;
+- interrupt-parent = <&gpiog>;
+- interrupts = <2 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */
++ interrupt-parent = <&gpioc>;
++ interrupts = <6 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */
+ };
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 3497b4142113f2758eda85ae696d3d5d5117b7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Jun 2021 20:54:21 +0200
+Subject: ARM: dts: stm32: Prefer HW RTC on DHCOM SoM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 3a0670824979a986a2314c921aa092e60730eeae ]
+
+The DHCOM SoM has two RTC, one is the STM32 RTC built into the SoC
+and another is Microcrystal RV RTC. By default, only the later has
+battery backup, the former does not. The order in which the RTCs
+are probed on boot is random, which means the kernel might pick up
+system time from the STM32 RTC which has no battery backup. This
+then leads to incorrect initial system time setup, even though the
+HW RTC has correct time configured in it.
+
+Add DT alias entries, so that the RTCs get assigned fixed IDs and
+the HW RTC is always picked by the kernel as the default RTC, thus
+resulting in correct system time in early userspace.
+
+Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+index 2af0a6752674..8349c9099e30 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+@@ -12,6 +12,8 @@
+ aliases {
+ ethernet0 = ðernet0;
+ ethernet1 = &ksz8851;
++ rtc0 = &hwrtc;
++ rtc1 = &rtc;
+ };
+
+ memory@c0000000 {
+@@ -248,7 +250,7 @@
+ /delete-property/dmas;
+ /delete-property/dma-names;
+
+- rtc@32 {
++ hwrtc: rtc@32 {
+ compatible = "microcrystal,rv8803";
+ reg = <0x32>;
+ };
+--
+2.30.2
+
--- /dev/null
+From 19d158cf7774eb46bd96ea935292b818a6c37eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 20:52:39 +0800
+Subject: ARM: imx: add missing clk_disable_unprepare()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f07ec85365807b3939f32d0094a6dd5ce065d1b9 ]
+
+clock source is prepared and enabled by clk_prepare_enable()
+in probe function, but no disable or unprepare in remove and
+error path.
+
+Fixes: 9454a0caff6a ("ARM: imx: add mmdc ipg clock operation for mmdc")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/mmdc.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index 8e57691aafe2..4a6f1359e1e9 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -103,6 +103,7 @@ struct mmdc_pmu {
+ struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
+ struct hlist_node node;
+ struct fsl_mmdc_devtype_data *devtype_data;
++ struct clk *mmdc_ipg_clk;
+ };
+
+ /*
+@@ -463,11 +464,13 @@ static int imx_mmdc_remove(struct platform_device *pdev)
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
+ iounmap(pmu_mmdc->mmdc_base);
++ clk_disable_unprepare(pmu_mmdc->mmdc_ipg_clk);
+ kfree(pmu_mmdc);
+ return 0;
+ }
+
+-static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base)
++static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base,
++ struct clk *mmdc_ipg_clk)
+ {
+ struct mmdc_pmu *pmu_mmdc;
+ char *name;
+@@ -495,6 +498,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ }
+
+ mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+ if (mmdc_num == 0)
+ name = "mmdc";
+ else
+@@ -568,9 +572,11 @@ static int imx_mmdc_probe(struct platform_device *pdev)
+ val &= ~(1 << BP_MMDC_MAPSR_PSD);
+ writel_relaxed(val, reg);
+
+- err = imx_mmdc_perf_init(pdev, mmdc_base);
+- if (err)
++ err = imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk);
++ if (err) {
+ iounmap(mmdc_base);
++ clk_disable_unprepare(mmdc_ipg_clk);
++ }
+
+ return err;
+ }
+--
+2.30.2
+
--- /dev/null
+From 378202afb9c50db2981c2f1f5bcec326ced5ae2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jun 2021 20:52:38 +0800
+Subject: ARM: imx: add missing iounmap()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f9613aa07f16d6042e74208d1b40a6104d72964a ]
+
+Commit e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
+introduced imx_mmdc_remove(), the mmdc_base need be unmapped in it if
+config PERF_EVENTS is enabled.
+
+If imx_mmdc_perf_init() fails, the mmdc_base also need be unmapped.
+
+Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/mmdc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index 0dfd0ae7a63d..8e57691aafe2 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -462,6 +462,7 @@ static int imx_mmdc_remove(struct platform_device *pdev)
+
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
++ iounmap(pmu_mmdc->mmdc_base);
+ kfree(pmu_mmdc);
+ return 0;
+ }
+@@ -567,7 +568,11 @@ static int imx_mmdc_probe(struct platform_device *pdev)
+ val &= ~(1 << BP_MMDC_MAPSR_PSD);
+ writel_relaxed(val, reg);
+
+- return imx_mmdc_perf_init(pdev, mmdc_base);
++ err = imx_mmdc_perf_init(pdev, mmdc_base);
++ if (err)
++ iounmap(mmdc_base);
++
++ return err;
+ }
+
+ int imx_mmdc_get_ddr_type(void)
+--
+2.30.2
+
--- /dev/null
+From d0ac7bbc61f7b254dfc50c9d4373cc92505a66bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 14:23:21 +0100
+Subject: ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 20fb73911fec01f06592de1cdbca00b66602ebd7 ]
+
+The function imx_mmdc_perf_init recently had a 3rd argument added to
+it but the equivalent macro was not updated and is still the older
+2 argument version. Fix this by adding in the missing 3rd argumement
+mmdc_ipg_clk.
+
+Fixes: f07ec8536580 ("ARM: imx: add missing clk_disable_unprepare()")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/mmdc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index 4a6f1359e1e9..af12668d0bf5 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -534,7 +534,7 @@ pmu_free:
+
+ #else
+ #define imx_mmdc_remove NULL
+-#define imx_mmdc_perf_init(pdev, mmdc_base) 0
++#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0
+ #endif
+
+ static int imx_mmdc_probe(struct platform_device *pdev)
+--
+2.30.2
+
--- /dev/null
+From 74e88260d709570f02d281992224da1a31b60d8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 13:11:34 +0300
+Subject: arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC
+ controllers
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 923f98929182dfd04e9149be839160b63a3db145 ]
+
+Since drivers/mmc/host/sdhci-xenon.c declares the PROBE_PREFER_ASYNCHRONOUS
+probe type, it is not guaranteed whether /dev/mmcblk0 will belong to
+sdhci0 or sdhci1. In turn, this will break booting by:
+
+root=/dev/mmcblk0p1
+
+Fix the issue by adding aliases so that the old MMC controller indices
+are preserved.
+
+Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index ce2bcddf396f..f2d7d6f071bc 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -19,6 +19,8 @@
+ aliases {
+ spi0 = &spi0;
+ ethernet1 = ð1;
++ mmc0 = &sdhci0;
++ mmc1 = &sdhci1;
+ };
+
+ chosen {
+--
+2.30.2
+
--- /dev/null
+From 1a2fcfaa659c31b6a35576c1fecdf94dac38e525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 17:12:29 +0200
+Subject: arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit ee7ab3f263f8131722cff3871b9618b1e7478f07 ]
+
+Some SFP modules are not detected when i2c-fast-mode is enabled even when
+clock-frequency is already set to 100000. The I2C bus violates the timing
+specifications when run in fast mode. So disable fast mode on Turris Mox.
+
+Same change was already applied for uDPU (also Armada 3720 board with SFP)
+in commit fe3ec631a77d ("arm64: dts: uDPU: remove i2c-fast-mode").
+
+Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index f2d7d6f071bc..a05b1ab2dd12 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -121,6 +121,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c1_pins>;
+ clock-frequency = <100000>;
++ /delete-property/ mrvl,i2c-fast-mode;
+ status = "okay";
+
+ rtc@6f {
+--
+2.30.2
+
--- /dev/null
+From 76249de5d032dfec4021102ea34e2e93e070e424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 21:49:14 +0200
+Subject: arm64: dts: ls1028: sl28: fix networking for variant 2
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 29f6a20c21b5bdc7eb623a712bbf7b99612ee746 ]
+
+The PHY configuration for the variant 2 is still missing the flag for
+in-band signalling between PHY and MAC. Both sides - MAC and PHY - have
+to match the setting. For now, Linux only supports setting the MAC side
+and thus it has to match the setting the bootloader is configuring.
+Enable in-band signalling to make ethernet work.
+
+Fixes: ab43f0307449 ("arm64: dts: ls1028a: sl28: add support for variant 2")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts
+index dd764b720fb0..f6a79c8080d1 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts
+@@ -54,6 +54,7 @@
+
+ &mscc_felix_port0 {
+ label = "swp0";
++ managed = "in-band-status";
+ phy-handle = <&phy0>;
+ phy-mode = "sgmii";
+ status = "okay";
+@@ -61,6 +62,7 @@
+
+ &mscc_felix_port1 {
+ label = "swp1";
++ managed = "in-band-status";
+ phy-handle = <&phy1>;
+ phy-mode = "sgmii";
+ status = "okay";
+--
+2.30.2
+
--- /dev/null
+From bd184652ab5383626c89324eaceceb03d49e2f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 14:26:58 +0300
+Subject: arm64: dts: ls1028a: fix node name for the sysclk
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 7e71b85473f863a29eb1c69265ef025389b4091d ]
+
+U-Boot attempts to fix up the "clock-frequency" property of the "/sysclk" node:
+https://elixir.bootlin.com/u-boot/v2021.04/source/arch/arm/cpu/armv8/fsl-layerscape/fdt.c#L512
+
+but fails to do so:
+
+ ## Booting kernel from Legacy Image at a1000000 ...
+ Image Name:
+ Created: 2021-06-08 10:31:38 UTC
+ Image Type: AArch64 Linux Kernel Image (gzip compressed)
+ Data Size: 15431370 Bytes = 14.7 MiB
+ Load Address: 80080000
+ Entry Point: 80080000
+ Verifying Checksum ... OK
+ ## Flattened Device Tree blob at a0000000
+ Booting using the fdt blob at 0xa0000000
+ Uncompressing Kernel Image
+ Loading Device Tree to 00000000fbb19000, end 00000000fbb22717 ... OK
+ Unable to update property /sysclk:clock-frequency, err=FDT_ERR_NOTFOUND
+
+ Starting kernel ...
+
+All Layerscape SoCs except LS1028A use "sysclk" as the node name, and
+not "clock-sysclk". So change the node name of LS1028A accordingly.
+
+Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index a30249ebffa8..a94cbd6dcce6 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -66,7 +66,7 @@
+ };
+ };
+
+- sysclk: clock-sysclk {
++ sysclk: sysclk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <100000000>;
+--
+2.30.2
+
--- /dev/null
+From a067d2a32a6383a110e8aca0fa50d9a95a369189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 20:46:45 +0800
+Subject: blk-iolatency: error out if blk_get_queue() failed in
+ iolatency_set_limit()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 8d75d0eff6887bcac7225e12b9c75595e523d92d ]
+
+If queue is dying while iolatency_set_limit() is in progress,
+blk_get_queue() won't increment the refcount of the queue. However,
+blk_put_queue() will still decrement the refcount later, which will
+cause the refcout to be unbalanced.
+
+Thus error out in such case to fix the problem.
+
+Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20210805124645.543797-1-yukuai3@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iolatency.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 81be0096411d..d8b0d8bd132b 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -833,7 +833,11 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+
+ enable = iolatency_set_min_lat_nsec(blkg, lat_val);
+ if (enable) {
+- WARN_ON_ONCE(!blk_get_queue(blkg->q));
++ if (!blk_get_queue(blkg->q)) {
++ ret = -ENODEV;
++ goto out;
++ }
++
+ blkg_get(blkg);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From bf923fd3a5fed7b003016bb909031687e21577bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 19:26:56 +0900
+Subject: Bluetooth: defer cleanup of resources in hci_unregister_dev()
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+[ Upstream commit e04480920d1eec9c061841399aa6f35b6f987d8b ]
+
+syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to
+calling lock_sock() with rw spinlock held [1].
+
+It seems that history of this locking problem is a trial and error.
+
+Commit b40df5743ee8 ("[PATCH] bluetooth: fix socket locking in
+hci_sock_dev_event()") in 2.6.21-rc4 changed bh_lock_sock() to
+lock_sock() as an attempt to fix lockdep warning.
+
+Then, commit 4ce61d1c7a8e ("[BLUETOOTH]: Fix locking in
+hci_sock_dev_event().") in 2.6.22-rc2 changed lock_sock() to
+local_bh_disable() + bh_lock_sock_nested() as an attempt to fix the
+sleep in atomic context warning.
+
+Then, commit 4b5dd696f81b ("Bluetooth: Remove local_bh_disable() from
+hci_sock.c") in 3.3-rc1 removed local_bh_disable().
+
+Then, commit e305509e678b ("Bluetooth: use correct lock to prevent UAF
+of hdev object") in 5.13-rc5 again changed bh_lock_sock_nested() to
+lock_sock() as an attempt to fix CVE-2021-3573.
+
+This difficulty comes from current implementation that
+hci_sock_dev_event(HCI_DEV_UNREG) is responsible for dropping all
+references from sockets because hci_unregister_dev() immediately
+reclaims resources as soon as returning from
+hci_sock_dev_event(HCI_DEV_UNREG).
+
+But the history suggests that hci_sock_dev_event(HCI_DEV_UNREG) was not
+doing what it should do.
+
+Therefore, instead of trying to detach sockets from device, let's accept
+not detaching sockets from device at hci_sock_dev_event(HCI_DEV_UNREG),
+by moving actual cleanup of resources from hci_unregister_dev() to
+hci_cleanup_dev() which is called by bt_host_release() when all
+references to this unregistered device (which is a kobject) are gone.
+
+Since hci_sock_dev_event(HCI_DEV_UNREG) no longer resets
+hci_pi(sk)->hdev, we need to check whether this device was unregistered
+and return an error based on HCI_UNREGISTER flag. There might be subtle
+behavioral difference in "monitor the hdev" functionality; please report
+if you found something went wrong due to this patch.
+
+Link: https://syzkaller.appspot.com/bug?extid=a5df189917e79d5e59c9 [1]
+Reported-by: syzbot <syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: e305509e678b ("Bluetooth: use correct lock to prevent UAF of hdev object")
+Acked-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 1 +
+ net/bluetooth/hci_core.c | 16 +++++------
+ net/bluetooth/hci_sock.c | 49 +++++++++++++++++++++-----------
+ net/bluetooth/hci_sysfs.c | 3 ++
+ 4 files changed, 45 insertions(+), 24 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 89c8406dddb4..34a92d5ed12b 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1229,6 +1229,7 @@ struct hci_dev *hci_alloc_dev(void);
+ void hci_free_dev(struct hci_dev *hdev);
+ int hci_register_dev(struct hci_dev *hdev);
+ void hci_unregister_dev(struct hci_dev *hdev);
++void hci_cleanup_dev(struct hci_dev *hdev);
+ int hci_suspend_dev(struct hci_dev *hdev);
+ int hci_resume_dev(struct hci_dev *hdev);
+ int hci_reset_dev(struct hci_dev *hdev);
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 7d71d104fdfd..ee59d1c7f1f6 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3976,14 +3976,10 @@ EXPORT_SYMBOL(hci_register_dev);
+ /* Unregister HCI device */
+ void hci_unregister_dev(struct hci_dev *hdev)
+ {
+- int id;
+-
+ BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+
+ hci_dev_set_flag(hdev, HCI_UNREGISTER);
+
+- id = hdev->id;
+-
+ write_lock(&hci_dev_list_lock);
+ list_del(&hdev->list);
+ write_unlock(&hci_dev_list_lock);
+@@ -4018,7 +4014,14 @@ void hci_unregister_dev(struct hci_dev *hdev)
+ }
+
+ device_del(&hdev->dev);
++ /* Actual cleanup is deferred until hci_cleanup_dev(). */
++ hci_dev_put(hdev);
++}
++EXPORT_SYMBOL(hci_unregister_dev);
+
++/* Cleanup HCI device */
++void hci_cleanup_dev(struct hci_dev *hdev)
++{
+ debugfs_remove_recursive(hdev->debugfs);
+ kfree_const(hdev->hw_info);
+ kfree_const(hdev->fw_info);
+@@ -4043,11 +4046,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
+ hci_blocked_keys_clear(hdev);
+ hci_dev_unlock(hdev);
+
+- hci_dev_put(hdev);
+-
+- ida_simple_remove(&hci_index_ida, id);
++ ida_simple_remove(&hci_index_ida, hdev->id);
+ }
+-EXPORT_SYMBOL(hci_unregister_dev);
+
+ /* Suspend HCI device */
+ int hci_suspend_dev(struct hci_dev *hdev)
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index eed0dd066e12..53f85d7c5f9e 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -59,6 +59,17 @@ struct hci_pinfo {
+ char comm[TASK_COMM_LEN];
+ };
+
++static struct hci_dev *hci_hdev_from_sock(struct sock *sk)
++{
++ struct hci_dev *hdev = hci_pi(sk)->hdev;
++
++ if (!hdev)
++ return ERR_PTR(-EBADFD);
++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
++ return ERR_PTR(-EPIPE);
++ return hdev;
++}
++
+ void hci_sock_set_flag(struct sock *sk, int nr)
+ {
+ set_bit(nr, &hci_pi(sk)->flags);
+@@ -759,19 +770,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
+ if (event == HCI_DEV_UNREG) {
+ struct sock *sk;
+
+- /* Detach sockets from device */
++ /* Wake up sockets using this dead device */
+ read_lock(&hci_sk_list.lock);
+ sk_for_each(sk, &hci_sk_list.head) {
+- lock_sock(sk);
+ if (hci_pi(sk)->hdev == hdev) {
+- hci_pi(sk)->hdev = NULL;
+ sk->sk_err = EPIPE;
+- sk->sk_state = BT_OPEN;
+ sk->sk_state_change(sk);
+-
+- hci_dev_put(hdev);
+ }
+- release_sock(sk);
+ }
+ read_unlock(&hci_sk_list.lock);
+ }
+@@ -930,10 +935,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
+ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
+ unsigned long arg)
+ {
+- struct hci_dev *hdev = hci_pi(sk)->hdev;
++ struct hci_dev *hdev = hci_hdev_from_sock(sk);
+
+- if (!hdev)
+- return -EBADFD;
++ if (IS_ERR(hdev))
++ return PTR_ERR(hdev);
+
+ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
+ return -EBUSY;
+@@ -1103,6 +1108,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
+
+ lock_sock(sk);
+
++ /* Allow detaching from dead device and attaching to alive device, if
++ * the caller wants to re-bind (instead of close) this socket in
++ * response to hci_sock_dev_event(HCI_DEV_UNREG) notification.
++ */
++ hdev = hci_pi(sk)->hdev;
++ if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
++ hci_pi(sk)->hdev = NULL;
++ sk->sk_state = BT_OPEN;
++ hci_dev_put(hdev);
++ }
++ hdev = NULL;
++
+ if (sk->sk_state == BT_BOUND) {
+ err = -EALREADY;
+ goto done;
+@@ -1379,9 +1396,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
+
+ lock_sock(sk);
+
+- hdev = hci_pi(sk)->hdev;
+- if (!hdev) {
+- err = -EBADFD;
++ hdev = hci_hdev_from_sock(sk);
++ if (IS_ERR(hdev)) {
++ err = PTR_ERR(hdev);
+ goto done;
+ }
+
+@@ -1743,9 +1760,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ goto done;
+ }
+
+- hdev = hci_pi(sk)->hdev;
+- if (!hdev) {
+- err = -EBADFD;
++ hdev = hci_hdev_from_sock(sk);
++ if (IS_ERR(hdev)) {
++ err = PTR_ERR(hdev);
+ goto done;
+ }
+
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index 9874844a95a9..b69d88b88d2e 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -83,6 +83,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
+ static void bt_host_release(struct device *dev)
+ {
+ struct hci_dev *hdev = to_hci_dev(dev);
++
++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
++ hci_cleanup_dev(hdev);
+ kfree(hdev);
+ module_put(THIS_MODULE);
+ }
+--
+2.30.2
+
--- /dev/null
+From 7611bc4f79ba3b869d1914f8099aa292231b86d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:38:26 +0300
+Subject: bnx2x: fix an error code in bnx2x_nic_load()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fb653827c758725b149b5c924a5eb50ab4812750 ]
+
+Set the error code if bnx2x_alloc_fw_stats_mem() fails. The current
+code returns success.
+
+Fixes: ad5afc89365e ("bnx2x: Separate VF and PF logic")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 1a6ec1a12d53..b5d954cb409a 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -2669,7 +2669,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ }
+
+ /* Allocated memory for FW statistics */
+- if (bnx2x_alloc_fw_stats_mem(bp))
++ rc = bnx2x_alloc_fw_stats_mem(bp);
++ if (rc)
+ LOAD_ERROR_EXIT(bp, load_error0);
+
+ /* request pf to initialize status blocks */
+--
+2.30.2
+
--- /dev/null
+From 62e37a5beb11118bc2cfab51dd574198cb88e1ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jun 2021 08:42:50 +0300
+Subject: bus: ti-sysc: Fix gpt12 system timer issue with reserved status
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 3ff340e24c9dd5cff9fc07d67914c5adf67f80d6 ]
+
+Jarkko Nikula <jarkko.nikula@bitmer.com> reported that Beagleboard
+revision c2 stopped booting. Jarkko bisected the issue down to
+commit 6cfcd5563b4f ("clocksource/drivers/timer-ti-dm: Fix suspend
+and resume for am3 and am4").
+
+Let's fix the issue by tagging system timers as reserved rather than
+ignoring them. And let's not probe any interconnect target module child
+devices for reserved modules.
+
+This allows PM runtime to keep track of clocks and clockdomains for
+the interconnect target module, and prevent the system timer from idling
+as we already have SYSC_QUIRK_NO_IDLE and SYSC_QUIRK_NO_IDLE_ON_INIT
+flags set for system timers.
+
+Fixes: 6cfcd5563b4f ("clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4")
+Reported-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 38cb116ed433..188cdb0a394e 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -100,6 +100,7 @@ static const char * const clock_names[SYSC_MAX_CLOCKS] = {
+ * @cookie: data used by legacy platform callbacks
+ * @name: name if available
+ * @revision: interconnect target module revision
++ * @reserved: target module is reserved and already in use
+ * @enabled: sysc runtime enabled status
+ * @needs_resume: runtime resume needed on resume from suspend
+ * @child_needs_resume: runtime resume needed for child on resume from suspend
+@@ -130,6 +131,7 @@ struct sysc {
+ struct ti_sysc_cookie cookie;
+ const char *name;
+ u32 revision;
++ unsigned int reserved:1;
+ unsigned int enabled:1;
+ unsigned int needs_resume:1;
+ unsigned int child_needs_resume:1;
+@@ -3093,8 +3095,8 @@ static int sysc_probe(struct platform_device *pdev)
+ return error;
+
+ error = sysc_check_active_timer(ddata);
+- if (error)
+- return error;
++ if (error == -EBUSY)
++ ddata->reserved = true;
+
+ error = sysc_get_clocks(ddata);
+ if (error)
+@@ -3130,11 +3132,15 @@ static int sysc_probe(struct platform_device *pdev)
+ sysc_show_registers(ddata);
+
+ ddata->dev->type = &sysc_device_type;
+- error = of_platform_populate(ddata->dev->of_node, sysc_match_table,
+- pdata ? pdata->auxdata : NULL,
+- ddata->dev);
+- if (error)
+- goto err;
++
++ if (!ddata->reserved) {
++ error = of_platform_populate(ddata->dev->of_node,
++ sysc_match_table,
++ pdata ? pdata->auxdata : NULL,
++ ddata->dev);
++ if (error)
++ goto err;
++ }
+
+ INIT_DELAYED_WORK(&ddata->idle_work, ti_sysc_idle);
+
+--
+2.30.2
+
--- /dev/null
+From 2176413dd6e78b9138807380f66a5f3f1dfc8003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 18:07:25 +0200
+Subject: clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
+
+From: Dario Binacchi <dariobin@libero.it>
+
+[ Upstream commit 24b5b1978cd5a80db58e2a19db2f9c36fe8d4f7a ]
+
+Enabling the framebuffer leads to a system hang. Running, as a debug
+hack, the store_pan() function in drivers/video/fbdev/core/fbsysfs.c
+without taking the console_lock, allows to see the crash backtrace on
+the serial line.
+
+~ # echo 0 0 > /sys/class/graphics/fb0/pan
+
+[ 9.719414] Unhandled exception: IPSR = 00000005 LR = fffffff1
+[ 9.726937] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9
+[ 9.733008] Hardware name: STM32 (Device Tree Support)
+[ 9.738296] PC is at clk_gate_is_enabled+0x0/0x28
+[ 9.743426] LR is at stm32f4_pll_div_set_rate+0xf/0x38
+[ 9.748857] pc : [<0011e4be>] lr : [<0011f9e3>] psr: 0100000b
+[ 9.755373] sp : 00bc7be0 ip : 00000000 fp : 001f3ac4
+[ 9.760812] r10: 002610d0 r9 : 01efe920 r8 : 00540560
+[ 9.766269] r7 : 02e7ddb0 r6 : 0173eed8 r5 : 00000000 r4 : 004027c0
+[ 9.773081] r3 : 0011e4bf r2 : 02e7ddb0 r1 : 0173eed8 r0 : 1d3267b8
+[ 9.779911] xPSR: 0100000b
+[ 9.782719] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9
+[ 9.788791] Hardware name: STM32 (Device Tree Support)
+[ 9.794120] [<0000afa1>] (unwind_backtrace) from [<0000a33f>] (show_stack+0xb/0xc)
+[ 9.802421] [<0000a33f>] (show_stack) from [<0000a8df>] (__invalid_entry+0x4b/0x4c)
+
+The `pll_num' field in the post_div_data configuration contained a wrong
+value which also referenced an uninitialized hardware clock when
+clk_register_pll_div() was called.
+
+Fixes: 517633ef630e ("clk: stm32f4: Add post divisor for I2S & SAI PLLs")
+Signed-off-by: Dario Binacchi <dariobin@libero.it>
+Reviewed-by: Gabriel Fernandez <gabriel.fernandez@st.com>
+Link: https://lore.kernel.org/r/20210725160725.10788-1-dariobin@libero.it
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-stm32f4.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
+index 18117ce5ff85..5c75e3d906c2 100644
+--- a/drivers/clk/clk-stm32f4.c
++++ b/drivers/clk/clk-stm32f4.c
+@@ -526,7 +526,7 @@ struct stm32f4_pll {
+
+ struct stm32f4_pll_post_div_data {
+ int idx;
+- u8 pll_num;
++ int pll_idx;
+ const char *name;
+ const char *parent;
+ u8 flag;
+@@ -557,13 +557,13 @@ static const struct clk_div_table post_divr_table[] = {
+
+ #define MAX_POST_DIV 3
+ static const struct stm32f4_pll_post_div_data post_div_data[MAX_POST_DIV] = {
+- { CLK_I2SQ_PDIV, PLL_I2S, "plli2s-q-div", "plli2s-q",
++ { CLK_I2SQ_PDIV, PLL_VCO_I2S, "plli2s-q-div", "plli2s-q",
+ CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 0, 5, 0, NULL},
+
+- { CLK_SAIQ_PDIV, PLL_SAI, "pllsai-q-div", "pllsai-q",
++ { CLK_SAIQ_PDIV, PLL_VCO_SAI, "pllsai-q-div", "pllsai-q",
+ CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 8, 5, 0, NULL },
+
+- { NO_IDX, PLL_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT,
++ { NO_IDX, PLL_VCO_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT,
+ STM32F4_RCC_DCKCFGR, 16, 2, 0, post_divr_table },
+ };
+
+@@ -1774,7 +1774,7 @@ static void __init stm32f4_rcc_init(struct device_node *np)
+ post_div->width,
+ post_div->flag_div,
+ post_div->div_table,
+- clks[post_div->pll_num],
++ clks[post_div->pll_idx],
+ &stm32f4_clk_lock);
+
+ if (post_div->idx != NO_IDX)
+--
+2.30.2
+
--- /dev/null
+From 385032afe644fa2edaa1465d0f68da3f7aee4462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jul 2021 14:27:42 +0300
+Subject: clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 2bcc025ab9bbd029b1730cde71cb4e4f0ed35d0f ]
+
+Implement disable_unused() callback of tegra_clk_sdmmc_mux_ops to fix
+imbalanced disabling of the unused MMC clock on Tegra210 Jetson Nano.
+
+Fixes: c592c8a28f58 ("clk: tegra: Fix refcounting of gate clocks")
+Reported-by: Jon Hunter <jonathanh@nvidia.com> # T210 Nano
+Tested-by: Jon Hunter <jonathanh@nvidia.com> # T210 Nano
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210717112742.7196-1-digetx@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-sdmmc-mux.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/clk/tegra/clk-sdmmc-mux.c b/drivers/clk/tegra/clk-sdmmc-mux.c
+index 316912d3b1a4..4f2c3309eea4 100644
+--- a/drivers/clk/tegra/clk-sdmmc-mux.c
++++ b/drivers/clk/tegra/clk-sdmmc-mux.c
+@@ -194,6 +194,15 @@ static void clk_sdmmc_mux_disable(struct clk_hw *hw)
+ gate_ops->disable(gate_hw);
+ }
+
++static void clk_sdmmc_mux_disable_unused(struct clk_hw *hw)
++{
++ struct tegra_sdmmc_mux *sdmmc_mux = to_clk_sdmmc_mux(hw);
++ const struct clk_ops *gate_ops = sdmmc_mux->gate_ops;
++ struct clk_hw *gate_hw = &sdmmc_mux->gate.hw;
++
++ gate_ops->disable_unused(gate_hw);
++}
++
+ static void clk_sdmmc_mux_restore_context(struct clk_hw *hw)
+ {
+ struct clk_hw *parent = clk_hw_get_parent(hw);
+@@ -218,6 +227,7 @@ static const struct clk_ops tegra_clk_sdmmc_mux_ops = {
+ .is_enabled = clk_sdmmc_mux_is_enabled,
+ .enable = clk_sdmmc_mux_enable,
+ .disable = clk_sdmmc_mux_disable,
++ .disable_unused = clk_sdmmc_mux_disable_unused,
+ .restore_context = clk_sdmmc_mux_restore_context,
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 3052b110bff70f1c5fd8923df86b6dc635a0dbd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jun 2021 12:09:29 -0700
+Subject: dmaengine: idxd: fix array index when int_handles are being used
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit da435aedb00a4ef61019ff11ae0c08ffb9b1fb18 ]
+
+The index to the irq vector should be local and has no relation to
+the assigned interrupt handle. Assign the MSIX interrupt index that is
+programmed for the descriptor. The interrupt handle only matters when it
+comes to hardware descriptor programming.
+
+Fixes: eb15e7154fbf ("dmaengine: idxd: add interrupt handle request and release support")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/162456176939.1121476.3366256009925001897.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/submit.c | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
+index 19afb62abaff..e29887528077 100644
+--- a/drivers/dma/idxd/submit.c
++++ b/drivers/dma/idxd/submit.c
+@@ -128,19 +128,8 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ * Pending the descriptor to the lockless list for the irq_entry
+ * that we designated the descriptor to.
+ */
+- if (desc->hw->flags & IDXD_OP_FLAG_RCI) {
+- int vec;
+-
+- /*
+- * If the driver is on host kernel, it would be the value
+- * assigned to interrupt handle, which is index for MSIX
+- * vector. If it's guest then can't use the int_handle since
+- * that is the index to IMS for the entire device. The guest
+- * device local index will be used.
+- */
+- vec = !idxd->int_handles ? desc->hw->int_handle : desc->vector;
+- llist_add(&desc->llnode, &idxd->irq_entries[vec].pending_llist);
+- }
++ if (desc->hw->flags & IDXD_OP_FLAG_RCI)
++ llist_add(&desc->llnode, &idxd->irq_entries[desc->vector].pending_llist);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 6e415b0ca046303601c15d36899f2959e2681018 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 11:38:41 -0700
+Subject: dmaengine: idxd: fix desc->vector that isn't being updated
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 8ba89a3c7967808f33478a8573277cf6a7412c4c ]
+
+Missing update for desc->vector when the wq vector gets updated. This
+causes the desc->vector to always be at 0.
+
+Fixes: da435aedb00a ("dmaengine: idxd: fix array index when int_handles are being used")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/162628784374.353761.4736602409627820431.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/submit.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
+index e29887528077..21d7d09f73dd 100644
+--- a/drivers/dma/idxd/submit.c
++++ b/drivers/dma/idxd/submit.c
+@@ -25,11 +25,10 @@ static struct idxd_desc *__get_desc(struct idxd_wq *wq, int idx, int cpu)
+ * Descriptor completion vectors are 1...N for MSIX. We will round
+ * robin through the N vectors.
+ */
+- wq->vec_ptr = (wq->vec_ptr % idxd->num_wq_irqs) + 1;
++ wq->vec_ptr = desc->vector = (wq->vec_ptr % idxd->num_wq_irqs) + 1;
+ if (!idxd->int_handles) {
+ desc->hw->int_handle = wq->vec_ptr;
+ } else {
+- desc->vector = wq->vec_ptr;
+ /*
+ * int_handles are only for descriptor completion. However for device
+ * MSIX enumeration, vec 0 is used for misc interrupts. Therefore even
+--
+2.30.2
+
--- /dev/null
+From 6c6168bcd3f431c659e73392d8247c305795937b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 14:57:19 -0700
+Subject: dmaengine: idxd: fix sequence for pci driver remove() and shutdown()
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 7eb25da161befbc9a80e94e1bd90d6c06aa645cf ]
+
+->shutdown() call should only be responsible for quiescing the device.
+Currently it is doing PCI device tear down. This causes issue when things
+like MMIO mapping is removed while idxd_unregister_devices() will trigger
+removal of idxd device sub-driver and still initiates MMIO writes to the
+device. Another issue is with the unregistering of idxd 'struct device',
+the memory context gets freed. So the teardown calls are accessing freed
+memory and can cause kernel oops. Move all the teardown bits that doesn't
+belong in shutdown to ->remove() call. Move unregistering of the idxd
+conf_dev 'struct device' to after doing all the teardown to free all
+the memory that's no longer needed.
+
+Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/162629983901.395844.17964803190905549615.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/init.c | 26 +++++++++++++++++---------
+ drivers/dma/idxd/sysfs.c | 2 --
+ 2 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 4bc80eb6b9e7..32cca6a0e66a 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -759,32 +759,40 @@ static void idxd_shutdown(struct pci_dev *pdev)
+ for (i = 0; i < msixcnt; i++) {
+ irq_entry = &idxd->irq_entries[i];
+ synchronize_irq(irq_entry->vector);
+- free_irq(irq_entry->vector, irq_entry);
+ if (i == 0)
+ continue;
+ idxd_flush_pending_llist(irq_entry);
+ idxd_flush_work_list(irq_entry);
+ }
+-
+- idxd_msix_perm_clear(idxd);
+- idxd_release_int_handles(idxd);
+- pci_free_irq_vectors(pdev);
+- pci_iounmap(pdev, idxd->reg_base);
+- pci_disable_device(pdev);
+- destroy_workqueue(idxd->wq);
++ flush_workqueue(idxd->wq);
+ }
+
+ static void idxd_remove(struct pci_dev *pdev)
+ {
+ struct idxd_device *idxd = pci_get_drvdata(pdev);
++ struct idxd_irq_entry *irq_entry;
++ int msixcnt = pci_msix_vec_count(pdev);
++ int i;
+
+ dev_dbg(&pdev->dev, "%s called\n", __func__);
+ idxd_shutdown(pdev);
+ if (device_pasid_enabled(idxd))
+ idxd_disable_system_pasid(idxd);
+ idxd_unregister_devices(idxd);
+- perfmon_pmu_remove(idxd);
++
++ for (i = 0; i < msixcnt; i++) {
++ irq_entry = &idxd->irq_entries[i];
++ free_irq(irq_entry->vector, irq_entry);
++ }
++ idxd_msix_perm_clear(idxd);
++ idxd_release_int_handles(idxd);
++ pci_free_irq_vectors(pdev);
++ pci_iounmap(pdev, idxd->reg_base);
+ iommu_dev_disable_feature(&pdev->dev, IOMMU_DEV_FEAT_SVA);
++ pci_disable_device(pdev);
++ destroy_workqueue(idxd->wq);
++ perfmon_pmu_remove(idxd);
++ device_unregister(&idxd->conf_dev);
+ }
+
+ static struct pci_driver idxd_pci_driver = {
+diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
+index 0460d58e3941..bb4df63906a7 100644
+--- a/drivers/dma/idxd/sysfs.c
++++ b/drivers/dma/idxd/sysfs.c
+@@ -1744,8 +1744,6 @@ void idxd_unregister_devices(struct idxd_device *idxd)
+
+ device_unregister(&group->conf_dev);
+ }
+-
+- device_unregister(&idxd->conf_dev);
+ }
+
+ int idxd_register_bus_type(void)
+--
+2.30.2
+
--- /dev/null
+From 3fa7220788ea13964dd53b2bd56213b1cb03879d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jun 2021 13:43:32 -0700
+Subject: dmaengine: idxd: fix setup sequence for MSIXPERM table
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit d5c10e0fc8645342fe5c9796b00c84ab078cd713 ]
+
+The MSIX permission table should be programmed BEFORE request_irq()
+happens. This prevents any possibility of an interrupt happening before the
+MSIX perm table is setup, however slight.
+
+Fixes: 6df0e6c57dfc ("dmaengine: idxd: clear MSIX permission entry on shutdown")
+Sign-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/162456741222.1138073.1298447364671237896.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 442d55c11a5f..4bc80eb6b9e7 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -102,6 +102,8 @@ static int idxd_setup_interrupts(struct idxd_device *idxd)
+ spin_lock_init(&idxd->irq_entries[i].list_lock);
+ }
+
++ idxd_msix_perm_setup(idxd);
++
+ irq_entry = &idxd->irq_entries[0];
+ rc = request_threaded_irq(irq_entry->vector, NULL, idxd_misc_thread,
+ 0, "idxd-misc", irq_entry);
+@@ -148,7 +150,6 @@ static int idxd_setup_interrupts(struct idxd_device *idxd)
+ }
+
+ idxd_unmask_error_interrupts(idxd);
+- idxd_msix_perm_setup(idxd);
+ return 0;
+
+ err_wq_irqs:
+@@ -162,6 +163,7 @@ static int idxd_setup_interrupts(struct idxd_device *idxd)
+ err_misc_irq:
+ /* Disable error interrupt generation */
+ idxd_mask_error_interrupts(idxd);
++ idxd_msix_perm_clear(idxd);
+ err_irq_entries:
+ pci_free_irq_vectors(pdev);
+ dev_err(dev, "No usable interrupts\n");
+--
+2.30.2
+
--- /dev/null
+From b34026cfa6d2f187818956402c863e4304e625c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 11:50:06 -0700
+Subject: dmaengine: idxd: fix submission race window
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 6b4b87f2c31ac1af4f244990a7cbfb50d3f3e33f ]
+
+Konstantin observed that when descriptors are submitted, the descriptor is
+added to the pending list after the submission. This creates a race window
+with the slight possibility that the descriptor can complete before it
+gets added to the pending list and this window would cause the completion
+handler to miss processing the descriptor.
+
+To address the issue, the addition of the descriptor to the pending list
+must be done before it gets submitted to the hardware. However, submitting
+to swq with ENQCMDS instruction can cause a failure with the condition of
+either wq is full or wq is not "active".
+
+With the descriptor allocation being the gate to the wq capacity, it is not
+possible to hit a retry with ENQCMDS submission to the swq. The only
+possible failure can happen is when wq is no longer "active" due to hw
+error and therefore we are moving towards taking down the portal. Given
+this is a rare condition and there's no longer concern over I/O
+performance, the driver can walk the completion lists in order to retrieve
+and abort the descriptor.
+
+The error path will set the descriptor to aborted status. It will take the
+work list lock to prevent further processing of worklist. It will do a
+delete_all on the pending llist to retrieve all descriptors on the pending
+llist. The delete_all action does not require a lock. It will walk through
+the acquired llist to find the aborted descriptor while add all remaining
+descriptors to the work list since it holds the lock. If it does not find
+the aborted descriptor on the llist, it will walk through the work
+list. And if it still does not find the descriptor, then it means the
+interrupt handler has removed the desc from the llist but is pending on
+the work list lock and will process it once the error path releases the
+lock.
+
+Fixes: eb15e7154fbf ("dmaengine: idxd: add interrupt handle request and release support")
+Reported-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/162628855747.360485.10101925573082466530.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/idxd.h | 14 +++++++
+ drivers/dma/idxd/irq.c | 27 +++++++++-----
+ drivers/dma/idxd/submit.c | 78 ++++++++++++++++++++++++++++++++++-----
+ 3 files changed, 101 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
+index 26482c7d4c3a..fc708be7ad9a 100644
+--- a/drivers/dma/idxd/idxd.h
++++ b/drivers/dma/idxd/idxd.h
+@@ -294,6 +294,14 @@ struct idxd_desc {
+ struct idxd_wq *wq;
+ };
+
++/*
++ * This is software defined error for the completion status. We overload the error code
++ * that will never appear in completion status and only SWERR register.
++ */
++enum idxd_completion_status {
++ IDXD_COMP_DESC_ABORT = 0xff,
++};
++
+ #define confdev_to_idxd(dev) container_of(dev, struct idxd_device, conf_dev)
+ #define confdev_to_wq(dev) container_of(dev, struct idxd_wq, conf_dev)
+
+@@ -482,4 +490,10 @@ static inline void perfmon_init(void) {}
+ static inline void perfmon_exit(void) {}
+ #endif
+
++static inline void complete_desc(struct idxd_desc *desc, enum idxd_complete_type reason)
++{
++ idxd_dma_complete_txd(desc, reason);
++ idxd_free_desc(desc->wq, desc);
++}
++
+ #endif
+diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
+index ae68e1e5487a..4e3a7198c0ca 100644
+--- a/drivers/dma/idxd/irq.c
++++ b/drivers/dma/idxd/irq.c
+@@ -245,12 +245,6 @@ static inline bool match_fault(struct idxd_desc *desc, u64 fault_addr)
+ return false;
+ }
+
+-static inline void complete_desc(struct idxd_desc *desc, enum idxd_complete_type reason)
+-{
+- idxd_dma_complete_txd(desc, reason);
+- idxd_free_desc(desc->wq, desc);
+-}
+-
+ static int irq_process_pending_llist(struct idxd_irq_entry *irq_entry,
+ enum irq_work_type wtype,
+ int *processed, u64 data)
+@@ -272,8 +266,16 @@ static int irq_process_pending_llist(struct idxd_irq_entry *irq_entry,
+ reason = IDXD_COMPLETE_DEV_FAIL;
+
+ llist_for_each_entry_safe(desc, t, head, llnode) {
+- if (desc->completion->status) {
+- if ((desc->completion->status & DSA_COMP_STATUS_MASK) != DSA_COMP_SUCCESS)
++ u8 status = desc->completion->status & DSA_COMP_STATUS_MASK;
++
++ if (status) {
++ if (unlikely(status == IDXD_COMP_DESC_ABORT)) {
++ complete_desc(desc, IDXD_COMPLETE_ABORT);
++ (*processed)++;
++ continue;
++ }
++
++ if (unlikely(status != DSA_COMP_SUCCESS))
+ match_fault(desc, data);
+ complete_desc(desc, reason);
+ (*processed)++;
+@@ -329,7 +331,14 @@ static int irq_process_work_list(struct idxd_irq_entry *irq_entry,
+ spin_unlock_irqrestore(&irq_entry->list_lock, flags);
+
+ list_for_each_entry(desc, &flist, list) {
+- if ((desc->completion->status & DSA_COMP_STATUS_MASK) != DSA_COMP_SUCCESS)
++ u8 status = desc->completion->status & DSA_COMP_STATUS_MASK;
++
++ if (unlikely(status == IDXD_COMP_DESC_ABORT)) {
++ complete_desc(desc, IDXD_COMPLETE_ABORT);
++ continue;
++ }
++
++ if (unlikely(status != DSA_COMP_SUCCESS))
+ match_fault(desc, data);
+ complete_desc(desc, reason);
+ }
+diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
+index 21d7d09f73dd..36c9c1a89b7e 100644
+--- a/drivers/dma/idxd/submit.c
++++ b/drivers/dma/idxd/submit.c
+@@ -87,9 +87,64 @@ void idxd_free_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ sbitmap_queue_clear(&wq->sbq, desc->id, cpu);
+ }
+
++static struct idxd_desc *list_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
++ struct idxd_desc *desc)
++{
++ struct idxd_desc *d, *n;
++
++ lockdep_assert_held(&ie->list_lock);
++ list_for_each_entry_safe(d, n, &ie->work_list, list) {
++ if (d == desc) {
++ list_del(&d->list);
++ return d;
++ }
++ }
++
++ /*
++ * At this point, the desc needs to be aborted is held by the completion
++ * handler where it has taken it off the pending list but has not added to the
++ * work list. It will be cleaned up by the interrupt handler when it sees the
++ * IDXD_COMP_DESC_ABORT for completion status.
++ */
++ return NULL;
++}
++
++static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
++ struct idxd_desc *desc)
++{
++ struct idxd_desc *d, *t, *found = NULL;
++ struct llist_node *head;
++ unsigned long flags;
++
++ desc->completion->status = IDXD_COMP_DESC_ABORT;
++ /*
++ * Grab the list lock so it will block the irq thread handler. This allows the
++ * abort code to locate the descriptor need to be aborted.
++ */
++ spin_lock_irqsave(&ie->list_lock, flags);
++ head = llist_del_all(&ie->pending_llist);
++ if (head) {
++ llist_for_each_entry_safe(d, t, head, llnode) {
++ if (d == desc) {
++ found = desc;
++ continue;
++ }
++ list_add_tail(&desc->list, &ie->work_list);
++ }
++ }
++
++ if (!found)
++ found = list_abort_desc(wq, ie, desc);
++ spin_unlock_irqrestore(&ie->list_lock, flags);
++
++ if (found)
++ complete_desc(found, IDXD_COMPLETE_ABORT);
++}
++
+ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ {
+ struct idxd_device *idxd = wq->idxd;
++ struct idxd_irq_entry *ie = NULL;
+ void __iomem *portal;
+ int rc;
+
+@@ -107,6 +162,16 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ * even on UP because the recipient is a device.
+ */
+ wmb();
++
++ /*
++ * Pending the descriptor to the lockless list for the irq_entry
++ * that we designated the descriptor to.
++ */
++ if (desc->hw->flags & IDXD_OP_FLAG_RCI) {
++ ie = &idxd->irq_entries[desc->vector];
++ llist_add(&desc->llnode, &ie->pending_llist);
++ }
++
+ if (wq_dedicated(wq)) {
+ iosubmit_cmds512(portal, desc->hw, 1);
+ } else {
+@@ -117,18 +182,13 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ * device is not accepting descriptor at all.
+ */
+ rc = enqcmds(portal, desc->hw);
+- if (rc < 0)
++ if (rc < 0) {
++ if (ie)
++ llist_abort_desc(wq, ie, desc);
+ return rc;
++ }
+ }
+
+ percpu_ref_put(&wq->wq_active);
+-
+- /*
+- * Pending the descriptor to the lockless list for the irq_entry
+- * that we designated the descriptor to.
+- */
+- if (desc->hw->flags & IDXD_OP_FLAG_RCI)
+- llist_add(&desc->llnode, &idxd->irq_entries[desc->vector].pending_llist);
+-
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 8b10681957375995f0a8bd92e35ddec7f55b2492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 09:18:21 +0200
+Subject: dmaengine: imx-dma: configure the generic DMA type to make it work
+
+From: Juergen Borleis <jbe@pengutronix.de>
+
+[ Upstream commit 7199ddede9f0f2f68d41e6928e1c6c4bca9c39c0 ]
+
+Commit dea7a9fbb009 ("dmaengine: imx-dma: remove dma_slave_config
+direction usage") changes the method from a "configuration when called"
+to an "configuration when used". Due to this, only the cyclic DMA type
+gets configured correctly, while the generic DMA type is left
+non-configured.
+
+Without this additional call, the struct imxdma_channel::word_size member
+is stuck at DMA_SLAVE_BUSWIDTH_UNDEFINED and imxdma_prep_slave_sg() always
+returns NULL.
+
+Signed-off-by: Juergen Borleis <jbe@pengutronix.de>
+Fixes: dea7a9fbb009 ("dmaengine: imx-dma: remove dma_slave_config direction usage")
+Link: https://lore.kernel.org/r/20210729071821.9857-1-jbe@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
+index 7f116bbcfad2..2ddc31e64db0 100644
+--- a/drivers/dma/imx-dma.c
++++ b/drivers/dma/imx-dma.c
+@@ -812,6 +812,8 @@ static struct dma_async_tx_descriptor *imxdma_prep_slave_sg(
+ dma_length += sg_dma_len(sg);
+ }
+
++ imxdma_config_write(chan, &imxdmac->config, direction);
++
+ switch (imxdmac->word_size) {
+ case DMA_SLAVE_BUSWIDTH_4_BYTES:
+ if (sg_dma_len(sgl) & 3 || sgl->dma_address & 3)
+--
+2.30.2
+
--- /dev/null
+From 92b3a180c5c8297df9014cebcadabd378df19f8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 14:46:38 +0800
+Subject: dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit d54db74ad6e0dea8c253fb68c689b836657ab914 ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: 48bc73ba14bcd ("dmaengine: stm32-dma: Add PM Runtime support")
+Fixes: 05f8740a0e6fc ("dmaengine: stm32-dma: add suspend/resume power management support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210607064640.121394-2-zhangqilong3@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-dma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c
+index f54ecb123a52..7dd1d3d0bf06 100644
+--- a/drivers/dma/stm32-dma.c
++++ b/drivers/dma/stm32-dma.c
+@@ -1200,7 +1200,7 @@ static int stm32_dma_alloc_chan_resources(struct dma_chan *c)
+
+ chan->config_init = false;
+
+- ret = pm_runtime_get_sync(dmadev->ddev.dev);
++ ret = pm_runtime_resume_and_get(dmadev->ddev.dev);
+ if (ret < 0)
+ return ret;
+
+@@ -1470,7 +1470,7 @@ static int stm32_dma_suspend(struct device *dev)
+ struct stm32_dma_device *dmadev = dev_get_drvdata(dev);
+ int id, ret, scr;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 508705b59c00f843870736ad535cbdf3785444da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 14:46:39 +0800
+Subject: dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32
+ dmamux ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit baa16371c9525f24d508508e4d296c031e1de29c ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: 4f3ceca254e0f ("dmaengine: stm32-dmamux: Add PM Runtime support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210607064640.121394-3-zhangqilong3@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-dmamux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c
+index ef0d0555103d..a42164389ebc 100644
+--- a/drivers/dma/stm32-dmamux.c
++++ b/drivers/dma/stm32-dmamux.c
+@@ -137,7 +137,7 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
+
+ /* Set dma request */
+ spin_lock_irqsave(&dmamux->lock, flags);
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0) {
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+ goto error;
+@@ -336,7 +336,7 @@ static int stm32_dmamux_suspend(struct device *dev)
+ struct stm32_dmamux_data *stm32_dmamux = platform_get_drvdata(pdev);
+ int i, ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+@@ -361,7 +361,7 @@ static int stm32_dmamux_resume(struct device *dev)
+ if (ret < 0)
+ return ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 98fa33d284a6ada6aa0c7da038b94a1ff83339e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 14:47:32 +0900
+Subject: dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic
+ state
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 55f24c27b6c1a840b62fe297616f1f9ea3576cb7 ]
+
+The function uniphier_xdmac_chan_stop() is only called in atomic state.
+Should use readl_poll_timeout_atomic() there instead of
+readl_poll_timeout().
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 667b9251440b ("dmaengine: uniphier-xdmac: Add UniPhier external DMA controller driver")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Link: https://lore.kernel.org/r/1627364852-28432-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/uniphier-xdmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/uniphier-xdmac.c b/drivers/dma/uniphier-xdmac.c
+index 16b19654873d..d6b8a202474f 100644
+--- a/drivers/dma/uniphier-xdmac.c
++++ b/drivers/dma/uniphier-xdmac.c
+@@ -209,8 +209,8 @@ static int uniphier_xdmac_chan_stop(struct uniphier_xdmac_chan *xc)
+ writel(0, xc->reg_ch_base + XDMAC_TSS);
+
+ /* wait until transfer is stopped */
+- return readl_poll_timeout(xc->reg_ch_base + XDMAC_STAT, val,
+- !(val & XDMAC_STAT_TENF), 100, 1000);
++ return readl_poll_timeout_atomic(xc->reg_ch_base + XDMAC_STAT, val,
++ !(val & XDMAC_STAT_TENF), 100, 1000);
+ }
+
+ /* xc->vc.lock must be held by caller */
+--
+2.30.2
+
--- /dev/null
+From 7cf2e0aa81013da592312df7d777140ccf61bbbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 10:23:54 -0500
+Subject: drm/i915: Call i915_globals_exit() if pci_register_device() fails
+
+From: Jason Ekstrand <jason@jlekstrand.net>
+
+[ Upstream commit 1354d830cb8f9be966cc07fc61368af27ffb7c4a ]
+
+In the unlikely event that pci_register_device() fails, we were tearing
+down our PMU setup but not globals. This leaves a bunch of memory slabs
+lying around.
+
+Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
+Fixes: 32eb6bcfdda9 ("drm/i915: Make request allocation caches global")
+[danvet: Fix conflicts against removal of the globals_flush
+infrastructure.]
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210721152358.2893314-3-jason@jlekstrand.net
+(cherry picked from commit db484889d1ff0645e07e360d3e3ad306c0515821)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Fixed small conflict while cherry picking]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_globals.c | 2 +-
+ drivers/gpu/drm/i915/i915_pci.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_globals.c b/drivers/gpu/drm/i915/i915_globals.c
+index 3aa213684293..e27739a50bee 100644
+--- a/drivers/gpu/drm/i915/i915_globals.c
++++ b/drivers/gpu/drm/i915/i915_globals.c
+@@ -149,7 +149,7 @@ static void __exit __i915_globals_flush(void)
+ atomic_dec(&active);
+ }
+
+-void __exit i915_globals_exit(void)
++void i915_globals_exit(void)
+ {
+ GEM_BUG_ON(atomic_read(&active));
+
+diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
+index 480553746794..a6261a8103f4 100644
+--- a/drivers/gpu/drm/i915/i915_pci.c
++++ b/drivers/gpu/drm/i915/i915_pci.c
+@@ -1168,6 +1168,7 @@ static int __init i915_init(void)
+ err = pci_register_driver(&i915_pci_driver);
+ if (err) {
+ i915_pmu_exit();
++ i915_globals_exit();
+ return err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1e2a81161c5390d2c01aa53ddb5b48d15d72d132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 13:41:47 -0700
+Subject: drm/i915: fix i915_globals_exit() section mismatch error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a07296453bf2778952a09b6244a695bf7607babb ]
+
+Fix modpost Section mismatch error in i915_globals_exit().
+Since both an __init function and an __exit function can call
+i915_globals_exit(), any function that i915_globals_exit() calls
+should not be marked as __init or __exit. I.e., it needs to be
+available for either of them.
+
+WARNING: modpost: vmlinux.o(.text+0x8b796a): Section mismatch in reference from the function i915_globals_exit() to the function .exit.text:__i915_globals_flush()
+The function i915_globals_exit() references a function in an exit section.
+Often the function __i915_globals_flush() has valid usage outside the exit section
+and the fix is to remove the __exit annotation of __i915_globals_flush.
+
+ERROR: modpost: Section mismatches detected.
+Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
+
+Fixes: 1354d830cb8f ("drm/i915: Call i915_globals_exit() if pci_register_device() fails")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jason Ekstrand <jason@jlekstrand.net>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210804204147.2070-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_globals.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_globals.c b/drivers/gpu/drm/i915/i915_globals.c
+index e27739a50bee..57d2943884ab 100644
+--- a/drivers/gpu/drm/i915/i915_globals.c
++++ b/drivers/gpu/drm/i915/i915_globals.c
+@@ -139,7 +139,7 @@ void i915_globals_unpark(void)
+ atomic_inc(&active);
+ }
+
+-static void __exit __i915_globals_flush(void)
++static void __i915_globals_flush(void)
+ {
+ atomic_inc(&active); /* skip shrinking */
+
+--
+2.30.2
+
--- /dev/null
+From 40c51c0f1c3a5555313ac0f5db368cfc23941ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 14:51:17 -0700
+Subject: drm/kmb: Enable LCD DMA for low TVDDCV
+
+From: Edmund Dea <edmund.j.dea@intel.com>
+
+[ Upstream commit 0aab5dce395636eddf4e5f33eba88390328a95b4 ]
+
+There's an undocumented dependency between LCD layer enable bits [2-5]
+and the AXI pipelined read enable bit [28] in the LCD_CONTROL register.
+The proper order of operation is:
+
+1) Clear AXI pipelined read enable bit
+2) Set LCD layers
+3) Set AXI pipelined read enable bit
+
+With this update, LCD can start DMA when TVDDCV is reduced down to 700mV.
+
+Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210728003126.1425028-1-anitha.chrisanthus@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_drv.c | 14 ++++++++++++++
+ drivers/gpu/drm/kmb/kmb_plane.c | 15 +++++++++++++--
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.c b/drivers/gpu/drm/kmb/kmb_drv.c
+index 96ea1a2c11dd..c0b1c6f99249 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.c
++++ b/drivers/gpu/drm/kmb/kmb_drv.c
+@@ -203,6 +203,7 @@ static irqreturn_t handle_lcd_irq(struct drm_device *dev)
+ unsigned long status, val, val1;
+ int plane_id, dma0_state, dma1_state;
+ struct kmb_drm_private *kmb = to_kmb(dev);
++ u32 ctrl = 0;
+
+ status = kmb_read_lcd(kmb, LCD_INT_STATUS);
+
+@@ -227,6 +228,19 @@ static irqreturn_t handle_lcd_irq(struct drm_device *dev)
+ kmb_clr_bitmask_lcd(kmb, LCD_CONTROL,
+ kmb->plane_status[plane_id].ctrl);
+
++ ctrl = kmb_read_lcd(kmb, LCD_CONTROL);
++ if (!(ctrl & (LCD_CTRL_VL1_ENABLE |
++ LCD_CTRL_VL2_ENABLE |
++ LCD_CTRL_GL1_ENABLE |
++ LCD_CTRL_GL2_ENABLE))) {
++ /* If no LCD layers are using DMA,
++ * then disable DMA pipelined AXI read
++ * transactions.
++ */
++ kmb_clr_bitmask_lcd(kmb, LCD_CONTROL,
++ LCD_CTRL_PIPELINE_DMA);
++ }
++
+ kmb->plane_status[plane_id].disable = false;
+ }
+ }
+diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
+index d5b6195856d1..ecee6782612d 100644
+--- a/drivers/gpu/drm/kmb/kmb_plane.c
++++ b/drivers/gpu/drm/kmb/kmb_plane.c
+@@ -427,8 +427,14 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+
+ kmb_set_bitmask_lcd(kmb, LCD_CONTROL, ctrl);
+
+- /* FIXME no doc on how to set output format,these values are
+- * taken from the Myriadx tests
++ /* Enable pipeline AXI read transactions for the DMA
++ * after setting graphics layers. This must be done
++ * in a separate write cycle.
++ */
++ kmb_set_bitmask_lcd(kmb, LCD_CONTROL, LCD_CTRL_PIPELINE_DMA);
++
++ /* FIXME no doc on how to set output format, these values are taken
++ * from the Myriadx tests
+ */
+ out_format |= LCD_OUTF_FORMAT_RGB888;
+
+@@ -526,6 +532,11 @@ struct kmb_plane *kmb_plane_init(struct drm_device *drm)
+ plane->id = i;
+ }
+
++ /* Disable pipeline AXI read transactions for the DMA
++ * prior to setting graphics layers
++ */
++ kmb_clr_bitmask_lcd(kmb, LCD_CONTROL, LCD_CTRL_PIPELINE_DMA);
++
+ return primary;
+ cleanup:
+ drmm_kfree(drm, plane);
+--
+2.30.2
+
--- /dev/null
+From 03338070b7a0a33ced29b33409dc4176cf751932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 10:27:28 +0800
+Subject: ext4: fix potential uninitialized access to retval in kmmpd
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit b66541422824cf6cf20e9a35112e9cb5d82cdf62 ]
+
+if (!ext4_has_feature_mmp(sb)) then retval can be unitialized before
+we jump to the wait_to_exit label.
+
+Fixes: 61bb4a1c417e ("ext4: fix possible UAF when remounting r/o a mmp-protected file system")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20210713022728.2533770-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
+index bc364c119af6..cebea4270817 100644
+--- a/fs/ext4/mmp.c
++++ b/fs/ext4/mmp.c
+@@ -138,7 +138,7 @@ static int kmmpd(void *data)
+ unsigned mmp_check_interval;
+ unsigned long last_update_time;
+ unsigned long diff;
+- int retval;
++ int retval = 0;
+
+ mmp_block = le64_to_cpu(es->s_mmp_block);
+ mmp = (struct mmp_struct *)(bh->b_data);
+--
+2.30.2
+
--- /dev/null
+From acae37ec99b8274c43a07e23367d21eb808f1703 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 12:00:47 +0200
+Subject: gpio: tqmx86: really make IRQ optional
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 9b87f43537acfa24b95c236beba0f45901356eb2 ]
+
+The tqmx86 MFD driver was passing IRQ 0 for "no IRQ" in the past. This
+causes warnings with newer kernels.
+
+Prepare the gpio-tqmx86 driver for the fixed MFD driver by handling a
+missing IRQ properly.
+
+Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-tqmx86.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-tqmx86.c b/drivers/gpio/gpio-tqmx86.c
+index 5022e0ad0fae..0f5d17f343f1 100644
+--- a/drivers/gpio/gpio-tqmx86.c
++++ b/drivers/gpio/gpio-tqmx86.c
+@@ -238,8 +238,8 @@ static int tqmx86_gpio_probe(struct platform_device *pdev)
+ struct resource *res;
+ int ret, irq;
+
+- irq = platform_get_irq(pdev, 0);
+- if (irq < 0)
++ irq = platform_get_irq_optional(pdev, 0);
++ if (irq < 0 && irq != -ENXIO)
+ return irq;
+
+ res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+@@ -278,7 +278,7 @@ static int tqmx86_gpio_probe(struct platform_device *pdev)
+
+ pm_runtime_enable(&pdev->dev);
+
+- if (irq) {
++ if (irq > 0) {
+ struct irq_chip *irq_chip = &gpio->irq_chip;
+ u8 irq_status;
+
+--
+2.30.2
+
--- /dev/null
+From b8e194e359e33ab8c4f07949ed9b50a2e0b337b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 18:05:38 +0800
+Subject: io-wq: fix lack of acct->nr_workers < acct->max_workers judgement
+
+From: Hao Xu <haoxu@linux.alibaba.com>
+
+[ Upstream commit 21698274da5b6fc724b005bc7ec3e6b9fbcfaa06 ]
+
+There should be this judgement before we create an io-worker
+
+Fixes: 685fe7feedb9 ("io-wq: eliminate the need for a manager thread")
+Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io-wq.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index e00ac0969470..400fba839734 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -281,9 +281,17 @@ static void create_worker_cb(struct callback_head *cb)
+ {
+ struct create_worker_data *cwd;
+ struct io_wq *wq;
++ struct io_wqe *wqe;
++ struct io_wqe_acct *acct;
+
+ cwd = container_of(cb, struct create_worker_data, work);
+- wq = cwd->wqe->wq;
++ wqe = cwd->wqe;
++ wq = wqe->wq;
++ acct = &wqe->acct[cwd->index];
++ raw_spin_lock_irq(&wqe->lock);
++ if (acct->nr_workers < acct->max_workers)
++ acct->nr_workers++;
++ raw_spin_unlock_irq(&wqe->lock);
+ create_io_worker(wq, cwd->wqe, cwd->index);
+ kfree(cwd);
+ }
+--
+2.30.2
+
--- /dev/null
+From ae90677458867ec30d87fd1ee41253bad3fc8c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 18:05:37 +0800
+Subject: io-wq: fix no lock protection of acct->nr_worker
+
+From: Hao Xu <haoxu@linux.alibaba.com>
+
+[ Upstream commit 3d4e4face9c1548752a2891e98b38b100feee336 ]
+
+There is an acct->nr_worker visit without lock protection. Think about
+the case: two callers call io_wqe_wake_worker(), one is the original
+context and the other one is an io-worker(by calling
+io_wqe_enqueue(wqe, linked)), on two cpus paralelly, this may cause
+nr_worker to be larger than max_worker.
+Let's fix it by adding lock for it, and let's do nr_workers++ before
+create_io_worker. There may be a edge cause that the first caller fails
+to create an io-worker, but the second caller doesn't know it and then
+quit creating io-worker as well:
+
+say nr_worker = max_worker - 1
+ cpu 0 cpu 1
+ io_wqe_wake_worker() io_wqe_wake_worker()
+ nr_worker < max_worker
+ nr_worker++
+ create_io_worker() nr_worker == max_worker
+ failed return
+ return
+
+But the chance of this case is very slim.
+
+Fixes: 685fe7feedb9 ("io-wq: eliminate the need for a manager thread")
+Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
+[axboe: fix unconditional create_io_worker() call]
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io-wq.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index 9efecdf025b9..e00ac0969470 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -248,10 +248,19 @@ static void io_wqe_wake_worker(struct io_wqe *wqe, struct io_wqe_acct *acct)
+ ret = io_wqe_activate_free_worker(wqe);
+ rcu_read_unlock();
+
+- if (!ret && acct->nr_workers < acct->max_workers) {
+- atomic_inc(&acct->nr_running);
+- atomic_inc(&wqe->wq->worker_refs);
+- create_io_worker(wqe->wq, wqe, acct->index);
++ if (!ret) {
++ bool do_create = false;
++
++ raw_spin_lock_irq(&wqe->lock);
++ if (acct->nr_workers < acct->max_workers) {
++ atomic_inc(&acct->nr_running);
++ atomic_inc(&wqe->wq->worker_refs);
++ acct->nr_workers++;
++ do_create = true;
++ }
++ raw_spin_unlock_irq(&wqe->lock);
++ if (do_create)
++ create_io_worker(wqe->wq, wqe, acct->index);
+ }
+ }
+
+@@ -640,6 +649,9 @@ static void create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index)
+ kfree(worker);
+ fail:
+ atomic_dec(&acct->nr_running);
++ raw_spin_lock_irq(&wqe->lock);
++ acct->nr_workers--;
++ raw_spin_unlock_irq(&wqe->lock);
+ io_worker_ref_put(wq);
+ return;
+ }
+@@ -655,9 +667,8 @@ fail:
+ worker->flags |= IO_WORKER_F_FREE;
+ if (index == IO_WQ_ACCT_BOUND)
+ worker->flags |= IO_WORKER_F_BOUND;
+- if (!acct->nr_workers && (worker->flags & IO_WORKER_F_BOUND))
++ if ((acct->nr_workers == 1) && (worker->flags & IO_WORKER_F_BOUND))
+ worker->flags |= IO_WORKER_F_FIXED;
+- acct->nr_workers++;
+ raw_spin_unlock_irq(&wqe->lock);
+ wake_up_new_task(tsk);
+ }
+--
+2.30.2
+
--- /dev/null
+From 2ba3a52e52ac7b404fe13cb4b830987309f9d53b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 09:12:54 +0900
+Subject: kbuild: cancel sub_make_done for the install target to fix DKMS
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 14ccc638b02f9ec500c17d9e39efe979145a4b61 ]
+
+Since commit bcf637f54f6d ("kbuild: parse C= and M= before changing the
+working directory"), external module builds invoked by DKMS fail because
+M= option is not parsed.
+
+I wanted to add 'unset sub_make_done' in install.sh but similar scripts,
+arch/*/boot/install.sh, are duplicated, so I set sub_make_done empty in
+the top Makefile.
+
+Fixes: bcf637f54f6d ("kbuild: parse C= and M= before changing the working directory")
+Reported-by: John S Gruber <johnsgruber@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Tested-by: John S Gruber <johnsgruber@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/Makefile b/Makefile
+index 9d810e13a83f..218f44d7fc80 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1366,6 +1366,15 @@ scripts_unifdef: scripts_basic
+ $(Q)$(MAKE) $(build)=scripts scripts/unifdef
+
+ # ---------------------------------------------------------------------------
++# Install
++
++# Many distributions have the custom install script, /sbin/installkernel.
++# If DKMS is installed, 'make install' will eventually recuses back
++# to the this Makefile to build and install external modules.
++# Cancel sub_make_done so that options such as M=, V=, etc. are parsed.
++
++install: sub_make_done :=
++
+ # Kernel selftest
+
+ PHONY += kselftest
+--
+2.30.2
+
--- /dev/null
+From bdd899a5693637a154a6e4a13476bfeefb61f106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 09:58:23 +0200
+Subject: media: videobuf2-core: dequeue if start_streaming fails
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit c592b46907adbeb81243f7eb7a468c36692658b8 ]
+
+If a vb2_queue sets q->min_buffers_needed then when the number of
+queued buffers reaches q->min_buffers_needed, vb2_core_qbuf() will call
+the start_streaming() callback. If start_streaming() returns an error,
+then that error was just returned by vb2_core_qbuf(), but the buffer
+was still queued. However, userspace expects that if VIDIOC_QBUF fails,
+the buffer is returned dequeued.
+
+So if start_streaming() fails, then remove the buffer from the queue,
+thus avoiding this unwanted side-effect.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Fixes: b3379c6201bb ("[media] vb2: only call start_streaming if sufficient buffers are queued")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/videobuf2/videobuf2-core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 02281d13505f..508ac295eb06 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1573,6 +1573,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,
+ struct media_request *req)
+ {
+ struct vb2_buffer *vb;
++ enum vb2_buffer_state orig_state;
+ int ret;
+
+ if (q->error) {
+@@ -1673,6 +1674,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,
+ * Add to the queued buffers list, a buffer will stay on it until
+ * dequeued in dqbuf.
+ */
++ orig_state = vb->state;
+ list_add_tail(&vb->queued_entry, &q->queued_list);
+ q->queued_count++;
+ q->waiting_for_buffers = false;
+@@ -1703,8 +1705,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,
+ if (q->streaming && !q->start_streaming_called &&
+ q->queued_count >= q->min_buffers_needed) {
+ ret = vb2_start_streaming(q);
+- if (ret)
++ if (ret) {
++ /*
++ * Since vb2_core_qbuf will return with an error,
++ * we should return it to state DEQUEUED since
++ * the error indicates that the buffer wasn't queued.
++ */
++ list_del(&vb->queued_entry);
++ q->queued_count--;
++ vb->state = orig_state;
+ return ret;
++ }
+ }
+
+ dprintk(q, 2, "qbuf of buffer %d succeeded\n", vb->index);
+--
+2.30.2
+
--- /dev/null
+From d63bdc3c48f317936335cf4778d0857229733c8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:30:45 +0800
+Subject: MIPS: check return value of pgtable_pmd_page_ctor
+
+From: Huang Pei <huangpei@loongson.cn>
+
+[ Upstream commit 6aa32467299e9e12280a6aec9dbc21bf2db830b0 ]
+
++. According to Documentation/vm/split_page_table_lock, handle failure
+of pgtable_pmd_page_ctor
+
++. Use GFP_KERNEL_ACCOUNT instead of GFP_KERNEL|__GFP_ACCOUNT
+
++. Adjust coding style
+
+Fixes: ed914d48b6a1 ("MIPS: add PMD table accounting into MIPS')
+Reported-by: Joshua Kinard <kumba@gentoo.org>
+Signed-off-by: Huang Pei <huangpei@loongson.cn>
+Reviewed-by: Joshua Kinard <kumba@gentoo.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/pgalloc.h | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
+index d0cf997b4ba8..139b4050259f 100644
+--- a/arch/mips/include/asm/pgalloc.h
++++ b/arch/mips/include/asm/pgalloc.h
+@@ -59,15 +59,20 @@ do { \
+
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+- pmd_t *pmd = NULL;
++ pmd_t *pmd;
+ struct page *pg;
+
+- pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER);
+- if (pg) {
+- pgtable_pmd_page_ctor(pg);
+- pmd = (pmd_t *)page_address(pg);
+- pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
++ pg = alloc_pages(GFP_KERNEL_ACCOUNT, PMD_ORDER);
++ if (!pg)
++ return NULL;
++
++ if (!pgtable_pmd_page_ctor(pg)) {
++ __free_pages(pg, PMD_ORDER);
++ return NULL;
+ }
++
++ pmd = (pmd_t *)page_address(pg);
++ pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
+ return pmd;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From cec354cf0269c00d409c4aad64d37c8bd76385bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 10:57:10 +0200
+Subject: mips: Fix non-POSIX regexp
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 28bbbb9875a35975904e46f9b06fa689d051b290 ]
+
+When cross compiling a MIPS kernel on a BSD based HOSTCC leads
+to errors like
+
+ SYNC include/config/auto.conf.cmd - due to: .config
+egrep: empty (sub)expression
+ UPD include/config/kernel.release
+ HOSTCC scripts/dtc/dtc.o - due to target missing
+
+It turns out that egrep uses this egrep pattern:
+
+ (|MINOR_|PATCHLEVEL_)
+
+This is not valid syntax or gives undefined results according
+to POSIX 9.5.3 ERE Grammar
+
+ https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html
+
+It seems to be silently accepted by the Linux egrep implementation
+while a BSD host complains.
+
+Such patterns can be replaced by a transformation like
+
+ "(|p1|p2)" -> "(p1|p2)?"
+
+Fixes: 48c35b2d245f ("[MIPS] There is no __GNUC_MAJOR__")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/Makefile b/arch/mips/Makefile
+index 258234c35a09..674f68d16a73 100644
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -321,7 +321,7 @@ KBUILD_LDFLAGS += -m $(ld-emul)
+
+ ifdef CONFIG_MIPS
+ CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
+- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
++ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
+ sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g')
+ endif
+
+--
+2.30.2
+
--- /dev/null
+From 15a757ab0b1fb8c132bad512728d4ba93bddf60d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 02:17:30 +0300
+Subject: net: bridge: validate the NUD_PERMANENT bit when adding an
+ extern_learn FDB entry
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 0541a6293298fb52789de389dfb27ef54df81f73 ]
+
+Currently it is possible to add broken extern_learn FDB entries to the
+bridge in two ways:
+
+1. Entries pointing towards the bridge device that are not local/permanent:
+
+ip link add br0 type bridge
+bridge fdb add 00:01:02:03:04:05 dev br0 self extern_learn static
+
+2. Entries pointing towards the bridge device or towards a port that
+are marked as local/permanent, however the bridge does not process the
+'permanent' bit in any way, therefore they are recorded as though they
+aren't permanent:
+
+ip link add br0 type bridge
+bridge fdb add 00:01:02:03:04:05 dev br0 self extern_learn permanent
+
+Since commit 52e4bec15546 ("net: bridge: switchdev: treat local FDBs the
+same as entries towards the bridge"), these incorrect FDB entries can
+even trigger NULL pointer dereferences inside the kernel.
+
+This is because that commit made the assumption that all FDB entries
+that are not local/permanent have a valid destination port. For context,
+local / permanent FDB entries either have fdb->dst == NULL, and these
+point towards the bridge device and are therefore local and not to be
+used for forwarding, or have fdb->dst == a net_bridge_port structure
+(but are to be treated in the same way, i.e. not for forwarding).
+
+That assumption _is_ correct as long as things are working correctly in
+the bridge driver, i.e. we cannot logically have fdb->dst == NULL under
+any circumstance for FDB entries that are not local. However, the
+extern_learn code path where FDB entries are managed by a user space
+controller show that it is possible for the bridge kernel driver to
+misinterpret the NUD flags of an entry transmitted by user space, and
+end up having fdb->dst == NULL while not being a local entry. This is
+invalid and should be rejected.
+
+Before, the two commands listed above both crashed the kernel in this
+check from br_switchdev_fdb_notify:
+
+ struct net_device *dev = info.is_local ? br->dev : dst->dev;
+
+info.is_local == false, dst == NULL.
+
+After this patch, the invalid entry added by the first command is
+rejected:
+
+ip link add br0 type bridge && bridge fdb add 00:01:02:03:04:05 dev br0 self extern_learn static; ip link del br0
+Error: bridge: FDB entry towards bridge must be permanent.
+
+and the valid entry added by the second command is properly treated as a
+local address and does not crash br_switchdev_fdb_notify anymore:
+
+ip link add br0 type bridge && bridge fdb add 00:01:02:03:04:05 dev br0 self extern_learn permanent; ip link del br0
+
+Fixes: eb100e0e24a2 ("net: bridge: allow to add externally learned entries from user-space")
+Reported-by: syzbot+9ba1174359adba5a5b7c@syzkaller.appspotmail.com
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Link: https://lore.kernel.org/r/20210801231730.7493-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br.c | 3 ++-
+ net/bridge/br_fdb.c | 30 ++++++++++++++++++++++++------
+ net/bridge/br_private.h | 2 +-
+ 3 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index ef743f94254d..bbab9984f24e 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -166,7 +166,8 @@ static int br_switchdev_event(struct notifier_block *unused,
+ case SWITCHDEV_FDB_ADD_TO_BRIDGE:
+ fdb_info = ptr;
+ err = br_fdb_external_learn_add(br, p, fdb_info->addr,
+- fdb_info->vid, false);
++ fdb_info->vid,
++ fdb_info->is_local, false);
+ if (err) {
+ err = notifier_from_errno(err);
+ break;
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index 698b79747d32..87ce52bba649 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -1001,7 +1001,8 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
+
+ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
+ struct net_bridge_port *p, const unsigned char *addr,
+- u16 nlh_flags, u16 vid, struct nlattr *nfea_tb[])
++ u16 nlh_flags, u16 vid, struct nlattr *nfea_tb[],
++ struct netlink_ext_ack *extack)
+ {
+ int err = 0;
+
+@@ -1020,7 +1021,15 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
+ rcu_read_unlock();
+ local_bh_enable();
+ } else if (ndm->ndm_flags & NTF_EXT_LEARNED) {
+- err = br_fdb_external_learn_add(br, p, addr, vid, true);
++ if (!p && !(ndm->ndm_state & NUD_PERMANENT)) {
++ NL_SET_ERR_MSG_MOD(extack,
++ "FDB entry towards bridge must be permanent");
++ return -EINVAL;
++ }
++
++ err = br_fdb_external_learn_add(br, p, addr, vid,
++ ndm->ndm_state & NUD_PERMANENT,
++ true);
+ } else {
+ spin_lock_bh(&br->hash_lock);
+ err = fdb_add_entry(br, p, addr, ndm, nlh_flags, vid, nfea_tb);
+@@ -1092,9 +1101,11 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
+ }
+
+ /* VID was specified, so use it. */
+- err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid, nfea_tb);
++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid, nfea_tb,
++ extack);
+ } else {
+- err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0, nfea_tb);
++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0, nfea_tb,
++ extack);
+ if (err || !vg || !vg->num_vlans)
+ goto out;
+
+@@ -1106,7 +1117,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
+ if (!br_vlan_should_use(v))
+ continue;
+ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid,
+- nfea_tb);
++ nfea_tb, extack);
+ if (err)
+ goto out;
+ }
+@@ -1246,7 +1257,7 @@ void br_fdb_unsync_static(struct net_bridge *br, struct net_bridge_port *p)
+ }
+
+ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+- const unsigned char *addr, u16 vid,
++ const unsigned char *addr, u16 vid, bool is_local,
+ bool swdev_notify)
+ {
+ struct net_bridge_fdb_entry *fdb;
+@@ -1263,6 +1274,10 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+
+ if (swdev_notify)
+ flags |= BIT(BR_FDB_ADDED_BY_USER);
++
++ if (is_local)
++ flags |= BIT(BR_FDB_LOCAL);
++
+ fdb = fdb_create(br, p, addr, vid, flags);
+ if (!fdb) {
+ err = -ENOMEM;
+@@ -1289,6 +1304,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ if (swdev_notify)
+ set_bit(BR_FDB_ADDED_BY_USER, &fdb->flags);
+
++ if (is_local)
++ set_bit(BR_FDB_LOCAL, &fdb->flags);
++
+ if (modified)
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ }
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index e013d33f1c7c..4e3d26e0a2d1 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -707,7 +707,7 @@ int br_fdb_get(struct sk_buff *skb, struct nlattr *tb[], struct net_device *dev,
+ int br_fdb_sync_static(struct net_bridge *br, struct net_bridge_port *p);
+ void br_fdb_unsync_static(struct net_bridge *br, struct net_bridge_port *p);
+ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+- const unsigned char *addr, u16 vid,
++ const unsigned char *addr, u16 vid, bool is_local,
+ bool swdev_notify);
+ int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
+ const unsigned char *addr, u16 vid,
+--
+2.30.2
+
--- /dev/null
+From ed2e31030c31d51a840171d2ca870556abf7c0a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 08:37:46 +0200
+Subject: net: dsa: qca: ar9331: reorder MDIO write sequence
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit d1a58c013a5837451e3213e7a426d350fa524ead ]
+
+In case of this switch we work with 32bit registers on top of 16bit
+bus. Some registers (for example access to forwarding database) have
+trigger bit on the first 16bit half of request and the result +
+configuration of request in the second half. Without this patch, we would
+trigger database operation and overwrite result in one run.
+
+To make it work properly, we should do the second part of transfer
+before the first one is done.
+
+So far, this rule seems to work for all registers on this switch.
+
+Fixes: ec6698c272de ("net: dsa: add support for Atheros AR9331 built-in switch")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20210803063746.3600-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca/ar9331.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c
+index ca2ad77b71f1..6686192e1883 100644
+--- a/drivers/net/dsa/qca/ar9331.c
++++ b/drivers/net/dsa/qca/ar9331.c
+@@ -837,16 +837,24 @@ static int ar9331_mdio_write(void *ctx, u32 reg, u32 val)
+ return 0;
+ }
+
+- ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg, val);
++ /* In case of this switch we work with 32bit registers on top of 16bit
++ * bus. Some registers (for example access to forwarding database) have
++ * trigger bit on the first 16bit half of request, the result and
++ * configuration of request in the second half.
++ * To make it work properly, we should do the second part of transfer
++ * before the first one is done.
++ */
++ ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg + 2,
++ val >> 16);
+ if (ret < 0)
+ goto error;
+
+- ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg + 2,
+- val >> 16);
++ ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg, val);
+ if (ret < 0)
+ goto error;
+
+ return 0;
++
+ error:
+ dev_err_ratelimited(&sbus->dev, "Bus error. Failed to write register.\n");
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From 00fdad42e37d152848e1722c3f0465aa2b0768f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 20:18:14 +0300
+Subject: net: dsa: sja1105: be stateless with FDB entries on
+ SJA1105P/Q/R/S/SJA1110 too
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 589918df93226a1e5f104306c185b6dcf2bd8051 ]
+
+Similar but not quite the same with what was done in commit b11f0a4c0c81
+("net: dsa: sja1105: be stateless when installing FDB entries") for
+SJA1105E/T, it is desirable to drop the priv->vlan_aware check and
+simply go ahead and install FDB entries in the VLAN that was given by
+the bridge.
+
+As opposed to SJA1105E/T, in SJA1105P/Q/R/S and SJA1110, the FDB is a
+maskable TCAM, and we are installing VLAN-unaware FDB entries with the
+VLAN ID masked off. However, such FDB entries might completely obscure
+VLAN-aware entries where the VLAN ID is included in the search mask,
+because the switch looks up the FDB from left to right and picks the
+first entry which results in a masked match. So it depends on whether
+the bridge installs first the VLAN-unaware or the VLAN-aware FDB entries.
+
+Anyway, if we had a VLAN-unaware FDB entry towards one set of DESTPORTS
+and a VLAN-aware one towards other set of DESTPORTS, the result is that
+the packets in VLAN-aware mode will be forwarded towards the DESTPORTS
+specified by the VLAN-unaware entry.
+
+To solve this, simply do not use the masked matching ability of the FDB
+for VLAN ID, and always match precisely on it. In VLAN-unaware mode, we
+configure the switch for shared VLAN learning, so the VLAN ID will be
+ignored anyway during lookup, so it is redundant to mask it off in the
+TCAM.
+
+This patch conflicts with net-next commit 0fac6aa098ed ("net: dsa: sja1105:
+delete the best_effort_vlan_filtering mode") which changed this line:
+ if (priv->vlan_state != SJA1105_VLAN_UNAWARE) {
+into:
+ if (priv->vlan_aware) {
+
+When merging with net-next, the lines added by this patch should take
+precedence in the conflict resolution (i.e. the "if" condition should be
+deleted in both cases).
+
+Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 18 ++++--------------
+ 1 file changed, 4 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index edc9462c6d4e..19d321ac6532 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1437,13 +1437,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ l2_lookup.vlanid = vid;
+ l2_lookup.iotag = SJA1105_S_TAG;
+ l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
+- if (priv->vlan_state != SJA1105_VLAN_UNAWARE) {
+- l2_lookup.mask_vlanid = VLAN_VID_MASK;
+- l2_lookup.mask_iotag = BIT(0);
+- } else {
+- l2_lookup.mask_vlanid = 0;
+- l2_lookup.mask_iotag = 0;
+- }
++ l2_lookup.mask_vlanid = VLAN_VID_MASK;
++ l2_lookup.mask_iotag = BIT(0);
+ l2_lookup.destports = BIT(port);
+
+ tmp = l2_lookup;
+@@ -1535,13 +1530,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port,
+ l2_lookup.vlanid = vid;
+ l2_lookup.iotag = SJA1105_S_TAG;
+ l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
+- if (priv->vlan_state != SJA1105_VLAN_UNAWARE) {
+- l2_lookup.mask_vlanid = VLAN_VID_MASK;
+- l2_lookup.mask_iotag = BIT(0);
+- } else {
+- l2_lookup.mask_vlanid = 0;
+- l2_lookup.mask_iotag = 0;
+- }
++ l2_lookup.mask_vlanid = VLAN_VID_MASK;
++ l2_lookup.mask_iotag = BIT(0);
+ l2_lookup.destports = BIT(port);
+
+ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
+--
+2.30.2
+
--- /dev/null
+From 30e55a2e8bda646437d956eedc4d888f971a6c24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 20:18:13 +0300
+Subject: net: dsa: sja1105: ignore the FDB entry for unknown multicast when
+ adding a new address
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 728db843df88753aeb7224314807a203afa8eb32 ]
+
+Currently, when sja1105pqrs_fdb_add() is called for a host-joined IPv6
+MDB entry such as 33:33:00:00:00:6a, the search for that address will
+return the FDB entry for SJA1105_UNKNOWN_MULTICAST, which has a
+destination MAC of 01:00:00:00:00:00 and a mask of 01:00:00:00:00:00.
+It returns that entry because, well, it matches, in the sense that
+unknown multicast is supposed by design to match it...
+
+But the issue is that we then proceed to overwrite this entry with the
+one for our precise host-joined multicast address, and the unknown
+multicast entry is no longer there - unknown multicast is now flooded to
+the same group of ports as broadcast, which does not look up the FDB.
+
+To solve this problem, we should ignore searches that return the unknown
+multicast address as the match, and treat them as "no match" which will
+result in the entry being installed to hardware.
+
+For this to work properly, we need to put the result of the FDB search
+in a temporary variable in order to avoid overwriting the l2_lookup
+entry we want to program. The l2_lookup entry returned by the search
+might not have the same set of DESTPORTS and not even the same MACADDR
+as the entry we're trying to add.
+
+Fixes: 4d9423549501 ("net: dsa: sja1105: offload bridge port flags to device")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index 5e88632e10b9..edc9462c6d4e 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1446,14 +1446,19 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ }
+ l2_lookup.destports = BIT(port);
+
++ tmp = l2_lookup;
++
+ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
+- SJA1105_SEARCH, &l2_lookup);
+- if (rc == 0) {
++ SJA1105_SEARCH, &tmp);
++ if (rc == 0 && tmp.index != SJA1105_MAX_L2_LOOKUP_COUNT - 1) {
+ /* Found a static entry and this port is already in the entry's
+ * port mask => job done
+ */
+- if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds)
++ if ((tmp.destports & BIT(port)) && tmp.lockeds)
+ return 0;
++
++ l2_lookup = tmp;
++
+ /* l2_lookup.index is populated by the switch in case it
+ * found something.
+ */
+--
+2.30.2
+
--- /dev/null
+From 8ebb7bd3bb28295383cc76895d0b3a6371bc7791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 20:18:12 +0300
+Subject: net: dsa: sja1105: invalidate dynamic FDB entries learned
+ concurrently with statically added ones
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6c5fc159e0927531707895709eee1f8bfa04289f ]
+
+The procedure to add a static FDB entry in sja1105 is concurrent with
+dynamic learning performed on all bridge ports and the CPU port.
+
+The switch looks up the FDB from left to right, and also learns
+dynamically from left to right, so it is possible that between the
+moment when we pick up a free slot to install an FDB entry, another slot
+to the left of that one becomes free due to an address ageing out, and
+that other slot is then immediately used by the switch to learn
+dynamically the same address as we're trying to add statically.
+
+The result is that we succeeded to add our static FDB entry, but it is
+being shadowed by a dynamic FDB entry to its left, and the switch will
+behave as if our static FDB entry did not exist.
+
+We cannot really prevent this from happening unless we make the entire
+process to add a static FDB entry a huge critical section where address
+learning is temporarily disabled on _all_ ports, and then re-enabled
+according to the configuration done by sja1105_port_set_learning.
+However, that is kind of disruptive for the operation of the network.
+
+What we can do alternatively is to simply read back the FDB for dynamic
+entries located before our newly added static one, and delete them.
+This will guarantee that our static FDB entry is now operational. It
+will still not guarantee that there aren't dynamic FDB entries to the
+_right_ of that static FDB entry, but at least those entries will age
+out by themselves since they aren't hit, and won't bother anyone.
+
+Fixes: 291d1e72b756 ("net: dsa: sja1105: Add support for FDB and MDB management")
+Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 57 +++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index c671d43a4724..5e88632e10b9 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1308,10 +1308,11 @@ static int sja1105et_is_fdb_entry_in_bin(struct sja1105_private *priv, int bin,
+ int sja1105et_fdb_add(struct dsa_switch *ds, int port,
+ const unsigned char *addr, u16 vid)
+ {
+- struct sja1105_l2_lookup_entry l2_lookup = {0};
++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp;
+ struct sja1105_private *priv = ds->priv;
+ struct device *dev = ds->dev;
+ int last_unused = -1;
++ int start, end, i;
+ int bin, way, rc;
+
+ bin = sja1105et_fdb_hash(priv, addr, vid);
+@@ -1363,6 +1364,29 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port,
+ if (rc < 0)
+ return rc;
+
++ /* Invalidate a dynamically learned entry if that exists */
++ start = sja1105et_fdb_index(bin, 0);
++ end = sja1105et_fdb_index(bin, way);
++
++ for (i = start; i < end; i++) {
++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
++ i, &tmp);
++ if (rc == -ENOENT)
++ continue;
++ if (rc)
++ return rc;
++
++ if (tmp.macaddr != ether_addr_to_u64(addr) || tmp.vlanid != vid)
++ continue;
++
++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP,
++ i, NULL, false);
++ if (rc)
++ return rc;
++
++ break;
++ }
++
+ return sja1105_static_fdb_change(priv, port, &l2_lookup, true);
+ }
+
+@@ -1404,7 +1428,7 @@ int sja1105et_fdb_del(struct dsa_switch *ds, int port,
+ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ const unsigned char *addr, u16 vid)
+ {
+- struct sja1105_l2_lookup_entry l2_lookup = {0};
++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp;
+ struct sja1105_private *priv = ds->priv;
+ int rc, i;
+
+@@ -1462,6 +1486,35 @@ skip_finding_an_index:
+ if (rc < 0)
+ return rc;
+
++ /* The switch learns dynamic entries and looks up the FDB left to
++ * right. It is possible that our addition was concurrent with the
++ * dynamic learning of the same address, so now that the static entry
++ * has been installed, we are certain that address learning for this
++ * particular address has been turned off, so the dynamic entry either
++ * is in the FDB at an index smaller than the static one, or isn't (it
++ * can also be at a larger index, but in that case it is inactive
++ * because the static FDB entry will match first, and the dynamic one
++ * will eventually age out). Search for a dynamically learned address
++ * prior to our static one and invalidate it.
++ */
++ tmp = l2_lookup;
++
++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
++ SJA1105_SEARCH, &tmp);
++ if (rc < 0) {
++ dev_err(ds->dev,
++ "port %d failed to read back entry for %pM vid %d: %pe\n",
++ port, addr, vid, ERR_PTR(rc));
++ return rc;
++ }
++
++ if (tmp.index < l2_lookup.index) {
++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP,
++ tmp.index, NULL, false);
++ if (rc < 0)
++ return rc;
++ }
++
+ return sja1105_static_fdb_change(priv, port, &l2_lookup, true);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 3f6b7dc4c8303d9a4adacdc09806afae56fdb0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 20:18:15 +0300
+Subject: net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN
+ tag
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 47c2c0c2312118a478f738503781de1d1a6020d2 ]
+
+On SJA1105P/Q/R/S and SJA1110, the L2 Lookup Table entries contain a
+maskable "inner/outer tag" bit which means:
+- when set to 1: match single-outer and double tagged frames
+- when set to 0: match untagged and single-inner tagged frames
+- when masked off: match all frames regardless of the type of tag
+
+This driver does not make any meaningful distinction between inner tags
+(matches on TPID) and outer tags (matches on TPID2). In fact, all VLAN
+table entries are installed as SJA1110_VLAN_D_TAG, which means that they
+match on both inner and outer tags.
+
+So it does not make sense that we install FDB entries with the IOTAG bit
+set to 1.
+
+In VLAN-unaware mode, we set both TPID and TPID2 to 0xdadb, so the
+switch will see frames as outer-tagged or double-tagged (never inner).
+So the FDB entries will match if IOTAG is set to 1.
+
+In VLAN-aware mode, we set TPID to 0x8100 and TPID2 to 0x88a8. So the
+switch will see untagged and 802.1Q-tagged packets as inner-tagged, and
+802.1ad-tagged packets as outer-tagged. So untagged and 802.1Q-tagged
+packets will not match FDB entries if IOTAG is set to 1, but 802.1ad
+tagged packets will. Strange.
+
+To fix this, simply mask off the IOTAG bit from FDB entries, and make
+them match regardless of whether the VLAN tag is inner or outer.
+
+Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index 19d321ac6532..4b05a2424623 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1435,10 +1435,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ /* Search for an existing entry in the FDB table */
+ l2_lookup.macaddr = ether_addr_to_u64(addr);
+ l2_lookup.vlanid = vid;
+- l2_lookup.iotag = SJA1105_S_TAG;
+ l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
+ l2_lookup.mask_vlanid = VLAN_VID_MASK;
+- l2_lookup.mask_iotag = BIT(0);
+ l2_lookup.destports = BIT(port);
+
+ tmp = l2_lookup;
+@@ -1528,10 +1526,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port,
+
+ l2_lookup.macaddr = ether_addr_to_u64(addr);
+ l2_lookup.vlanid = vid;
+- l2_lookup.iotag = SJA1105_S_TAG;
+ l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0);
+ l2_lookup.mask_vlanid = VLAN_VID_MASK;
+- l2_lookup.mask_iotag = BIT(0);
+ l2_lookup.destports = BIT(port);
+
+ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
+--
+2.30.2
+
--- /dev/null
+From 6e188d60c50f60fd9a59ff18b59b884c54133cdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 20:18:11 +0300
+Subject: net: dsa: sja1105: overwrite dynamic FDB entries with static ones in
+ .port_fdb_add
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit e11e865bf84e3c6ea91563ff3e858cfe0e184bd2 ]
+
+The SJA1105 switch family leaves it up to software to decide where
+within the FDB to install a static entry, and to concatenate destination
+ports for already existing entries (the FDB is also used for multicast
+entries), it is not as simple as just saying "please add this entry".
+
+This means we first need to search for an existing FDB entry before
+adding a new one. The driver currently manages to fool itself into
+thinking that if an FDB entry already exists, there is nothing to be
+done. But that FDB entry might be dynamically learned, case in which it
+should be replaced with a static entry, but instead it is left alone.
+
+This patch checks the LOCKEDS ("locked/static") bit from found FDB
+entries, and lets the code "goto skip_finding_an_index;" if the FDB
+entry was not static. So we also need to move the place where we set
+LOCKEDS = true, to cover the new case where a dynamic FDB entry existed
+but was dynamic.
+
+Fixes: 291d1e72b756 ("net: dsa: sja1105: Add support for FDB and MDB management")
+Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index 5b7947832b87..c671d43a4724 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1323,7 +1323,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port,
+ * mask? If yes, we need to do nothing. If not, we need
+ * to rewrite the entry by adding this port to it.
+ */
+- if (l2_lookup.destports & BIT(port))
++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds)
+ return 0;
+ l2_lookup.destports |= BIT(port);
+ } else {
+@@ -1354,6 +1354,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port,
+ index, NULL, false);
+ }
+ }
++ l2_lookup.lockeds = true;
+ l2_lookup.index = sja1105et_fdb_index(bin, way);
+
+ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP,
+@@ -1424,10 +1425,10 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
+ SJA1105_SEARCH, &l2_lookup);
+ if (rc == 0) {
+- /* Found and this port is already in the entry's
++ /* Found a static entry and this port is already in the entry's
+ * port mask => job done
+ */
+- if (l2_lookup.destports & BIT(port))
++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds)
+ return 0;
+ /* l2_lookup.index is populated by the switch in case it
+ * found something.
+@@ -1450,10 +1451,11 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,
+ dev_err(ds->dev, "FDB is full, cannot add entry.\n");
+ return -EINVAL;
+ }
+- l2_lookup.lockeds = true;
+ l2_lookup.index = i;
+
+ skip_finding_an_index:
++ l2_lookup.lockeds = true;
++
+ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP,
+ l2_lookup.index, &l2_lookup,
+ true);
+--
+2.30.2
+
--- /dev/null
+From 941847845a3e1ce232fdf75121f2808b090ffe20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:14:09 +0300
+Subject: net: ethernet: ti: am65-cpsw: fix crash in
+ am65_cpsw_port_offload_fwd_mark_update()
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit ae03d189bae306e1e00aa631feee090ebda6cf63 ]
+
+The am65_cpsw_port_offload_fwd_mark_update() causes NULL exception crash
+when there is at least one disabled port and any other port added to the
+bridge first time.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000858
+pc : am65_cpsw_port_offload_fwd_mark_update+0x54/0x68
+lr : am65_cpsw_netdevice_event+0x8c/0xf0
+Call trace:
+am65_cpsw_port_offload_fwd_mark_update+0x54/0x68
+notifier_call_chain+0x54/0x98
+raw_notifier_call_chain+0x14/0x20
+call_netdevice_notifiers_info+0x34/0x78
+__netdev_upper_dev_link+0x1c8/0x290
+netdev_master_upper_dev_link+0x1c/0x28
+br_add_if+0x3f0/0x6d0 [bridge]
+
+Fix it by adding proper check for port->ndev != NULL.
+
+Fixes: 2934db9bcb30 ("net: ti: am65-cpsw-nuss: Add netdevice notifiers")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 718539cdd2f2..67a08cbba859 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2060,8 +2060,12 @@ static void am65_cpsw_port_offload_fwd_mark_update(struct am65_cpsw_common *comm
+
+ for (i = 1; i <= common->port_num; i++) {
+ struct am65_cpsw_port *port = am65_common_get_port(common, i);
+- struct am65_cpsw_ndev_priv *priv = am65_ndev_to_priv(port->ndev);
++ struct am65_cpsw_ndev_priv *priv;
+
++ if (!port->ndev)
++ continue;
++
++ priv = am65_ndev_to_priv(port->ndev);
+ priv->offload_fwd_mark = set_val;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From be619862b92a39ff7fb705da652d0c60623084ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 18:51:51 +0300
+Subject: net: fec: fix use-after-free in fec_drv_remove
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ]
+
+Smatch says:
+ drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);
+ drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);
+
+Since fep pointer is netdev private data, accessing it after free_netdev()
+call can cause use-after-free bug. Fix it by moving free_netdev() call at
+the end of the function
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Reviewed-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 8aea707a65a7..7e4c4980ced7 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3843,13 +3843,13 @@ fec_drv_remove(struct platform_device *pdev)
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+- free_netdev(ndev);
+
+ clk_disable_unprepare(fep->clk_ahb);
+ clk_disable_unprepare(fep->clk_ipg);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
++ free_netdev(ndev);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 3325d3a07f3c42b9f13417e8d289096f89355e77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 15:48:20 +0200
+Subject: net, gro: Set inner transport header offset in tcp/udp GRO hook
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit d51c5907e9809a803b276883d203f45849abd4d6 ]
+
+GSO expects inner transport header offset to be valid when
+skb->encapsulation flag is set. GSO uses this value to calculate the length
+of an individual segment of a GSO packet in skb_gso_transport_seglen().
+
+However, tcp/udp gro_complete callbacks don't update the
+skb->inner_transport_header when processing an encapsulated TCP/UDP
+segment. As a result a GRO skb has ->inner_transport_header set to a value
+carried over from earlier skb processing.
+
+This can have mild to tragic consequences. From miscalculating the GSO
+segment length to triggering a page fault [1], when trying to read TCP/UDP
+header at an address past the skb->data page.
+
+The latter scenario leads to an oops report like so:
+
+ BUG: unable to handle page fault for address: ffff9fa7ec00d008
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 123f201067 P4D 123f201067 PUD 123f209067 PMD 0
+ Oops: 0000 [#1] SMP NOPTI
+ CPU: 44 PID: 0 Comm: swapper/44 Not tainted 5.4.53-cloudflare-2020.7.21 #1
+ Hardware name: HYVE EDGE-METAL-GEN10/HS-1811DLite1, BIOS V2.15 02/21/2020
+ RIP: 0010:skb_gso_transport_seglen+0x44/0xa0
+ Code: c0 41 83 e0 11 f6 87 81 00 00 00 20 74 30 0f b7 87 aa 00 00 00 0f [...]
+ RSP: 0018:ffffad8640bacbb8 EFLAGS: 00010202
+ RAX: 000000000000feda RBX: ffff9fcc8d31bc00 RCX: ffff9fa7ec00cffc
+ RDX: ffff9fa7ebffdec0 RSI: 000000000000feda RDI: 0000000000000122
+ RBP: 00000000000005c4 R08: 0000000000000001 R09: 0000000000000000
+ R10: ffff9fe588ae3800 R11: ffff9fe011fc92f0 R12: ffff9fcc8d31bc00
+ R13: ffff9fe0119d4300 R14: 00000000000005c4 R15: ffff9fba57d70900
+ FS: 0000000000000000(0000) GS:ffff9fe68df00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffff9fa7ec00d008 CR3: 0000003e99b1c000 CR4: 0000000000340ee0
+ Call Trace:
+ <IRQ>
+ skb_gso_validate_network_len+0x11/0x70
+ __ip_finish_output+0x109/0x1c0
+ ip_sublist_rcv_finish+0x57/0x70
+ ip_sublist_rcv+0x2aa/0x2d0
+ ? ip_rcv_finish_core.constprop.0+0x390/0x390
+ ip_list_rcv+0x12b/0x14f
+ __netif_receive_skb_list_core+0x2a9/0x2d0
+ netif_receive_skb_list_internal+0x1b5/0x2e0
+ napi_complete_done+0x93/0x140
+ veth_poll+0xc0/0x19f [veth]
+ ? mlx5e_napi_poll+0x221/0x610 [mlx5_core]
+ net_rx_action+0x1f8/0x790
+ __do_softirq+0xe1/0x2bf
+ irq_exit+0x8e/0xc0
+ do_IRQ+0x58/0xe0
+ common_interrupt+0xf/0xf
+ </IRQ>
+
+The bug can be observed in a simple setup where we send IP/GRE/IP/TCP
+packets into a netns over a veth pair. Inside the netns, packets are
+forwarded to dummy device:
+
+ trafgen -> [veth A]--[veth B] -forward-> [dummy]
+
+For veth B to GRO aggregate packets on receive, it needs to have an XDP
+program attached (for example, a trivial XDP_PASS). Additionally, for UDP,
+we need to enable GSO_UDP_L4 feature on the device:
+
+ ip netns exec A ethtool -K AB rx-udp-gro-forwarding on
+
+The last component is an artificial delay to increase the chances of GRO
+batching happening:
+
+ ip netns exec A tc qdisc add dev AB root \
+ netem delay 200us slot 5ms 10ms packets 2 bytes 64k
+
+With such a setup in place, the bug can be observed by tracing the skb
+outer and inner offsets when GSO skb is transmitted from the dummy device:
+
+tcp:
+
+FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPE
+ip_finish_output dumB 2830 270 290 1 294 254 1383 (tcpv4,gre,)
+ ^^^
+udp:
+
+FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPE
+ip_finish_output dumB 2818 270 290 1 294 254 1383 (gre,udp_l4,)
+ ^^^
+
+Fix it by updating the inner transport header offset in tcp/udp
+gro_complete callbacks, similar to how {inet,ipv6}_gro_complete callbacks
+update the inner network header offset, when skb->encapsulation flag is
+set.
+
+[1] https://lore.kernel.org/netdev/CAKxSbF01cLpZem2GFaUaifh0S-5WYViZemTicAg7FCHOnh6kug@mail.gmail.com/
+
+Fixes: bf296b125b21 ("tcp: Add GRO support")
+Fixes: f993bc25e519 ("net: core: handle encapsulation offloads when computing segment lengths")
+Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
+Reported-by: Alex Forster <aforster@cloudflare.com>
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_offload.c | 3 +++
+ net/ipv4/udp_offload.c | 4 ++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
+index e09147ac9a99..fc61cd3fea65 100644
+--- a/net/ipv4/tcp_offload.c
++++ b/net/ipv4/tcp_offload.c
+@@ -298,6 +298,9 @@ int tcp_gro_complete(struct sk_buff *skb)
+ if (th->cwr)
+ skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
+
++ if (skb->encapsulation)
++ skb->inner_transport_header = skb->transport_header;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(tcp_gro_complete);
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 9dde1e5fb449..1380a6b6f4ff 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -624,6 +624,10 @@ static int udp_gro_complete_segment(struct sk_buff *skb)
+
+ skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
+ skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_L4;
++
++ if (skb->encapsulation)
++ skb->inner_transport_header = skb->transport_header;
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 3a9162fcfe876a4b4d873b444a1eeff5ac1eb799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 12:00:16 +0200
+Subject: net: ipv6: fix returned variable type in ip6_skb_dst_mtu
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 4039146777a91e1576da2bf38e0d8a1061a1ae47 ]
+
+The patch fixing the returned value of ip6_skb_dst_mtu (int -> unsigned
+int) was rebased between its initial review and the version applied. In
+the meantime fade56410c22 was applied, which added a new variable (int)
+used as the returned value. This lead to a mismatch between the function
+prototype and the variable used as the return value.
+
+Fixes: 40fc3054b458 ("net: ipv6: fix return value of ip6_skb_dst_mtu")
+Cc: Vadim Fedorenko <vfedorenko@novek.ru>
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip6_route.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 625a38ccb5d9..0bf09a9bca4e 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -265,7 +265,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+
+ static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+- int mtu;
++ unsigned int mtu;
+
+ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+ inet6_sk(skb->sk) : NULL;
+--
+2.30.2
+
--- /dev/null
+From 1909597b736e779317487ad7fb1015beaa2d274b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 14:38:01 +0800
+Subject: net: natsemi: Fix missing pci_disable_device() in probe and remove
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 7fe74dfd41c428afb24e2e615470832fa997ff14 ]
+
+Replace pci_enable_device() with pcim_enable_device(),
+pci_disable_device() and pci_release_regions() will be
+called in release automatically.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/natsemi.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
+index b81e1487945c..14a17ad730f0 100644
+--- a/drivers/net/ethernet/natsemi/natsemi.c
++++ b/drivers/net/ethernet/natsemi/natsemi.c
+@@ -819,7 +819,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ printk(version);
+ #endif
+
+- i = pci_enable_device(pdev);
++ i = pcim_enable_device(pdev);
+ if (i) return i;
+
+ /* natsemi has a non-standard PM control register
+@@ -852,7 +852,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ioaddr = ioremap(iostart, iosize);
+ if (!ioaddr) {
+ i = -ENOMEM;
+- goto err_ioremap;
++ goto err_pci_request_regions;
+ }
+
+ /* Work around the dropped serial bit. */
+@@ -974,9 +974,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_register_netdev:
+ iounmap(ioaddr);
+
+- err_ioremap:
+- pci_release_regions(pdev);
+-
+ err_pci_request_regions:
+ free_netdev(dev);
+ return i;
+@@ -3241,7 +3238,6 @@ static void natsemi_remove1(struct pci_dev *pdev)
+
+ NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround);
+ unregister_netdev (dev);
+- pci_release_regions (pdev);
+ iounmap(ioaddr);
+ free_netdev (dev);
+ }
+--
+2.30.2
+
--- /dev/null
+From d4d741c4f266e37c6eb52ffb69c5b703620455c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 17:30:05 +0300
+Subject: net: pegasus: fix uninit-value in get_interrupt_interval
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit af35fc37354cda3c9c8cc4961b1d24bdc9d27903 ]
+
+Syzbot reported uninit value pegasus_probe(). The problem was in missing
+error handling.
+
+get_interrupt_interval() internally calls read_eprom_word() which can
+fail in some cases. For example: failed to receive usb control message.
+These cases should be handled to prevent uninit value bug, since
+read_eprom_word() will not initialize passed stack variable in case of
+internal failure.
+
+Fail log:
+
+BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
+BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
+CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0
+...
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ __dump_stack lib/dump_stack.c:79 [inline]
+ dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
+ kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
+ __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
+ get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
+ pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
+....
+
+Local variable ----data.i@pegasus_probe created at:
+ get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
+ pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
+ get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
+ pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
+
+Reported-and-tested-by: syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/20210804143005.439-1-paskripkin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 9a907182569c..bc2dbf86496b 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -735,12 +735,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus)
+ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
+ }
+
+-static inline void get_interrupt_interval(pegasus_t *pegasus)
++static inline int get_interrupt_interval(pegasus_t *pegasus)
+ {
+ u16 data;
+ u8 interval;
++ int ret;
++
++ ret = read_eprom_word(pegasus, 4, &data);
++ if (ret < 0)
++ return ret;
+
+- read_eprom_word(pegasus, 4, &data);
+ interval = data >> 8;
+ if (pegasus->usb->speed != USB_SPEED_HIGH) {
+ if (interval < 0x80) {
+@@ -755,6 +759,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus)
+ }
+ }
+ pegasus->intr_interval = interval;
++
++ return 0;
+ }
+
+ static void set_carrier(struct net_device *net)
+@@ -1149,7 +1155,9 @@ static int pegasus_probe(struct usb_interface *intf,
+ | NETIF_MSG_PROBE | NETIF_MSG_LINK);
+
+ pegasus->features = usb_dev_id[dev_index].private;
+- get_interrupt_interval(pegasus);
++ res = get_interrupt_interval(pegasus);
++ if (res)
++ goto out2;
+ if (reset_mac(pegasus)) {
+ dev_err(&intf->dev, "can't reset MAC\n");
+ res = -EIO;
+--
+2.30.2
+
--- /dev/null
+From 1cb06bbd609cf00574bc735a8a7ab564329e2f44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 08:57:50 +1000
+Subject: net: phy: micrel: Fix detection of ksz87xx switch
+
+From: Steve Bennett <steveb@workware.net.au>
+
+[ Upstream commit a5e63c7d38d548b8dab6c6205e0b6af76899dbf5 ]
+
+The logic for discerning between KSZ8051 and KSZ87XX PHYs is incorrect
+such that the that KSZ87XX switch is not identified correctly.
+
+ksz8051_ksz8795_match_phy_device() uses the parameter ksz_phy_id
+to discriminate whether it was called from ksz8051_match_phy_device()
+or from ksz8795_match_phy_device() but since PHY_ID_KSZ87XX is the
+same value as PHY_ID_KSZ8051, this doesn't work.
+
+Instead use a bool to discriminate the caller.
+
+Without this patch, the KSZ8795 switch port identifies as:
+
+ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Generic PHY]
+
+With the patch, it identifies correctly:
+
+ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Micrel KSZ87XX Switch]
+
+Fixes: 8b95599c55ed24b36cf4 ("net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs")
+Signed-off-by: Steve Bennett <steveb@workware.net.au>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index a14a00328fa3..7afd9edaf249 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -382,11 +382,11 @@ static int ksz8041_config_aneg(struct phy_device *phydev)
+ }
+
+ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,
+- const u32 ksz_phy_id)
++ const bool ksz_8051)
+ {
+ int ret;
+
+- if ((phydev->phy_id & MICREL_PHY_ID_MASK) != ksz_phy_id)
++ if ((phydev->phy_id & MICREL_PHY_ID_MASK) != PHY_ID_KSZ8051)
+ return 0;
+
+ ret = phy_read(phydev, MII_BMSR);
+@@ -399,7 +399,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,
+ * the switch does not.
+ */
+ ret &= BMSR_ERCAP;
+- if (ksz_phy_id == PHY_ID_KSZ8051)
++ if (ksz_8051)
+ return ret;
+ else
+ return !ret;
+@@ -407,7 +407,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,
+
+ static int ksz8051_match_phy_device(struct phy_device *phydev)
+ {
+- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ8051);
++ return ksz8051_ksz8795_match_phy_device(phydev, true);
+ }
+
+ static int ksz8081_config_init(struct phy_device *phydev)
+@@ -435,7 +435,7 @@ static int ksz8061_config_init(struct phy_device *phydev)
+
+ static int ksz8795_match_phy_device(struct phy_device *phydev)
+ {
+- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ87XX);
++ return ksz8051_ksz8795_match_phy_device(phydev, false);
+ }
+
+ static int ksz9021_load_values_from_of(struct phy_device *phydev,
+--
+2.30.2
+
--- /dev/null
+From 489ce0e99ad07e15aceff6c745a36e2bbe97f829 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 18:58:21 +0800
+Subject: net: sched: fix lockdep_set_class() typo error for sch->seqlock
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 06f5553e0f0c2182268179b93856187d9cb86dd5 ]
+
+According to comment in qdisc_alloc(), sch->seqlock's lockdep
+class key should be set to qdisc_tx_busylock, due to possible
+type error, sch->busylock's lockdep class key is set to
+qdisc_tx_busylock, which is duplicated because sch->busylock's
+lockdep class key is already set in qdisc_alloc().
+
+So fix it by replacing sch->busylock with sch->seqlock.
+
+Fixes: 96009c7d500e ("sched: replace __QDISC_STATE_RUNNING bit with a spin lock")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index fc8b56bcabf3..1ee96a5c5ee0 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -886,7 +886,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
+
+ /* seqlock has the same scope of busylock, for NOLOCK qdisc */
+ spin_lock_init(&sch->seqlock);
+- lockdep_set_class(&sch->busylock,
++ lockdep_set_class(&sch->seqlock,
+ dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
+
+ seqcount_init(&sch->running);
+--
+2.30.2
+
--- /dev/null
+From d8e6a02cec18e8373a8057cc133c4fca4883fe13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 18:52:20 +0300
+Subject: net: vxge: fix use-after-free in vxge_device_unregister
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 942e560a3d3862dd5dee1411dbdd7097d29b8416 ]
+
+Smatch says:
+drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
+drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
+drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
+drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
+
+Since vdev pointer is netdev private data accessing it after free_netdev()
+call can cause use-after-free bug. Fix it by moving free_netdev() call at
+the end of the function
+
+Fixes: 6cca200362b4 ("vxge: cleanup probe error paths")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/neterion/vxge/vxge-main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
+index 87892bd992b1..56556373548c 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
+@@ -3527,13 +3527,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev)
+
+ kfree(vdev->vpaths);
+
+- /* we are safe to free it now */
+- free_netdev(dev);
+-
+ vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered",
+ buf);
+ vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf,
+ __func__, __LINE__);
++
++ /* we are safe to free it now */
++ free_netdev(dev);
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 7379273641bb53588e6a195e01152f6f67c66d84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 13:23:54 +0300
+Subject: net: xfrm: fix memory leak in xfrm_user_rcv_msg
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 7c1a80e80cde008f271bae630d28cf684351e807 ]
+
+Syzbot reported memory leak in xfrm_user_rcv_msg(). The
+problem was is non-freed skb's frag_list.
+
+In skb_release_all() skb_release_data() will be called only
+in case of skb->head != NULL, but netlink_skb_destructor()
+sets head to NULL. So, allocated frag_list skb should be
+freed manualy, since consume_skb() won't take care of it
+
+Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
+Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index b47d613409b7..7aff641c717d 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2811,6 +2811,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+
+ err = link->doit(skb, nlh, attrs);
+
++ /* We need to free skb allocated in xfrm_alloc_compat() before
++ * returning from this function, because consume_skb() won't take
++ * care of frag_list since netlink destructor sets
++ * sbk->head to NULL. (see netlink_skb_destructor())
++ */
++ if (skb_has_frag_list(skb)) {
++ kfree_skb(skb_shinfo(skb)->frag_list);
++ skb_shinfo(skb)->frag_list = NULL;
++ }
++
+ err:
+ kvfree(nlh64);
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 828c906da84d4299bbcfd2f77befee8e3e5bd1bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 12:39:11 +0200
+Subject: nfp: update ethtool reporting of pauseframe control
+
+From: Fei Qin <fei.qin@corigine.com>
+
+[ Upstream commit 9fdc5d85a8fe684cdf24dc31c6bc4a727decfe87 ]
+
+Pauseframe control is set to symmetric mode by default on the NFP.
+Pause frames can not be configured through ethtool now, but ethtool can
+report the supported mode.
+
+Fixes: 265aeb511bd5 ("nfp: add support for .get_link_ksettings()")
+Signed-off-by: Fei Qin <fei.qin@corigine.com>
+Signed-off-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index 1b482446536d..8803faadd302 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -286,6 +286,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev,
+
+ /* Init to unknowns */
+ ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+ cmd->base.port = PORT_OTHER;
+ cmd->base.speed = SPEED_UNKNOWN;
+ cmd->base.duplex = DUPLEX_UNKNOWN;
+--
+2.30.2
+
--- /dev/null
+From b0d0f0bbbad9766d10237dd46b3609949fe97fc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 16:00:22 +0200
+Subject: omap5-board-common: remove not physically existing vdds_1v8_main
+ fixed-regulator
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit c68ef4ad180e09805fa46965d15e1dfadf09ffa5 ]
+
+This device tree include file describes a fixed-regulator
+connecting smps7_reg output (1.8V) to some 1.8V rail and
+consumers (vdds_1v8_main).
+
+This regulator does not physically exist.
+
+I assume it was introduced as a wrapper around smps7_reg
+to provide a speaking signal name "vdds_1v8_main" as label.
+
+This fixed-regulator without real function was not an issue
+in driver code until
+
+ Commit 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators")
+
+introduced a new check for regulator initialization which
+makes Palmas regulator registration fail:
+
+[ 5.407712] ldo1: supplied by vsys_cobra
+[ 5.412748] ldo2: supplied by vsys_cobra
+[ 5.417603] palmas-pmic 48070000.i2c:palmas@48:palmas_pmic: failed to register 48070000.i2c:palmas@48:palmas_pmic regulator
+
+The reason is that the supply-chain of regulators is too
+long and goes from ldo3 through the virtual vdds_1v8_main
+regulator and then back to smps7. This adds a cross-dependency
+of probing Palmas regulators and the fixed-regulator which
+leads to probe deferral by the new check and is no longer
+resolved.
+
+Since we do not control what device tree files including this
+one reference (either &vdds_1v8_main or &smps7_reg or both)
+we keep both labels for smps7 for compatibility.
+
+Fixes: 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap5-board-common.dtsi | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index d8f13626cfd1..3a8f10231475 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -30,14 +30,6 @@
+ regulator-max-microvolt = <5000000>;
+ };
+
+- vdds_1v8_main: fixedregulator-vdds_1v8_main {
+- compatible = "regulator-fixed";
+- regulator-name = "vdds_1v8_main";
+- vin-supply = <&smps7_reg>;
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- };
+-
+ vmmcsd_fixed: fixedregulator-mmcsd {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmcsd_fixed";
+@@ -487,6 +479,7 @@
+ regulator-boot-on;
+ };
+
++ vdds_1v8_main:
+ smps7_reg: smps7 {
+ /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */
+ regulator-name = "smps7";
+--
+2.30.2
+
--- /dev/null
+From 93d86ead4ee0028d43aea274605003f24fd76cbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 14:56:14 +0800
+Subject: RDMA/hns: Fix the double unlock problem of poll_sem
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+[ Upstream commit 8b436a99cd708bd158231a0630ffa49b1d6175e4 ]
+
+If hns_roce_cmd_use_events() fails then it means that the poll_sem is not
+obtained, but the poll_sem is released in hns_roce_cmd_use_polling(), this
+will cause an unlock problem.
+
+This is the static checker warning:
+ drivers/infiniband/hw/hns/hns_roce_main.c:926 hns_roce_init()
+ error: double unlocked '&hr_dev->cmd.poll_sem' (orig line 879)
+
+Event mode and polling mode are mutually exclusive and resources are
+separated, so there is no need to process polling mode resources in event
+mode.
+
+The initial mode of cmd is polling mode, so even if cmd fails to switch to
+event mode, it is not necessary to switch to polling mode.
+
+Fixes: a389d016c030 ("RDMA/hns: Enable all CMDQ context")
+Fixes: 3d50503b3b33 ("RDMA/hns: Optimize cmd init and mode selection for hip08")
+Link: https://lore.kernel.org/r/1627887374-20019-1-git-send-email-liangwenpeng@huawei.com
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_cmd.c | 7 +++----
+ drivers/infiniband/hw/hns/hns_roce_main.c | 4 +---
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_cmd.c b/drivers/infiniband/hw/hns/hns_roce_cmd.c
+index 8f68cc3ff193..84f3f2b5f097 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_cmd.c
++++ b/drivers/infiniband/hw/hns/hns_roce_cmd.c
+@@ -213,8 +213,10 @@ int hns_roce_cmd_use_events(struct hns_roce_dev *hr_dev)
+
+ hr_cmd->context =
+ kcalloc(hr_cmd->max_cmds, sizeof(*hr_cmd->context), GFP_KERNEL);
+- if (!hr_cmd->context)
++ if (!hr_cmd->context) {
++ hr_dev->cmd_mod = 0;
+ return -ENOMEM;
++ }
+
+ for (i = 0; i < hr_cmd->max_cmds; ++i) {
+ hr_cmd->context[i].token = i;
+@@ -228,7 +230,6 @@ int hns_roce_cmd_use_events(struct hns_roce_dev *hr_dev)
+ spin_lock_init(&hr_cmd->context_lock);
+
+ hr_cmd->use_events = 1;
+- down(&hr_cmd->poll_sem);
+
+ return 0;
+ }
+@@ -239,8 +240,6 @@ void hns_roce_cmd_use_polling(struct hns_roce_dev *hr_dev)
+
+ kfree(hr_cmd->context);
+ hr_cmd->use_events = 0;
+-
+- up(&hr_cmd->poll_sem);
+ }
+
+ struct hns_roce_cmd_mailbox *
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index 6c6e82b11d8b..33b84f219d0d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -897,11 +897,9 @@ int hns_roce_init(struct hns_roce_dev *hr_dev)
+
+ if (hr_dev->cmd_mod) {
+ ret = hns_roce_cmd_use_events(hr_dev);
+- if (ret) {
++ if (ret)
+ dev_warn(dev,
+ "Cmd event mode failed, set back to poll!\n");
+- hns_roce_cmd_use_polling(hr_dev);
+- }
+ }
+
+ ret = hns_roce_init_hem(hr_dev);
+--
+2.30.2
+
--- /dev/null
+From 726fce9f8850e92e6f26c75e25f0a73e28cb42e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 10:16:06 +0300
+Subject: RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it
+ recently
+
+From: Aharon Landau <aharonl@nvidia.com>
+
+[ Upstream commit d6793ca97b76642b77629dd0783ec64782a50bdb ]
+
+Fixing a typo that causes a cache entry to shrink immediately after adding
+to it new MRs if the entry size exceeds the high limit. In doing so, the
+cache misses its purpose to prevent the creation of new mkeys on the
+runtime by using the cached ones.
+
+Fixes: b9358bdbc713 ("RDMA/mlx5: Fix locking in MR cache work queue")
+Link: https://lore.kernel.org/r/fcb546986be346684a016f5ca23a0567399145fa.1627370131.git.leonro@nvidia.com
+Signed-off-by: Aharon Landau <aharonl@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 425423dfac72..fd113ddf6e86 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -530,8 +530,8 @@ static void __cache_work_func(struct mlx5_cache_ent *ent)
+ */
+ spin_unlock_irq(&ent->lock);
+ need_delay = need_resched() || someone_adding(cache) ||
+- time_after(jiffies,
+- READ_ONCE(cache->last_add) + 300 * HZ);
++ !time_after(jiffies,
++ READ_ONCE(cache->last_add) + 300 * HZ);
+ spin_lock_irq(&ent->lock);
+ if (ent->disabled)
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From 193d39a0fb834fb0d2359dd6a78e4369b9fc3c4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 23:09:55 +0200
+Subject: Revert "soc: imx8m: change to use platform driver"
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit ac34de14ac30ba4484d68f8845a54b6b6c23db42 ]
+
+With the SoC matching changed to a platform driver the match data
+is available only after other drivers, which may rely on it are
+already probed. This breaks at least the CAAM driver on i.MX8M.
+Revert the change until all those drivers have been audited and
+changed to be able to eal with match data being available later
+in the boot process.
+
+Fixes: 7d981405d0fd ("soc: imx8m: change to use platform driver")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Acked-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 84 ++++++-------------------------------
+ 1 file changed, 12 insertions(+), 72 deletions(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 071e14496e4b..cc57a384d74d 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -5,8 +5,6 @@
+
+ #include <linux/init.h>
+ #include <linux/io.h>
+-#include <linux/module.h>
+-#include <linux/nvmem-consumer.h>
+ #include <linux/of_address.h>
+ #include <linux/slab.h>
+ #include <linux/sys_soc.h>
+@@ -31,7 +29,7 @@
+
+ struct imx8_soc_data {
+ char *name;
+- u32 (*soc_revision)(struct device *dev);
++ u32 (*soc_revision)(void);
+ };
+
+ static u64 soc_uid;
+@@ -52,7 +50,7 @@ static u32 imx8mq_soc_revision_from_atf(void)
+ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; };
+ #endif
+
+-static u32 __init imx8mq_soc_revision(struct device *dev)
++static u32 __init imx8mq_soc_revision(void)
+ {
+ struct device_node *np;
+ void __iomem *ocotp_base;
+@@ -77,20 +75,9 @@ static u32 __init imx8mq_soc_revision(struct device *dev)
+ rev = REV_B1;
+ }
+
+- if (dev) {
+- int ret;
+-
+- ret = nvmem_cell_read_u64(dev, "soc_unique_id", &soc_uid);
+- if (ret) {
+- iounmap(ocotp_base);
+- of_node_put(np);
+- return ret;
+- }
+- } else {
+- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH);
+- soc_uid <<= 32;
+- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
+- }
++ soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH);
++ soc_uid <<= 32;
++ soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
+
+ iounmap(ocotp_base);
+ of_node_put(np);
+@@ -120,7 +107,7 @@ static void __init imx8mm_soc_uid(void)
+ of_node_put(np);
+ }
+
+-static u32 __init imx8mm_soc_revision(struct device *dev)
++static u32 __init imx8mm_soc_revision(void)
+ {
+ struct device_node *np;
+ void __iomem *anatop_base;
+@@ -138,15 +125,7 @@ static u32 __init imx8mm_soc_revision(struct device *dev)
+ iounmap(anatop_base);
+ of_node_put(np);
+
+- if (dev) {
+- int ret;
+-
+- ret = nvmem_cell_read_u64(dev, "soc_unique_id", &soc_uid);
+- if (ret)
+- return ret;
+- } else {
+- imx8mm_soc_uid();
+- }
++ imx8mm_soc_uid();
+
+ return rev;
+ }
+@@ -171,7 +150,7 @@ static const struct imx8_soc_data imx8mp_soc_data = {
+ .soc_revision = imx8mm_soc_revision,
+ };
+
+-static __maybe_unused const struct of_device_id imx8_machine_match[] = {
++static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+ { .compatible = "fsl,imx8mq", .data = &imx8mq_soc_data, },
+ { .compatible = "fsl,imx8mm", .data = &imx8mm_soc_data, },
+ { .compatible = "fsl,imx8mn", .data = &imx8mn_soc_data, },
+@@ -179,20 +158,12 @@ static __maybe_unused const struct of_device_id imx8_machine_match[] = {
+ { }
+ };
+
+-static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+- { .compatible = "fsl,imx8mq-soc", .data = &imx8mq_soc_data, },
+- { .compatible = "fsl,imx8mm-soc", .data = &imx8mm_soc_data, },
+- { .compatible = "fsl,imx8mn-soc", .data = &imx8mn_soc_data, },
+- { .compatible = "fsl,imx8mp-soc", .data = &imx8mp_soc_data, },
+- { }
+-};
+-
+ #define imx8_revision(soc_rev) \
+ soc_rev ? \
+ kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \
+ "unknown"
+
+-static int imx8_soc_info(struct platform_device *pdev)
++static int __init imx8_soc_init(void)
+ {
+ struct soc_device_attribute *soc_dev_attr;
+ struct soc_device *soc_dev;
+@@ -211,10 +182,7 @@ static int imx8_soc_info(struct platform_device *pdev)
+ if (ret)
+ goto free_soc;
+
+- if (pdev)
+- id = of_match_node(imx8_soc_match, pdev->dev.of_node);
+- else
+- id = of_match_node(imx8_machine_match, of_root);
++ id = of_match_node(imx8_soc_match, of_root);
+ if (!id) {
+ ret = -ENODEV;
+ goto free_soc;
+@@ -223,16 +191,8 @@ static int imx8_soc_info(struct platform_device *pdev)
+ data = id->data;
+ if (data) {
+ soc_dev_attr->soc_id = data->name;
+- if (data->soc_revision) {
+- if (pdev) {
+- soc_rev = data->soc_revision(&pdev->dev);
+- ret = soc_rev;
+- if (ret < 0)
+- goto free_soc;
+- } else {
+- soc_rev = data->soc_revision(NULL);
+- }
+- }
++ if (data->soc_revision)
++ soc_rev = data->soc_revision();
+ }
+
+ soc_dev_attr->revision = imx8_revision(soc_rev);
+@@ -270,24 +230,4 @@ free_soc:
+ kfree(soc_dev_attr);
+ return ret;
+ }
+-
+-/* Retain device_initcall is for backward compatibility with DTS. */
+-static int __init imx8_soc_init(void)
+-{
+- if (of_find_matching_node_and_match(NULL, imx8_soc_match, NULL))
+- return 0;
+-
+- return imx8_soc_info(NULL);
+-}
+ device_initcall(imx8_soc_init);
+-
+-static struct platform_driver imx8_soc_info_driver = {
+- .probe = imx8_soc_info,
+- .driver = {
+- .name = "imx8_soc_info",
+- .of_match_table = imx8_soc_match,
+- },
+-};
+-
+-module_platform_driver(imx8_soc_info_driver);
+-MODULE_LICENSE("GPL v2");
+--
+2.30.2
+
--- /dev/null
+From 4516080c65e13c61cddeab0c21cba83cea227eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 09:26:21 -0700
+Subject: riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is
+ enabled
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit a18b14d8886614b3c7d290c4cfc33389822b0535 ]
+
+riscv uses the value of TSK_STACK_CANARY to set
+stack-protector-guard-offset. With GCC_PLUGIN_RANDSTRUCT enabled, that
+value is non-deterministic, and with riscv:allmodconfig often results
+in build errors such as
+
+cc1: error: '8120' is not a valid offset in '-mstack-protector-guard-offset='
+
+Enable STACKPROTECTOR_PER_TASK only if GCC_PLUGIN_RANDSTRUCT is disabled
+to fix the problem.
+
+Fixes: fea2fed201ee5 ("riscv: Enable per-task stack canaries")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index 18ec0f9bb8d5..3c3647ac33cb 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -489,6 +489,7 @@ config CC_HAVE_STACKPROTECTOR_TLS
+
+ config STACKPROTECTOR_PER_TASK
+ def_bool y
++ depends on !GCC_PLUGIN_RANDSTRUCT
+ depends on STACKPROTECTOR && CC_HAVE_STACKPROTECTOR_TLS
+
+ config PHYS_RAM_BASE_FIXED
+--
+2.30.2
+
--- /dev/null
+From dbbaedad3b9e6b547ba670231b49a6e512d17e6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 21:40:51 +0800
+Subject: riscv: stacktrace: Fix NULL pointer dereference
+
+From: Jisheng Zhang <jszhang@kernel.org>
+
+[ Upstream commit 78d9d8005e4556448f398d876f29d0ca7ab8e398 ]
+
+When CONFIG_FRAME_POINTER=y, calling dump_stack() can always trigger
+NULL pointer dereference panic similar as below:
+
+[ 0.396060] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5+ #47
+[ 0.396692] Hardware name: riscv-virtio,qemu (DT)
+[ 0.397176] Call Trace:
+[ 0.398191] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000960
+[ 0.399487] Oops [#1]
+[ 0.399739] Modules linked in:
+[ 0.400135] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5+ #47
+[ 0.400570] Hardware name: riscv-virtio,qemu (DT)
+[ 0.400926] epc : walk_stackframe+0xc4/0xdc
+[ 0.401291] ra : dump_backtrace+0x30/0x38
+[ 0.401630] epc : ffffffff80004922 ra : ffffffff8000496a sp : ffffffe000f3bd00
+[ 0.402115] gp : ffffffff80cfdcb8 tp : ffffffe000f30000 t0 : ffffffff80d0b0cf
+[ 0.402602] t1 : ffffffff80d0b0c0 t2 : 0000000000000000 s0 : ffffffe000f3bd60
+[ 0.403071] s1 : ffffffff808bc2e8 a0 : 0000000000001000 a1 : 0000000000000000
+[ 0.403448] a2 : ffffffff803d7088 a3 : ffffffff808bc2e8 a4 : 6131725dbc24d400
+[ 0.403820] a5 : 0000000000001000 a6 : 0000000000000002 a7 : ffffffffffffffff
+[ 0.404226] s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000
+[ 0.404634] s5 : ffffffff803d7088 s6 : ffffffff808bc2e8 s7 : ffffffff80630650
+[ 0.405085] s8 : ffffffff80912a80 s9 : 0000000000000008 s10: ffffffff804000fc
+[ 0.405388] s11: 0000000000000000 t3 : 0000000000000043 t4 : ffffffffffffffff
+[ 0.405616] t5 : 000000000000003d t6 : ffffffe000f3baa8
+[ 0.405793] status: 0000000000000100 badaddr: 0000000000000960 cause: 000000000000000d
+[ 0.406135] [<ffffffff80004922>] walk_stackframe+0xc4/0xdc
+[ 0.407032] [<ffffffff8000496a>] dump_backtrace+0x30/0x38
+[ 0.407797] [<ffffffff803d7100>] show_stack+0x40/0x4c
+[ 0.408234] [<ffffffff803d9e5c>] dump_stack+0x90/0xb6
+[ 0.409019] [<ffffffff8040423e>] ptdump_init+0x20/0xc4
+[ 0.409681] [<ffffffff800015b6>] do_one_initcall+0x4c/0x226
+[ 0.410110] [<ffffffff80401094>] kernel_init_freeable+0x1f4/0x258
+[ 0.410562] [<ffffffff803dba88>] kernel_init+0x22/0x148
+[ 0.410959] [<ffffffff800029e2>] ret_from_exception+0x0/0x14
+[ 0.412241] ---[ end trace b2ab92c901b96251 ]---
+[ 0.413099] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
+
+The reason is the task is NULL when we finally call walk_stackframe()
+the NULL is passed from __dump_stack():
+
+|static void __dump_stack(void)
+|{
+| dump_stack_print_info(KERN_DEFAULT);
+| show_stack(NULL, NULL, KERN_DEFAULT);
+|}
+
+Fix this issue by checking "task == NULL" case in walk_stackframe().
+
+Fixes: eac2f3059e02 ("riscv: stacktrace: fix the riscv stacktrace when CONFIG_FRAME_POINTER enabled")
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Reviewed-by: Atish Patra <atish.patra@wdc.com>
+Tested-by: Wende Tan <twd2.me@gmail.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/stacktrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index bde85fc53357..7bc8af75933a 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -27,7 +27,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ fp = frame_pointer(regs);
+ sp = user_stack_pointer(regs);
+ pc = instruction_pointer(regs);
+- } else if (task == current) {
++ } else if (task == NULL || task == current) {
+ fp = (unsigned long)__builtin_frame_address(1);
+ sp = (unsigned long)__builtin_frame_address(0);
+ pc = (unsigned long)__builtin_return_address(0);
+--
+2.30.2
+
--- /dev/null
+From 3565a230738d3c8ace8ec4ca17779b928c2f981f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 19:49:13 +0800
+Subject: scsi: sr: Return correct event when media event code is 3
+
+From: Li Manyi <limanyi@uniontech.com>
+
+[ Upstream commit 5c04243a56a7977185b00400e59ca7e108004faf ]
+
+Media event code 3 is defined in the MMC-6 spec as follows:
+
+ "MediaRemoval: The media has been removed from the specified slot, and
+ the Drive is unable to access the media without user intervention. This
+ applies to media changers only."
+
+This indicated that treating the condition as an EJECT_REQUEST was
+appropriate. However, doing so had the unfortunate side-effect of causing
+the drive tray to be physically ejected on resume. Instead treat the event
+as a MEDIA_CHANGE request.
+
+Fixes: 7dd753ca59d6 ("scsi: sr: Return appropriate error code when disk is ejected")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=213759
+Link: https://lore.kernel.org/r/20210726114913.6760-1-limanyi@uniontech.com
+Signed-off-by: Li Manyi <limanyi@uniontech.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 1a94c7b1de2d..261d3663cbb7 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -221,7 +221,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
+ else if (med->media_event_code == 2)
+ return DISK_EVENT_MEDIA_CHANGE;
+ else if (med->media_event_code == 3)
+- return DISK_EVENT_EJECT_REQUEST;
++ return DISK_EVENT_MEDIA_CHANGE;
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c902e13fe8231f1df3abf30e82f3de6325b52445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Aug 2021 02:25:31 -0400
+Subject: sctp: move the active_key update after sh_keys is added
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit ae954bbc451d267f7d60d7b49db811d5a68ebd7b ]
+
+In commit 58acd1009226 ("sctp: update active_key for asoc when old key is
+being replaced"), sctp_auth_asoc_init_active_key() is called to update
+the active_key right after the old key is deleted and before the new key
+is added, and it caused that the active_key could be found with the key_id.
+
+In Ying Xu's testing, the BUG_ON in sctp_auth_asoc_init_active_key() was
+triggered:
+
+ [ ] kernel BUG at net/sctp/auth.c:416!
+ [ ] RIP: 0010:sctp_auth_asoc_init_active_key.part.8+0xe7/0xf0 [sctp]
+ [ ] Call Trace:
+ [ ] sctp_auth_set_key+0x16d/0x1b0 [sctp]
+ [ ] sctp_setsockopt.part.33+0x1ba9/0x2bd0 [sctp]
+ [ ] __sys_setsockopt+0xd6/0x1d0
+ [ ] __x64_sys_setsockopt+0x20/0x30
+ [ ] do_syscall_64+0x5b/0x1a0
+
+So fix it by moving the active_key update after sh_keys is added.
+
+Fixes: 58acd1009226 ("sctp: update active_key for asoc when old key is being replaced")
+Reported-by: Ying Xu <yinxu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/auth.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index fe74c5f95630..db6b7373d16c 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -857,14 +857,18 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength);
+ cur_key->key = key;
+
+- if (replace) {
+- list_del_init(&shkey->key_list);
+- sctp_auth_shkey_release(shkey);
+- if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
+- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++ if (!replace) {
++ list_add(&cur_key->key_list, sh_keys);
++ return 0;
+ }
++
++ list_del_init(&shkey->key_list);
++ sctp_auth_shkey_release(shkey);
+ list_add(&cur_key->key_list, sh_keys);
+
++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch
+net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch
+arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch
+dmaengine-idxd-fix-array-index-when-int_handles-are-.patch
+dmaengine-idxd-fix-setup-sequence-for-msixperm-table.patch
+arm-imx-add-missing-iounmap.patch
+arm-imx-add-missing-clk_disable_unprepare.patch
+arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch
+revert-soc-imx8m-change-to-use-platform-driver.patch
+dmaengine-idxd-fix-desc-vector-that-isn-t-being-upda.patch
+dmaengine-idxd-fix-sequence-for-pci-driver-remove-an.patch
+dmaengine-idxd-fix-submission-race-window.patch
+arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch
+arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch
+arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch
+arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch
+arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch
+ext4-fix-potential-uninitialized-access-to-retval-in.patch
+arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch
+alsa-usb-audio-fix-incorrect-clock-source-setting.patch
+riscv-stacktrace-fix-null-pointer-dereference.patch
+clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch
+arm-dts-am437x-l4-fix-typo-in-can-0-node.patch
+omap5-board-common-remove-not-physically-existing-vd.patch
+dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch
+clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch
+dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch
+dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch
+spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch
+spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch
+drm-kmb-enable-lcd-dma-for-low-tvddcv.patch
+scsi-sr-return-correct-event-when-media-event-code-i.patch
+media-videobuf2-core-dequeue-if-start_streaming-fail.patch
+arm-dts-stm32-prefer-hw-rtc-on-dhcom-som.patch
+arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch
+arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch
+dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch
+net-gro-set-inner-transport-header-offset-in-tcp-udp.patch
+net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch
+net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch
+net-dsa-sja1105-ignore-the-fdb-entry-for-unknown-mul.patch
+net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch
+net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch
+net-phy-micrel-fix-detection-of-ksz87xx-switch.patch
+net-natsemi-fix-missing-pci_disable_device-in-probe-.patch
+gpio-tqmx86-really-make-irq-optional.patch
+rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch
+net-bridge-validate-the-nud_permanent-bit-when-addin.patch
+sctp-move-the-active_key-update-after-sh_keys-is-add.patch
+drm-i915-call-i915_globals_exit-if-pci_register_devi.patch
+nfp-update-ethtool-reporting-of-pauseframe-control.patch
+net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch
+rdma-hns-fix-the-double-unlock-problem-of-poll_sem.patch
+net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch
+riscv-disable-stackprotector_per_task-if-gcc_plugin_.patch
+net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch
+drm-i915-fix-i915_globals_exit-section-mismatch-erro.patch
+mips-check-return-value-of-pgtable_pmd_page_ctor.patch
+x86-tools-relocs-fix-non-posix-regexp.patch
+mips-fix-non-posix-regexp.patch
+kbuild-cancel-sub_make_done-for-the-install-target-t.patch
+bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch
+net-ethernet-ti-am65-cpsw-fix-crash-in-am65_cpsw_por.patch
+net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch
+net-fec-fix-use-after-free-in-fec_drv_remove.patch
+net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch
+blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch
+bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch
+io-wq-fix-no-lock-protection-of-acct-nr_worker.patch
+io-wq-fix-lack-of-acct-nr_workers-acct-max_workers-j.patch
--- /dev/null
+From f349ebea2a663d3035185ea6ef57c864f005432a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 12:01:02 +0200
+Subject: spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 53ca18acbe645656132fb5a329833db711067e54 ]
+
+The spi_imx->spi_bus_clk may be uninitialized and thus also zero in
+mx51_ecspi_prepare_message(), which would lead to division by zero
+in kernel. Since bitbang .setup_transfer callback which initializes
+the spi_imx->spi_bus_clk is called after bitbang prepare_message
+callback, iterate over all the transfers in spi_message, find the
+one with lowest bus frequency, and use that bus frequency for the
+delay calculation.
+
+Note that it is not possible to move this CONFIGREG delay back into
+the .setup_transfer callback, because that is invoked too late, after
+the GPIO chipselects were already configured.
+
+Fixes: 135cbd378eab ("spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210726100102.5188-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 4aee3db6d6df..2872993550bd 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -505,7 +505,9 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+ struct spi_message *msg)
+ {
+ struct spi_device *spi = msg->spi;
++ struct spi_transfer *xfer;
+ u32 ctrl = MX51_ECSPI_CTRL_ENABLE;
++ u32 min_speed_hz = ~0U;
+ u32 testreg, delay;
+ u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG);
+
+@@ -577,8 +579,20 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+ * be asserted before the SCLK polarity changes, which would disrupt
+ * the SPI communication as the device on the other end would consider
+ * the change of SCLK polarity as a clock tick already.
++ *
++ * Because spi_imx->spi_bus_clk is only set in bitbang prepare_message
++ * callback, iterate over all the transfers in spi_message, find the
++ * one with lowest bus frequency, and use that bus frequency for the
++ * delay calculation. In case all transfers have speed_hz == 0, then
++ * min_speed_hz is ~0 and the resulting delay is zero.
+ */
+- delay = (2 * 1000000) / spi_imx->spi_bus_clk;
++ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
++ if (!xfer->speed_hz)
++ continue;
++ min_speed_hz = min(xfer->speed_hz, min_speed_hz);
++ }
++
++ delay = (2 * 1000000) / min_speed_hz;
+ if (likely(delay < 10)) /* SCLK is faster than 100 kHz */
+ udelay(delay);
+ else /* SCLK is _very_ slow */
+--
+2.30.2
+
--- /dev/null
+From 47028d5e6d06cfe477e6b769cb2819111cf0bca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jul 2021 04:23:00 +0200
+Subject: spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 135cbd378eab336da15de9c84bbb22bf743b38a5 ]
+
+Since 00b80ac935539 ("spi: imx: mx51-ecspi: Move some initialisation to
+prepare_message hook."), the MX51_ECSPI_CONFIG write no longer happens
+in prepare_transfer hook, but rather in prepare_message hook, however
+the MX51_ECSPI_CONFIG delay is still left in prepare_transfer hook and
+thus has no effect. This leads to low bus frequency operation problems
+described in 6fd8b8503a0dc ("spi: spi-imx: Fix out-of-order CS/SCLK
+operation at low speeds") again.
+
+Move the MX51_ECSPI_CONFIG write delay into the prepare_message hook
+as well, thus reinstating the low bus frequency fix.
+
+Fixes: 00b80ac935539 ("spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook.")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210703022300.296114-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 39dc02e366f4..4aee3db6d6df 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -506,7 +506,7 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+ {
+ struct spi_device *spi = msg->spi;
+ u32 ctrl = MX51_ECSPI_CTRL_ENABLE;
+- u32 testreg;
++ u32 testreg, delay;
+ u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG);
+
+ /* set Master or Slave mode */
+@@ -567,6 +567,23 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,
+
+ writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG);
+
++ /*
++ * Wait until the changes in the configuration register CONFIGREG
++ * propagate into the hardware. It takes exactly one tick of the
++ * SCLK clock, but we will wait two SCLK clock just to be sure. The
++ * effect of the delay it takes for the hardware to apply changes
++ * is noticable if the SCLK clock run very slow. In such a case, if
++ * the polarity of SCLK should be inverted, the GPIO ChipSelect might
++ * be asserted before the SCLK polarity changes, which would disrupt
++ * the SPI communication as the device on the other end would consider
++ * the change of SCLK polarity as a clock tick already.
++ */
++ delay = (2 * 1000000) / spi_imx->spi_bus_clk;
++ if (likely(delay < 10)) /* SCLK is faster than 100 kHz */
++ udelay(delay);
++ else /* SCLK is _very_ slow */
++ usleep_range(delay, delay + 10);
++
+ return 0;
+ }
+
+@@ -574,7 +591,7 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
+ struct spi_device *spi)
+ {
+ u32 ctrl = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- u32 clk, delay;
++ u32 clk;
+
+ /* Clear BL field and set the right value */
+ ctrl &= ~MX51_ECSPI_CTRL_BL_MASK;
+@@ -596,23 +613,6 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
+
+ writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL);
+
+- /*
+- * Wait until the changes in the configuration register CONFIGREG
+- * propagate into the hardware. It takes exactly one tick of the
+- * SCLK clock, but we will wait two SCLK clock just to be sure. The
+- * effect of the delay it takes for the hardware to apply changes
+- * is noticable if the SCLK clock run very slow. In such a case, if
+- * the polarity of SCLK should be inverted, the GPIO ChipSelect might
+- * be asserted before the SCLK polarity changes, which would disrupt
+- * the SPI communication as the device on the other end would consider
+- * the change of SCLK polarity as a clock tick already.
+- */
+- delay = (2 * 1000000) / clk;
+- if (likely(delay < 10)) /* SCLK is faster than 100 kHz */
+- udelay(delay);
+- else /* SCLK is _very_ slow */
+- usleep_range(delay, delay + 10);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0c3bd0b95c7585901bddb00b9b4e77ede8542f5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 10:57:09 +0200
+Subject: x86/tools/relocs: Fix non-POSIX regexp
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa953adfad7cf9c7e30d9ea0e4ccfd38cfb5495d ]
+
+Trying to run a cross-compiled x86 relocs tool on a BSD based
+HOSTCC leads to errors like
+
+ VOFFSET arch/x86/boot/compressed/../voffset.h - due to: vmlinux
+ CC arch/x86/boot/compressed/misc.o - due to: arch/x86/boot/compressed/../voffset.h
+ OBJCOPY arch/x86/boot/compressed/vmlinux.bin - due to: vmlinux
+ RELOCS arch/x86/boot/compressed/vmlinux.relocs - due to: vmlinux
+empty (sub)expressionarch/x86/boot/compressed/Makefile:118: recipe for target 'arch/x86/boot/compressed/vmlinux.relocs' failed
+make[3]: *** [arch/x86/boot/compressed/vmlinux.relocs] Error 1
+
+It turns out that relocs.c uses patterns like
+
+ "something(|_end)"
+
+This is not valid syntax or gives undefined results according
+to POSIX 9.5.3 ERE Grammar
+
+ https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html
+
+It seems to be silently accepted by the Linux regexp() implementation
+while a BSD host complains.
+
+Such patterns can be replaced by a transformation like
+
+ "(|p1|p2)" -> "(p1|p2)?"
+
+Fixes: fd952815307f ("x86-32, relocs: Whitelist more symbols for ld bug workaround")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/tools/relocs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index 04c5a44b9682..9ba700dc47de 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -57,12 +57,12 @@ static const char * const sym_regex_kernel[S_NSYMTYPES] = {
+ [S_REL] =
+ "^(__init_(begin|end)|"
+ "__x86_cpu_dev_(start|end)|"
+- "(__parainstructions|__alt_instructions)(|_end)|"
+- "(__iommu_table|__apicdrivers|__smp_locks)(|_end)|"
++ "(__parainstructions|__alt_instructions)(_end)?|"
++ "(__iommu_table|__apicdrivers|__smp_locks)(_end)?|"
+ "__(start|end)_pci_.*|"
+ "__(start|end)_builtin_fw|"
+- "__(start|stop)___ksymtab(|_gpl)|"
+- "__(start|stop)___kcrctab(|_gpl)|"
++ "__(start|stop)___ksymtab(_gpl)?|"
++ "__(start|stop)___kcrctab(_gpl)?|"
+ "__(start|stop)___param|"
+ "__(start|stop)___modver|"
+ "__(start|stop)___bug_table|"
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
