--- /dev/null
+From 2607f45535f3d2bc2269e4d1e021242bdb566971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 16:19:12 +0300
+Subject: ARM: at91: pm: do not panic if ram controllers are not enabled
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 1605de1b3ca66e3eddbca4b3c353c13c26476fe2 ]
+
+In case PM is enabled but there is no RAM controller information
+in DT the code will panic. Avoid such scenarios by not initializing
+platform specific PM code in case RAM controller is not provided
+via DT.
+
+Reported-by: Eugen Hristev <eugen.hristev@microchip.com>
+Fixes: 827de1f123ba0 ("ARM: at91: remove at91_dt_initialize and machine init_early()")
+Fixes: 892e1f4a3ae58 ("ARM: at91: pm: add sama7g5 ddr phy controller")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20210823131915.23857-2-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm.c | 58 +++++++++++++++++++++++++++++++++--------
+ 1 file changed, 47 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 120f9aa6fff3..3f015cb6ec2b 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -517,18 +517,22 @@ static const struct of_device_id ramc_ids[] __initconst = {
+ { /*sentinel*/ }
+ };
+
+-static __init void at91_dt_ramc(void)
++static __init int at91_dt_ramc(void)
+ {
+ struct device_node *np;
+ const struct of_device_id *of_id;
+ int idx = 0;
+ void *standby = NULL;
+ const struct ramc_info *ramc;
++ int ret;
+
+ for_each_matching_node_and_match(np, ramc_ids, &of_id) {
+ soc_pm.data.ramc[idx] = of_iomap(np, 0);
+- if (!soc_pm.data.ramc[idx])
+- panic(pr_fmt("unable to map ramc[%d] cpu registers\n"), idx);
++ if (!soc_pm.data.ramc[idx]) {
++ pr_err("unable to map ramc[%d] cpu registers\n", idx);
++ ret = -ENOMEM;
++ goto unmap_ramc;
++ }
+
+ ramc = of_id->data;
+ if (!standby)
+@@ -538,15 +542,26 @@ static __init void at91_dt_ramc(void)
+ idx++;
+ }
+
+- if (!idx)
+- panic(pr_fmt("unable to find compatible ram controller node in dtb\n"));
++ if (!idx) {
++ pr_err("unable to find compatible ram controller node in dtb\n");
++ ret = -ENODEV;
++ goto unmap_ramc;
++ }
+
+ if (!standby) {
+ pr_warn("ramc no standby function available\n");
+- return;
++ return 0;
+ }
+
+ at91_cpuidle_device.dev.platform_data = standby;
++
++ return 0;
++
++unmap_ramc:
++ while (idx)
++ iounmap(soc_pm.data.ramc[--idx]);
++
++ return ret;
+ }
+
+ static void at91rm9200_idle(void)
+@@ -869,6 +884,8 @@ static void __init at91_pm_init(void (*pm_idle)(void))
+
+ void __init at91rm9200_pm_init(void)
+ {
++ int ret;
++
+ if (!IS_ENABLED(CONFIG_SOC_AT91RM9200))
+ return;
+
+@@ -880,7 +897,9 @@ void __init at91rm9200_pm_init(void)
+ soc_pm.data.standby_mode = AT91_PM_STANDBY;
+ soc_pm.data.suspend_mode = AT91_PM_ULP0;
+
+- at91_dt_ramc();
++ ret = at91_dt_ramc();
++ if (ret)
++ return;
+
+ /*
+ * AT91RM9200 SDRAM low-power mode cannot be used with self-refresh.
+@@ -895,13 +914,17 @@ void __init sam9x60_pm_init(void)
+ static const int modes[] __initconst = {
+ AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1,
+ };
++ int ret;
+
+ if (!IS_ENABLED(CONFIG_SOC_SAM9X60))
+ return;
+
+ at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
+ at91_pm_modes_init();
+- at91_dt_ramc();
++ ret = at91_dt_ramc();
++ if (ret)
++ return;
++
+ at91_pm_init(NULL);
+
+ soc_pm.ws_ids = sam9x60_ws_ids;
+@@ -910,6 +933,8 @@ void __init sam9x60_pm_init(void)
+
+ void __init at91sam9_pm_init(void)
+ {
++ int ret;
++
+ if (!IS_ENABLED(CONFIG_SOC_AT91SAM9))
+ return;
+
+@@ -921,7 +946,10 @@ void __init at91sam9_pm_init(void)
+ soc_pm.data.standby_mode = AT91_PM_STANDBY;
+ soc_pm.data.suspend_mode = AT91_PM_ULP0;
+
+- at91_dt_ramc();
++ ret = at91_dt_ramc();
++ if (ret)
++ return;
++
+ at91_pm_init(at91sam9_idle);
+ }
+
+@@ -930,12 +958,16 @@ void __init sama5_pm_init(void)
+ static const int modes[] __initconst = {
+ AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST,
+ };
++ int ret;
+
+ if (!IS_ENABLED(CONFIG_SOC_SAMA5))
+ return;
+
+ at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
+- at91_dt_ramc();
++ ret = at91_dt_ramc();
++ if (ret)
++ return;
++
+ at91_pm_init(NULL);
+ }
+
+@@ -945,13 +977,17 @@ void __init sama5d2_pm_init(void)
+ AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1,
+ AT91_PM_BACKUP,
+ };
++ int ret;
+
+ if (!IS_ENABLED(CONFIG_SOC_SAMA5D2))
+ return;
+
+ at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
+ at91_pm_modes_init();
+- at91_dt_ramc();
++ ret = at91_dt_ramc();
++ if (ret)
++ return;
++
+ at91_pm_init(NULL);
+
+ soc_pm.ws_ids = sama5d2_ws_ids;
+--
+2.33.0
+
--- /dev/null
+From d239954943c308ec19c4ea13f5fd74b62ba13377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 02:00:48 +0200
+Subject: ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 ]
+
+The panel already contains pinctrl-0 phandle, but it is missing
+the default pinctrl-names property, so the pin configuration is
+ignored. Fill in the missing pinctrl-names property, so the pin
+configuration is applied.
+
+Fixes: d81765d693db6 ("ARM: dts: imx53: Update LCD panel node on M53Menlo")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-m53menlo.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index d3082b9774e4..48adcfd32cea 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -56,6 +56,7 @@
+ panel {
+ compatible = "edt,etm0700g0dh6";
+ pinctrl-0 = <&pinctrl_display_gpio>;
++ pinctrl-names = "default";
+ enable-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>;
+
+ port {
+--
+2.33.0
+
--- /dev/null
+From 72bdb003a1ed943838ab717796ebe0caa30cf984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 02:01:37 +0200
+Subject: ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e ]
+
+The MIC2025 switch input signal nEN is active low, describe it as such
+in the DT. The previous change to this regulator polarity was incorrectly
+influenced by broken quirks in gpiolib-of.c, which is now long fixed. So
+fix this regulator polarity setting here once and for all.
+
+Fixes: 3c3601cd6a6d3 ("ARM: dts: imx53: Update USB configuration on M53Menlo")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-m53menlo.dts | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index 48adcfd32cea..4f88e96d81dd 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -77,8 +77,7 @@
+ regulator-name = "vbus";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+- gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+- enable-active-high;
++ gpio = <&gpio1 2 0>;
+ };
+ };
+
+--
+2.33.0
+
--- /dev/null
+From 2dc3fb38cb50f1e7b7a9a1334c0eaaf7aafef26b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 14:17:15 -0300
+Subject: ARM: dts: imx6qdl-pico: Fix Ethernet support
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 450e7fe9b1b3c90eeed74a2fe0eeb13a7b57f3da ]
+
+Currently, it is no longer possible to retrieve a DHCP address
+on the imx6qdl-pico board.
+
+This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q:
+remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs").
+
+Fix it by describing the qca,clk-out-frequency property as suggested
+by the commit above.
+
+Fixes: 98670a0bb0ef14bbb3 ("ARM: dts: imx6qdl: Add imx6qdl-pico support")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-pico.dtsi | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-pico.dtsi b/arch/arm/boot/dts/imx6qdl-pico.dtsi
+index 5de4ccb97916..f7a56d6b160c 100644
+--- a/arch/arm/boot/dts/imx6qdl-pico.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-pico.dtsi
+@@ -176,7 +176,18 @@
+ pinctrl-0 = <&pinctrl_enet>;
+ phy-mode = "rgmii-id";
+ phy-reset-gpios = <&gpio1 26 GPIO_ACTIVE_LOW>;
++ phy-handle = <&phy>;
+ status = "okay";
++
++ mdio {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ phy: ethernet-phy@1 {
++ reg = <1>;
++ qca,clk-out-frequency = <125000000>;
++ };
++ };
+ };
+
+ &hdmi {
+--
+2.33.0
+
--- /dev/null
+From 860429959667fe2233102cb4bd59d14c6153a8b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Aug 2021 22:30:25 +0200
+Subject: ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit f1db21c315f4b4f8c3fbea56aac500673132d317 ]
+
+The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference
+clock and should hence use PXO, not CXO which runs at 19.2MHz.
+
+Note that none of the DSI PHY/PLL drivers currently use this "ref"
+clock; they all rely on (sometimes inexistant) global clock names and
+usually function normally without a parent clock. This discrepancy will
+be corrected in a future patch, for which this change needs to be in
+place first.
+
+Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/r/20210829203027.276143-2-marijn.suijten@somainline.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-apq8064.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 01ea4590ffce..72c4a9fc41a2 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -198,7 +198,7 @@
+ clock-frequency = <19200000>;
+ };
+
+- pxo_board {
++ pxo_board: pxo_board {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <27000000>;
+@@ -1305,7 +1305,7 @@
+ reg-names = "dsi_pll", "dsi_phy", "dsi_phy_regulator";
+ clock-names = "iface_clk", "ref";
+ clocks = <&mmcc DSI_M_AHB_CLK>,
+- <&cxo_board>;
++ <&pxo_board>;
+ };
+
+
+--
+2.33.0
+
--- /dev/null
+From 69117f3df2b51d9b72346971761ef31e7ab0b207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Sep 2021 15:49:40 +0200
+Subject: ARM: imx6: disable the GIC CPU interface before calling stby-poweroff
+ sequence
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 783f3db030563f7bcdfe2d26428af98ea1699a8e ]
+
+Any pending interrupt can prevent entering standby based power off state.
+To avoid it, disable the GIC CPU interface.
+
+Fixes: 8148d2136002 ("ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 40c74b4c4d73..e24409c1f5d3 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -9,6 +9,7 @@
+ #include <linux/io.h>
+ #include <linux/irq.h>
+ #include <linux/genalloc.h>
++#include <linux/irqchip/arm-gic.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
+ #include <linux/of.h>
+@@ -618,6 +619,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+
+ static void imx6_pm_stby_poweroff(void)
+ {
++ gic_cpu_if_down(0);
+ imx6_set_lpm(STOP_POWER_OFF);
+ imx6q_suspend_finish(0);
+
+--
+2.33.0
+
--- /dev/null
+From 44520cdbd9ed16d778761626589e39228faa8021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 11:11:30 +0200
+Subject: arm64: dts: ls1028a: add missing CAN nodes
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 04fa4f03e3533f51b4db19cb487435f5862a0514 ]
+
+The LS1028A has two FlexCAN controller. These are compatible with
+the ones from the LX2160A. Add the nodes.
+
+The first controller was tested on the Kontron sl28 board.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 5f42904d53ab..580690057601 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -386,6 +386,24 @@
+ status = "disabled";
+ };
+
++ can0: can@2180000 {
++ compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan";
++ reg = <0x0 0x2180000 0x0 0x10000>;
++ interrupts = <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&sysclk>, <&clockgen 4 1>;
++ clock-names = "ipg", "per";
++ status = "disabled";
++ };
++
++ can1: can@2190000 {
++ compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan";
++ reg = <0x0 0x2190000 0x0 0x10000>;
++ interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&sysclk>, <&clockgen 4 1>;
++ clock-names = "ipg", "per";
++ status = "disabled";
++ };
++
+ duart0: serial@21c0500 {
+ compatible = "fsl,ns16550", "ns16550a";
+ reg = <0x00 0x21c0500 0x0 0x100>;
+--
+2.33.0
+
--- /dev/null
+From 8a4985970b7ce1f4364ad21f7ff37b98b831b9f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 18:13:39 +0300
+Subject: arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a153d317168aa3d61a204fadc85bac3995381d33 ]
+
+Change pm8150 to use the qcom,pm8998-pon compatible string for the pon
+in order to pass reboot mode properly.
+
+Fixes: 5101f22a5c37 ("arm64: dts: qcom: pm8150: Add base dts file")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20210916151341.1797512-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/pm8150.dtsi b/arch/arm64/boot/dts/qcom/pm8150.dtsi
+index 1b6406927509..82edcd74ce98 100644
+--- a/arch/arm64/boot/dts/qcom/pm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm8150.dtsi
+@@ -48,7 +48,7 @@
+ #size-cells = <0>;
+
+ pon: power-on@800 {
+- compatible = "qcom,pm8916-pon";
++ compatible = "qcom,pm8998-pon";
+ reg = <0x0800>;
+ pwrkey {
+ compatible = "qcom,pm8941-pwrkey";
+--
+2.33.0
+
--- /dev/null
+From c923a26874c35d66cefc1d7cf31a34ccf45e27d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 14:23:44 +0200
+Subject: ath5k: fix building with LEDS=m
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fb8c3a3c52400512fc8b3b61150057b888c30b0d ]
+
+Randconfig builds still show a failure for the ath5k driver,
+similar to the one that was fixed for ath9k earlier:
+
+WARNING: unmet direct dependencies detected for MAC80211_LEDS
+ Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y])
+ Selected by [m]:
+ - ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y]
+net/mac80211/led.c: In function 'ieee80211_alloc_led_names':
+net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name'
+ 34 | local->rx_led.name = kasprintf(GFP_KERNEL, "%srx",
+ | ^
+
+Copying the same logic from my ath9k patch makes this one work
+as well, stubbing out the calls to the LED subsystem.
+
+Fixes: b64acb28da83 ("ath9k: fix build error with LEDS_CLASS=m")
+Fixes: 72cdab808714 ("ath9k: Do not select MAC80211_LEDS by default")
+Fixes: 3a078876caee ("ath5k: convert LED code to use mac80211 triggers")
+Link: https://lore.kernel.org/all/20210722105501.1000781-1-arnd@kernel.org/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210920122359.353810-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/Kconfig | 4 +---
+ drivers/net/wireless/ath/ath5k/led.c | 10 ++++++----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
+index f35cd8de228e..6914b37bb0fb 100644
+--- a/drivers/net/wireless/ath/ath5k/Kconfig
++++ b/drivers/net/wireless/ath/ath5k/Kconfig
+@@ -3,9 +3,7 @@ config ATH5K
+ tristate "Atheros 5xxx wireless cards support"
+ depends on (PCI || ATH25) && MAC80211
+ select ATH_COMMON
+- select MAC80211_LEDS
+- select LEDS_CLASS
+- select NEW_LEDS
++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211
+ select ATH5K_AHB if ATH25
+ select ATH5K_PCI if !ATH25
+ help
+diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
+index 6a2a16856763..33e9928af363 100644
+--- a/drivers/net/wireless/ath/ath5k/led.c
++++ b/drivers/net/wireless/ath/ath5k/led.c
+@@ -89,7 +89,8 @@ static const struct pci_device_id ath5k_led_devices[] = {
+
+ void ath5k_led_enable(struct ath5k_hw *ah)
+ {
+- if (test_bit(ATH_STAT_LEDSOFT, ah->status)) {
++ if (IS_ENABLED(CONFIG_MAC80211_LEDS) &&
++ test_bit(ATH_STAT_LEDSOFT, ah->status)) {
+ ath5k_hw_set_gpio_output(ah, ah->led_pin);
+ ath5k_led_off(ah);
+ }
+@@ -104,7 +105,8 @@ static void ath5k_led_on(struct ath5k_hw *ah)
+
+ void ath5k_led_off(struct ath5k_hw *ah)
+ {
+- if (!test_bit(ATH_STAT_LEDSOFT, ah->status))
++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) ||
++ !test_bit(ATH_STAT_LEDSOFT, ah->status))
+ return;
+ ath5k_hw_set_gpio(ah, ah->led_pin, !ah->led_on);
+ }
+@@ -146,7 +148,7 @@ ath5k_register_led(struct ath5k_hw *ah, struct ath5k_led *led,
+ static void
+ ath5k_unregister_led(struct ath5k_led *led)
+ {
+- if (!led->ah)
++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !led->ah)
+ return;
+ led_classdev_unregister(&led->led_dev);
+ ath5k_led_off(led->ah);
+@@ -169,7 +171,7 @@ int ath5k_init_leds(struct ath5k_hw *ah)
+ char name[ATH5K_LED_MAX_NAME_LEN + 1];
+ const struct pci_device_id *match;
+
+- if (!ah->pdev)
++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !ah->pdev)
+ return 0;
+
+ #ifdef CONFIG_ATH5K_AHB
+--
+2.33.0
+
--- /dev/null
+From ea7caf359223c860a6e62436352310f3facd2f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Sep 2021 11:13:10 +0200
+Subject: bpf, arm: Fix register clobbering in div/mod implementation
+
+From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+
+[ Upstream commit 79e3445b38e0cab94264a3894c0c3d57c930b97e ]
+
+On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are
+implemented using a call to a helper function. Before, the emitted code
+for those function calls failed to preserve caller-saved ARM registers.
+Since some of those registers happen to be mapped to BPF registers, it
+resulted in eBPF register values being overwritten.
+
+This patch emits code to push and pop the remaining caller-saved ARM
+registers r2-r3 into the stack during the div/mod function call. ARM
+registers r0-r1 are used as arguments and return value, and those were
+already saved and restored correctly.
+
+Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
+Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/net/bpf_jit_32.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index ce8b04326352..1214e39aad5e 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -36,6 +36,10 @@
+ * +-----+
+ * |RSVD | JIT scratchpad
+ * current ARM_SP => +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE)
++ * | ... | caller-saved registers
++ * +-----+
++ * | ... | arguments passed on stack
++ * ARM_SP during call => +-----|
+ * | |
+ * | ... | Function call stack
+ * | |
+@@ -63,6 +67,12 @@
+ *
+ * When popping registers off the stack at the end of a BPF function, we
+ * reference them via the current ARM_FP register.
++ *
++ * Some eBPF operations are implemented via a call to a helper function.
++ * Such calls are "invisible" in the eBPF code, so it is up to the calling
++ * program to preserve any caller-saved ARM registers during the call. The
++ * JIT emits code to push and pop those registers onto the stack, immediately
++ * above the callee stack frame.
+ */
+ #define CALLEE_MASK (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \
+ 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \
+@@ -70,6 +80,8 @@
+ #define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR)
+ #define CALLEE_POP_MASK (CALLEE_MASK | 1 << ARM_PC)
+
++#define CALLER_MASK (1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3)
++
+ enum {
+ /* Stack layout - these are offsets from (top of stack - 4) */
+ BPF_R2_HI,
+@@ -464,6 +476,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx)
+
+ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
+ {
++ const int exclude_mask = BIT(ARM_R0) | BIT(ARM_R1);
+ const s8 *tmp = bpf2a32[TMP_REG_1];
+
+ #if __LINUX_ARM_ARCH__ == 7
+@@ -495,11 +508,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
+ emit(ARM_MOV_R(ARM_R0, rm), ctx);
+ }
+
++ /* Push caller-saved registers on stack */
++ emit(ARM_PUSH(CALLER_MASK & ~exclude_mask), ctx);
++
+ /* Call appropriate function */
+ emit_mov_i(ARM_IP, op == BPF_DIV ?
+ (u32)jit_udiv32 : (u32)jit_mod32, ctx);
+ emit_blx_r(ARM_IP, ctx);
+
++ /* Restore caller-saved registers from stack */
++ emit(ARM_POP(CALLER_MASK & ~exclude_mask), ctx);
++
+ /* Save return value */
+ if (rd != ARM_R0)
+ emit(ARM_MOV_R(rd, ARM_R0), ctx);
+--
+2.33.0
+
--- /dev/null
+From 26e1364ddf94e5cd205a40e295c619e0ebb34926 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 22:55:45 +0900
+Subject: bpf: Fix integer overflow in prealloc_elems_and_freelist()
+
+From: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com>
+
+[ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ]
+
+In prealloc_elems_and_freelist(), the multiplication to calculate the
+size passed to bpf_map_area_alloc() could lead to an integer overflow.
+As a result, out-of-bounds write could occur in pcpu_freelist_populate()
+as reported by KASAN:
+
+[...]
+[ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100
+[ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78
+[ 16.970038]
+[ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1
+[ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
+[ 16.972026] Call Trace:
+[ 16.972306] dump_stack_lvl+0x34/0x44
+[ 16.972687] print_address_description.constprop.0+0x21/0x140
+[ 16.973297] ? pcpu_freelist_populate+0xd9/0x100
+[ 16.973777] ? pcpu_freelist_populate+0xd9/0x100
+[ 16.974257] kasan_report.cold+0x7f/0x11b
+[ 16.974681] ? pcpu_freelist_populate+0xd9/0x100
+[ 16.975190] pcpu_freelist_populate+0xd9/0x100
+[ 16.975669] stack_map_alloc+0x209/0x2a0
+[ 16.976106] __sys_bpf+0xd83/0x2ce0
+[...]
+
+The possibility of this overflow was originally discussed in [0], but
+was overlooked.
+
+Fix the integer overflow by changing elem_size to u64 from u32.
+
+ [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/
+
+Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
+Signed-off-by: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index ebf60848d5eb..4477873ac3a0 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -64,7 +64,8 @@ static inline int stack_map_data_size(struct bpf_map *map)
+
+ static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
+ {
+- u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
++ u64 elem_size = sizeof(struct stack_map_bucket) +
++ (u64)smap->map.value_size;
+ int err;
+
+ smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,
+--
+2.33.0
+
--- /dev/null
+From 234f0849345cd93e79a904444957e457287b50f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 12:18:52 -0700
+Subject: bus: ti-sysc: Add break in switch statement in sysc_init_soc()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit e879f855e590b40fe3c79f2fbd8f65ca3c724120 ]
+
+After commit a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only"), clang
+with -Wimplicit-fallthrough enabled warns:
+
+drivers/bus/ti-sysc.c:2958:3: warning: unannotated fall-through between
+switch labels [-Wimplicit-fallthrough]
+ default:
+ ^
+drivers/bus/ti-sysc.c:2958:3: note: insert 'break;' to avoid
+fall-through
+ default:
+ ^
+ break;
+1 warning generated.
+
+Clang's version of this warning is a little bit more pedantic than
+GCC's. Add the missing break to satisfy it to match what has been done
+all over the kernel tree.
+
+Fixes: a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 159b57c6dc4d..d2b7338c073f 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -2922,6 +2922,7 @@ static int sysc_init_soc(struct sysc *ddata)
+ break;
+ case SOC_AM3:
+ sysc_add_disabled(0x48310000); /* rng */
++ break;
+ default:
+ break;
+ };
+--
+2.33.0
+
--- /dev/null
+From 7f6b9cc81a6709d4b74b8072a8b03ea8f9b0bcb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Sep 2021 08:49:36 +0300
+Subject: bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit b13a270ace2e4c70653aa1d1d0394c553905802f ]
+
+Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for
+CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in
+addition to dcan2 for errata i893 handling.
+
+Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods"
+dts property is used with related dcan hwmod data. This should be only
+needed if anybody needs to git bisect earlier stable trees though.
+
+Fixes: 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 ++
+ drivers/bus/ti-sysc.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index 83d595ebcf1f..9443f129859b 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -3618,6 +3618,8 @@ int omap_hwmod_init_module(struct device *dev,
+ oh->flags |= HWMOD_SWSUP_SIDLE_ACT;
+ if (data->cfg->quirks & SYSC_QUIRK_SWSUP_MSTANDBY)
+ oh->flags |= HWMOD_SWSUP_MSTANDBY;
++ if (data->cfg->quirks & SYSC_QUIRK_CLKDM_NOAUTO)
++ oh->flags |= HWMOD_CLKDM_NOAUTO;
+
+ error = omap_hwmod_check_module(dev, oh, data, sysc_fields,
+ rev_offs, sysc_offs, syss_offs,
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index d2b7338c073f..02341fd66e8d 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1464,6 +1464,9 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ /* Quirks that need to be set based on detected module */
+ SYSC_QUIRK("aess", 0, 0, 0x10, -ENODEV, 0x40000000, 0xffffffff,
+ SYSC_MODULE_QUIRK_AESS),
++ /* Errata i893 handling for dra7 dcan1 and 2 */
++ SYSC_QUIRK("dcan", 0x4ae3c000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff,
++ SYSC_QUIRK_CLKDM_NOAUTO),
+ SYSC_QUIRK("dcan", 0x48480000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff,
+ SYSC_QUIRK_CLKDM_NOAUTO),
+ SYSC_QUIRK("dss", 0x4832a000, 0, 0x10, 0x14, 0x00000020, 0xffffffff,
+--
+2.33.0
+
--- /dev/null
+From 40d5c90738b68bdae99bea7fb2ccc7a4ed221929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 19:02:20 -0500
+Subject: drm/nouveau: avoid a use-after-free when BO init fails
+
+From: Jeremy Cline <jcline@redhat.com>
+
+[ Upstream commit bcf34aa5082ee2343574bc3f4d1c126030913e54 ]
+
+nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
+back to the caller. On failures, ttm_bo_init() invokes the provided
+destructor which should de-initialize and free the memory.
+
+Thus, when nouveau_bo_init() returns an error the gem object has already
+been released and the memory freed by nouveau_bo_del_ttm().
+
+Fixes: 019cbd4a4feb ("drm/nouveau: Initialize GEM object before TTM object")
+Cc: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201203000220.18238-1-jcline@redhat.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index c2051380d18c..6504ebec1190 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -196,10 +196,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
+ }
+
+ ret = nouveau_bo_init(nvbo, size, align, domain, NULL, NULL);
+- if (ret) {
+- nouveau_bo_ref(NULL, &nvbo);
++ if (ret)
+ return ret;
+- }
+
+ /* we restrict allowed domains on nv50+ to only the types
+ * that were requested at creation time. not possibly on
+--
+2.33.0
+
--- /dev/null
+From e5bc8a7a178b49c601cd5e991bf44a2a61c1904b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Sep 2021 15:50:23 +0800
+Subject: drm/nouveau/debugfs: fix file release memory leak
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ]
+
+When using single_open() for opening, single_release() should be
+called, otherwise the 'op' allocated in single_open() will be leaked.
+
+Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yangyingliang@huawei.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index c2bc05eb2e54..1cbe01048b93 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -207,6 +207,7 @@ static const struct file_operations nouveau_pstate_fops = {
+ .open = nouveau_debugfs_pstate_open,
+ .read = seq_read,
+ .write = nouveau_debugfs_pstate_set,
++ .release = single_release,
+ };
+
+ static struct drm_info_list nouveau_debugfs_list[] = {
+--
+2.33.0
+
--- /dev/null
+From 376a1a33aa2fe119ff72a42d9ab4181d950979e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Sep 2021 15:50:22 +0800
+Subject: drm/nouveau/kms/nv50-: fix file release memory leak
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5 ]
+
+When using single_open() for opening, single_release() should be
+called, otherwise the 'op' allocated in single_open() will be leaked.
+
+Fixes: 12885ecbfe62 ("drm/nouveau/kms/nvd9-: Add CRC support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-1-yangyingliang@huawei.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/crc.c b/drivers/gpu/drm/nouveau/dispnv50/crc.c
+index b8c31b697797..66f32d965c72 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/crc.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/crc.c
+@@ -704,6 +704,7 @@ static const struct file_operations nv50_crc_flip_threshold_fops = {
+ .open = nv50_crc_debugfs_flip_threshold_open,
+ .read = seq_read,
+ .write = nv50_crc_debugfs_flip_threshold_set,
++ .release = single_release,
+ };
+
+ int nv50_head_crc_late_register(struct nv50_head *head)
+--
+2.33.0
+
--- /dev/null
+From 1a3562ce75f31dfa6eadb2b72a189007ce704025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 19:58:36 +0200
+Subject: drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit c64c8e04a12ed3e2238761e26cda78e72550dc98 ]
+
+Recent rework, which made HDMI PHY driver a platform device, inadvertely
+reversed clock setup order. HW is very touchy about it. Proper way is to
+handle controllers resets and clocks first and HDMI PHYs second.
+
+Currently, without this fix, first mode set completely fails (nothing on
+HDMI monitor) on H3 era PHYs. On H6, it still somehow work.
+
+Move HDMI PHY reset & clocks handling to sun8i_hdmi_phy_init() which
+will assure that code is executed after controllers reset & clocks are
+handled. Additionally, add sun8i_hdmi_phy_deinit() which will deinit
+them at controllers driver unload.
+
+Tested on A64, H3, H6 and R40.
+
+Fixes: 9bf3797796f5 ("drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210915175836.3158839-1-jernej.skrabec@gmail.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 7 +-
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 4 +-
+ drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++++++++++++------------
+ 3 files changed, 61 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index f75fb157f2ff..016b877051da 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -216,11 +216,13 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
+ goto err_disable_clk_tmds;
+ }
+
++ ret = sun8i_hdmi_phy_init(hdmi->phy);
++ if (ret)
++ goto err_disable_clk_tmds;
++
+ drm_encoder_helper_add(encoder, &sun8i_dw_hdmi_encoder_helper_funcs);
+ drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
+
+- sun8i_hdmi_phy_init(hdmi->phy);
+-
+ plat_data->mode_valid = hdmi->quirks->mode_valid;
+ plat_data->use_drm_infoframe = hdmi->quirks->use_drm_infoframe;
+ sun8i_hdmi_phy_set_ops(hdmi->phy, plat_data);
+@@ -262,6 +264,7 @@ static void sun8i_dw_hdmi_unbind(struct device *dev, struct device *master,
+ struct sun8i_dw_hdmi *hdmi = dev_get_drvdata(dev);
+
+ dw_hdmi_unbind(hdmi->hdmi);
++ sun8i_hdmi_phy_deinit(hdmi->phy);
+ clk_disable_unprepare(hdmi->clk_tmds);
+ reset_control_assert(hdmi->rst_ctrl);
+ gpiod_set_value(hdmi->ddc_en, 0);
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
+index 74f6ed0e2570..bffe1b9cd3dc 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
+@@ -169,6 +169,7 @@ struct sun8i_hdmi_phy {
+ struct clk *clk_phy;
+ struct clk *clk_pll0;
+ struct clk *clk_pll1;
++ struct device *dev;
+ unsigned int rcal;
+ struct regmap *regs;
+ struct reset_control *rst_phy;
+@@ -205,7 +206,8 @@ encoder_to_sun8i_dw_hdmi(struct drm_encoder *encoder)
+
+ int sun8i_hdmi_phy_get(struct sun8i_dw_hdmi *hdmi, struct device_node *node);
+
+-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy);
++int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy);
++void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy);
+ void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy,
+ struct dw_hdmi_plat_data *plat_data);
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+index c9239708d398..b64d93da651d 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -506,9 +506,60 @@ static void sun8i_hdmi_phy_init_h3(struct sun8i_hdmi_phy *phy)
+ phy->rcal = (val & SUN8I_HDMI_PHY_ANA_STS_RCAL_MASK) >> 2;
+ }
+
+-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy)
++int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy)
+ {
++ int ret;
++
++ ret = reset_control_deassert(phy->rst_phy);
++ if (ret) {
++ dev_err(phy->dev, "Cannot deassert phy reset control: %d\n", ret);
++ return ret;
++ }
++
++ ret = clk_prepare_enable(phy->clk_bus);
++ if (ret) {
++ dev_err(phy->dev, "Cannot enable bus clock: %d\n", ret);
++ goto err_assert_rst_phy;
++ }
++
++ ret = clk_prepare_enable(phy->clk_mod);
++ if (ret) {
++ dev_err(phy->dev, "Cannot enable mod clock: %d\n", ret);
++ goto err_disable_clk_bus;
++ }
++
++ if (phy->variant->has_phy_clk) {
++ ret = sun8i_phy_clk_create(phy, phy->dev,
++ phy->variant->has_second_pll);
++ if (ret) {
++ dev_err(phy->dev, "Couldn't create the PHY clock\n");
++ goto err_disable_clk_mod;
++ }
++
++ clk_prepare_enable(phy->clk_phy);
++ }
++
+ phy->variant->phy_init(phy);
++
++ return 0;
++
++err_disable_clk_mod:
++ clk_disable_unprepare(phy->clk_mod);
++err_disable_clk_bus:
++ clk_disable_unprepare(phy->clk_bus);
++err_assert_rst_phy:
++ reset_control_assert(phy->rst_phy);
++
++ return ret;
++}
++
++void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy)
++{
++ clk_disable_unprepare(phy->clk_mod);
++ clk_disable_unprepare(phy->clk_bus);
++ clk_disable_unprepare(phy->clk_phy);
++
++ reset_control_assert(phy->rst_phy);
+ }
+
+ void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy,
+@@ -638,6 +689,7 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ phy->variant = (struct sun8i_hdmi_phy_variant *)match->data;
++ phy->dev = dev;
+
+ ret = of_address_to_resource(node, 0, &res);
+ if (ret) {
+@@ -696,47 +748,10 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev)
+ goto err_put_clk_pll1;
+ }
+
+- ret = reset_control_deassert(phy->rst_phy);
+- if (ret) {
+- dev_err(dev, "Cannot deassert phy reset control: %d\n", ret);
+- goto err_put_rst_phy;
+- }
+-
+- ret = clk_prepare_enable(phy->clk_bus);
+- if (ret) {
+- dev_err(dev, "Cannot enable bus clock: %d\n", ret);
+- goto err_deassert_rst_phy;
+- }
+-
+- ret = clk_prepare_enable(phy->clk_mod);
+- if (ret) {
+- dev_err(dev, "Cannot enable mod clock: %d\n", ret);
+- goto err_disable_clk_bus;
+- }
+-
+- if (phy->variant->has_phy_clk) {
+- ret = sun8i_phy_clk_create(phy, dev,
+- phy->variant->has_second_pll);
+- if (ret) {
+- dev_err(dev, "Couldn't create the PHY clock\n");
+- goto err_disable_clk_mod;
+- }
+-
+- clk_prepare_enable(phy->clk_phy);
+- }
+-
+ platform_set_drvdata(pdev, phy);
+
+ return 0;
+
+-err_disable_clk_mod:
+- clk_disable_unprepare(phy->clk_mod);
+-err_disable_clk_bus:
+- clk_disable_unprepare(phy->clk_bus);
+-err_deassert_rst_phy:
+- reset_control_assert(phy->rst_phy);
+-err_put_rst_phy:
+- reset_control_put(phy->rst_phy);
+ err_put_clk_pll1:
+ clk_put(phy->clk_pll1);
+ err_put_clk_pll0:
+@@ -753,12 +768,6 @@ static int sun8i_hdmi_phy_remove(struct platform_device *pdev)
+ {
+ struct sun8i_hdmi_phy *phy = platform_get_drvdata(pdev);
+
+- clk_disable_unprepare(phy->clk_mod);
+- clk_disable_unprepare(phy->clk_bus);
+- clk_disable_unprepare(phy->clk_phy);
+-
+- reset_control_assert(phy->rst_phy);
+-
+ reset_control_put(phy->rst_phy);
+
+ clk_put(phy->clk_pll0);
+--
+2.33.0
+
--- /dev/null
+From 4d133687c1028b5edbaa189d82bc4bd8050711eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 14:35:12 +0200
+Subject: dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b2d70c0dbf2731a37d1c7bcc86ab2387954d5f56 ]
+
+make dtbs_check:
+
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dt.yaml: bridge@2c: reg:0:0: 45 was expected
+
+According to the datasheet, the I2C address can be either 0x2c or 0x2d,
+depending on the ADDR control input.
+
+Fixes: e3896e6dddf0b821 ("dt-bindings: drm/bridge: Document sn65dsi86 bridge bindings")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Link: https://lore.kernel.org/r/08f73c2aa0d4e580303357dfae107d084d962835.1632486753.git.geert+renesas@glider.be
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/display/bridge/ti,sn65dsi86.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
+index f8622bd0f61e..f0e0345da498 100644
+--- a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
++++ b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
+@@ -18,7 +18,7 @@ properties:
+ const: ti,sn65dsi86
+
+ reg:
+- const: 0x2d
++ enum: [ 0x2c, 0x2d ]
+
+ enable-gpios:
+ maxItems: 1
+--
+2.33.0
+
--- /dev/null
+From 7b53330ee5a5e1fb1928c939b8c38ba6c4842db4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 19:42:20 -0700
+Subject: gve: Avoid freeing NULL pointer
+
+From: Tao Liu <xliutaox@google.com>
+
+[ Upstream commit 922aa9bcac92b3ab6a423526a8e785b35a60b441 ]
+
+Prevent possible crashes when cleaning up after unsuccessful
+initializations.
+
+Fixes: 893ce44df5658 ("gve: Add basic driver framework for Compute Engine Virtual NIC")
+Signed-off-by: Tao Liu <xliutaox@google.com>
+Signed-off-by: Catherine Sully <csully@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_main.c | 27 ++++++++++++++--------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
+index 0b714b606ba1..22b2c6a8d08f 100644
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -71,6 +71,9 @@ static int gve_alloc_counter_array(struct gve_priv *priv)
+
+ static void gve_free_counter_array(struct gve_priv *priv)
+ {
++ if (!priv->counter_array)
++ return;
++
+ dma_free_coherent(&priv->pdev->dev,
+ priv->num_event_counters *
+ sizeof(*priv->counter_array),
+@@ -131,6 +134,9 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
+
+ static void gve_free_stats_report(struct gve_priv *priv)
+ {
++ if (!priv->stats_report)
++ return;
++
+ del_timer_sync(&priv->stats_report_timer);
+ dma_free_coherent(&priv->pdev->dev, priv->stats_report_len,
+ priv->stats_report, priv->stats_report_bus);
+@@ -301,18 +307,19 @@ static void gve_free_notify_blocks(struct gve_priv *priv)
+ {
+ int i;
+
+- if (priv->msix_vectors) {
+- /* Free the irqs */
+- for (i = 0; i < priv->num_ntfy_blks; i++) {
+- struct gve_notify_block *block = &priv->ntfy_blocks[i];
+- int msix_idx = i;
++ if (!priv->msix_vectors)
++ return;
+
+- irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector,
+- NULL);
+- free_irq(priv->msix_vectors[msix_idx].vector, block);
+- }
+- free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
++ /* Free the irqs */
++ for (i = 0; i < priv->num_ntfy_blks; i++) {
++ struct gve_notify_block *block = &priv->ntfy_blocks[i];
++ int msix_idx = i;
++
++ irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector,
++ NULL);
++ free_irq(priv->msix_vectors[msix_idx].vector, block);
+ }
++ free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
+ dma_free_coherent(&priv->pdev->dev,
+ priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks),
+ priv->ntfy_blocks, priv->ntfy_block_bus);
+--
+2.33.0
+
--- /dev/null
+From 8f39affd92c559ead9c672d6d513379e5fcb5236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 19:42:19 -0700
+Subject: gve: Correct available tx qpl check
+
+From: Catherine Sullivan <csully@google.com>
+
+[ Upstream commit d03477ee10f4bc35d3573cf1823814378ef2dca2 ]
+
+The qpl_map_size is rounded up to a multiple of sizeof(long), but the
+number of qpls doesn't have to be.
+
+Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support")
+Signed-off-by: Catherine Sullivan <csully@google.com>
+Signed-off-by: Jeroen de Borst <jeroendb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h
+index f5c80229ea96..cfb174624d4e 100644
+--- a/drivers/net/ethernet/google/gve/gve.h
++++ b/drivers/net/ethernet/google/gve/gve.h
+@@ -472,7 +472,7 @@ struct gve_queue_page_list *gve_assign_rx_qpl(struct gve_priv *priv)
+ gve_num_tx_qpls(priv));
+
+ /* we are out of rx qpls */
+- if (id == priv->qpl_cfg.qpl_map_size)
++ if (id == gve_num_tx_qpls(priv) + gve_num_rx_qpls(priv))
+ return NULL;
+
+ set_bit(id, priv->qpl_cfg.qpl_id_map);
+--
+2.33.0
+
--- /dev/null
+From ecde5bc5013bdad197a94a2bc6448fbc99aeed9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 17:30:30 -0700
+Subject: gve: fix gve_get_stats()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 ]
+
+gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry()
+returns true.
+
+What is needed here is to sample values in temporary variables,
+and only use them after each loop is ended.
+
+Fixes: f5cedc84a30d ("gve: Add transmit and receive support")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Catherine Sullivan <csully@google.com>
+Cc: Sagi Shahar <sagis@google.com>
+Cc: Jon Olson <jonolson@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: Luigi Rizzo <lrizzo@google.com>
+Cc: Jeroen de Borst <jeroendb@google.com>
+Cc: Tao Liu <xliutaox@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_main.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
+index 22b2c6a8d08f..b658bf9b5399 100644
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -30,6 +30,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
+ {
+ struct gve_priv *priv = netdev_priv(dev);
+ unsigned int start;
++ u64 packets, bytes;
+ int ring;
+
+ if (priv->rx) {
+@@ -37,10 +38,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
+ do {
+ start =
+ u64_stats_fetch_begin(&priv->rx[ring].statss);
+- s->rx_packets += priv->rx[ring].rpackets;
+- s->rx_bytes += priv->rx[ring].rbytes;
++ packets = priv->rx[ring].rpackets;
++ bytes = priv->rx[ring].rbytes;
+ } while (u64_stats_fetch_retry(&priv->rx[ring].statss,
+ start));
++ s->rx_packets += packets;
++ s->rx_bytes += bytes;
+ }
+ }
+ if (priv->tx) {
+@@ -48,10 +51,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
+ do {
+ start =
+ u64_stats_fetch_begin(&priv->tx[ring].statss);
+- s->tx_packets += priv->tx[ring].pkt_done;
+- s->tx_bytes += priv->tx[ring].bytes_done;
++ packets = priv->tx[ring].pkt_done;
++ bytes = priv->tx[ring].bytes_done;
+ } while (u64_stats_fetch_retry(&priv->tx[ring].statss,
+ start));
++ s->tx_packets += packets;
++ s->tx_bytes += bytes;
+ }
+ }
+ }
+--
+2.33.0
+
--- /dev/null
+From 88758989f2586466618bbcd8eb7796fefd279ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 18:01:38 -0700
+Subject: gve: report 64bit tx_bytes counter from gve_handle_report_stats()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 17c37d748f2b122a95b6d0524d410302ff89a2b1 ]
+
+Each tx queue maintains a 64bit counter for bytes, there is
+no reason to truncate this to 32bit (or this has not been
+documented)
+
+Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Yangchun Fu <yangchun@google.com>
+Cc: Kuo Zhao <kuozhao@google.com>
+Cc: David Awogbemila <awogbemila@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
+index b658bf9b5399..fd52218f4884 100644
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -987,9 +987,10 @@ static void gve_handle_reset(struct gve_priv *priv)
+
+ void gve_handle_report_stats(struct gve_priv *priv)
+ {
+- int idx, stats_idx = 0, tx_bytes;
+- unsigned int start = 0;
+ struct stats *stats = priv->stats_report->stats;
++ int idx, stats_idx = 0;
++ unsigned int start = 0;
++ u64 tx_bytes;
+
+ if (!gve_get_report_stats(priv))
+ return;
+--
+2.33.0
+
--- /dev/null
+From 08fac9a650d2c98d1a4684db2b9a88b1d570d46a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 10:54:42 +0200
+Subject: i40e: fix endless loop under rtnl
+
+From: Jiri Benc <jbenc@redhat.com>
+
+[ Upstream commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 ]
+
+The loop in i40e_get_capabilities can never end. The problem is that
+although i40e_aq_discover_capabilities returns with an error if there's
+a firmware problem, the returned error is not checked. There is a check for
+pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most
+firmware problems.
+
+When i40e_aq_discover_capabilities encounters a firmware problem, it will
+encounter the same problem on its next invocation. As the result, the loop
+becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking
+at the code, it can happen with a range of other firmware errors.
+
+I don't know what the correct behavior should be: whether the firmware
+should be retried a few times, or whether pf->hw.aq.asq_last_status should
+be always set to the encountered firmware error (but then it would be
+pointless and can be just replaced by the i40e_aq_discover_capabilities
+return value). However, the current behavior with an endless loop under the
+rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we
+explained the bug to them 7 months ago.
+
+This may not be the best possible fix but it's better than hanging the whole
+system on a firmware bug.
+
+Fixes: 56a62fc86895 ("i40e: init code and hardware support")
+Tested-by: Stefan Assmann <sassmann@redhat.com>
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index bc648ce0743c..0a1eea0846e6 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -9662,7 +9662,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf,
+ if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) {
+ /* retry with a larger buffer */
+ buf_len = data_size;
+- } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) {
++ } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) {
+ dev_info(&pf->pdev->dev,
+ "capability discovery failed, err %s aq_err %s\n",
+ i40e_stat_str(&pf->hw, err),
+--
+2.33.0
+
--- /dev/null
+From a1447948e64aad8fc27f18e71cc7a1e7967caa23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 11:40:41 +0200
+Subject: i40e: Fix freeing of uninitialized misc IRQ vector
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ]
+
+When VSI set up failed in i40e_probe() as part of PF switch set up
+driver was trying to free misc IRQ vectors in
+i40e_clear_interrupt_scheme and produced a kernel Oops:
+
+ Trying to free already-free IRQ 266
+ WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300
+ Workqueue: events work_for_cpu_fn
+ RIP: 0010:__free_irq+0x9a/0x300
+ Call Trace:
+ ? synchronize_irq+0x3a/0xa0
+ free_irq+0x2e/0x60
+ i40e_clear_interrupt_scheme+0x53/0x190 [i40e]
+ i40e_probe.part.108+0x134b/0x1a40 [i40e]
+ ? kmem_cache_alloc+0x158/0x1c0
+ ? acpi_ut_update_ref_count.part.1+0x8e/0x345
+ ? acpi_ut_update_object_reference+0x15e/0x1e2
+ ? strstr+0x21/0x70
+ ? irq_get_irq_data+0xa/0x20
+ ? mp_check_pin_attr+0x13/0xc0
+ ? irq_get_irq_data+0xa/0x20
+ ? mp_map_pin_to_irq+0xd3/0x2f0
+ ? acpi_register_gsi_ioapic+0x93/0x170
+ ? pci_conf1_read+0xa4/0x100
+ ? pci_bus_read_config_word+0x49/0x70
+ ? do_pci_enable_device+0xcc/0x100
+ local_pci_probe+0x41/0x90
+ work_for_cpu_fn+0x16/0x20
+ process_one_work+0x1a7/0x360
+ worker_thread+0x1cf/0x390
+ ? create_worker+0x1a0/0x1a0
+ kthread+0x112/0x130
+ ? kthread_flush_work_fn+0x10/0x10
+ ret_from_fork+0x1f/0x40
+
+The problem is that at that point misc IRQ vectors
+were not allocated yet and we get a call trace
+that driver is trying to free already free IRQ vectors.
+
+Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED
+PF state before calling i40e_free_misc_vector. This state is set only if
+misc IRQ vectors were properly initialized.
+
+Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup")
+Reported-by: PJ Waskiewicz <pwaskiewicz@jumptrading.com>
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 0a1eea0846e6..52c2d6fdeb7a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -4839,7 +4839,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf)
+ {
+ int i;
+
+- i40e_free_misc_vector(pf);
++ if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state))
++ i40e_free_misc_vector(pf);
+
+ i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector,
+ I40E_IWARP_IRQ_PILE_ID);
+--
+2.33.0
+
--- /dev/null
+From cb609e2db0131861f0ed0531a3a50b91906426e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 15:21:54 +0300
+Subject: iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit fe5c735d0d47b495be6753d6aea4f8f78c909a0a ]
+
+There is a Killer AX1650 2x2 Wi-Fi 6 and Bluetooth 5.1 wireless adapter
+found on Dell XPS 15 (9510) laptop, its configuration was present on
+Linux v5.7, however accidentally it has been removed from the list of
+supported devices, let's add it back.
+
+The problem is manifested on driver initialization:
+
+ Intel(R) Wireless WiFi driver for Linux
+ iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
+ iwlwifi: No config found for PCI dev 43f0/1651, rev=0x354, rfid=0x10a100
+ iwlwifi: probe of 0000:00:14.3 failed with error -22
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=213939
+Fixes: 3f910a25839b ("iwlwifi: pcie: convert all AX101 devices to the device tables")
+Cc: Julien Wajsberg <felash@gmail.com>
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Acked-by: Luca Coelho <luca@coelho.fi>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210924122154.2376577-1-vladimir.zapolskiy@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 90b12e201795..4e43efd5d1ea 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -635,6 +635,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
+ IWL_DEV_INFO(0x43F0, 0x0074, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0x43F0, 0x0078, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0x43F0, 0x007C, iwl_ax201_cfg_qu_hr, NULL),
++ IWL_DEV_INFO(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name),
++ IWL_DEV_INFO(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name),
+ IWL_DEV_INFO(0x43F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0x43F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL),
+ IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL),
+--
+2.33.0
+
--- /dev/null
+From a4c6b83499f8783542494d1efdc9b6eb42e88e68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 18:05:08 -0700
+Subject: net: bridge: fix under estimation in br_get_linkxstats_size()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0854a0513321cf70bea5fa483ebcaa983cc7c62e ]
+
+Commit de1799667b00 ("net: bridge: add STP xstats")
+added an additional nla_reserve_64bit() in br_fill_linkxstats(),
+but forgot to update br_get_linkxstats_size() accordingly.
+
+This can trigger the following in rtnl_stats_get()
+
+ WARN_ON(err == -EMSGSIZE);
+
+Fixes: de1799667b00 ("net: bridge: add STP xstats")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Vivien Didelot <vivien.didelot@gmail.com>
+Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
+Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_netlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index bfe6ab1914c8..31b00ba5dcc8 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -1591,6 +1591,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
+
+ return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
+ nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
++ (p ? nla_total_size_64bit(sizeof(p->stp_xstats)) : 0) +
+ nla_total_size(0);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From a9f39705140a7a0c0e452e724b24dc5dfa77376c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 18:05:07 -0700
+Subject: net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ]
+
+bridge_fill_linkxstats() is using nla_reserve_64bit().
+
+We must use nla_total_size_64bit() instead of nla_total_size()
+for corresponding data structure.
+
+Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
+Cc: Vivien Didelot <vivien.didelot@gmail.com>
+Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index 73f71c22f4c0..bfe6ab1914c8 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -1590,7 +1590,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
+ }
+
+ return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
+- nla_total_size(sizeof(struct br_mcast_stats)) +
++ nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
+ nla_total_size(0);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 8c7b2e5e59101927fa6d2031f1065fb5c4855d2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 17:57:47 +0300
+Subject: net/mlx5: E-Switch, Fix double allocation of acl flow counter
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit a586775f83bd729ad60b56352dbe067f4bb0beee ]
+
+Flow counter is allocated in eswitch legacy acl setting functions
+without checking if already allocated by previous setting. Add a check
+to avoid such double allocation.
+
+Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes")
+Fixes: ea651a86d468 ("net/mlx5: E-Switch, Refactor eswitch egress acl codes")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/esw/acl/egress_lgcy.c | 12 ++++++++----
+ .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 4 +++-
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
+index 3e19b1721303..b00c7d47833f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
+@@ -79,12 +79,16 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw,
+ int dest_num = 0;
+ int err = 0;
+
+- if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) {
++ if (vport->egress.legacy.drop_counter) {
++ drop_counter = vport->egress.legacy.drop_counter;
++ } else if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) {
+ drop_counter = mlx5_fc_create(esw->dev, false);
+- if (IS_ERR(drop_counter))
++ if (IS_ERR(drop_counter)) {
+ esw_warn(esw->dev,
+ "vport[%d] configure egress drop rule counter err(%ld)\n",
+ vport->vport, PTR_ERR(drop_counter));
++ drop_counter = NULL;
++ }
+ vport->egress.legacy.drop_counter = drop_counter;
+ }
+
+@@ -123,7 +127,7 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw,
+ flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP;
+
+ /* Attach egress drop flow counter */
+- if (!IS_ERR_OR_NULL(drop_counter)) {
++ if (drop_counter) {
+ flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_COUNT;
+ drop_ctr_dst.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
+ drop_ctr_dst.counter_id = mlx5_fc_id(drop_counter);
+@@ -162,7 +166,7 @@ void esw_acl_egress_lgcy_cleanup(struct mlx5_eswitch *esw,
+ esw_acl_egress_table_destroy(vport);
+
+ clean_drop_counter:
+- if (!IS_ERR_OR_NULL(vport->egress.legacy.drop_counter)) {
++ if (vport->egress.legacy.drop_counter) {
+ mlx5_fc_destroy(esw->dev, vport->egress.legacy.drop_counter);
+ vport->egress.legacy.drop_counter = NULL;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
+index d64fad2823e7..45570d0a58d2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
+@@ -160,7 +160,9 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,
+
+ esw_acl_ingress_lgcy_rules_destroy(vport);
+
+- if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) {
++ if (vport->ingress.legacy.drop_counter) {
++ counter = vport->ingress.legacy.drop_counter;
++ } else if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) {
+ counter = mlx5_fc_create(esw->dev, false);
+ if (IS_ERR(counter)) {
+ esw_warn(esw->dev,
+--
+2.33.0
+
--- /dev/null
+From 781e3d6942d2dd2cfb1b06d387f76566f8db36a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 17:07:17 +0300
+Subject: net/mlx5e: IPSEC RX, enable checksum complete
+
+From: Raed Salem <raeds@nvidia.com>
+
+[ Upstream commit f9a10440f0b1f33faa792af26f4e9823a9b8b6a4 ]
+
+Currently in Rx data path IPsec crypto offloaded packets uses
+csum_none flag, so checksum is handled by the stack, this naturally
+have some performance/cpu utilization impact on such flows. As Nvidia
+NIC starting from ConnectX6DX provides checksum complete value out of
+the box also for such flows there is no sense in taking csum_none path,
+furthermore the stack (xfrm) have the method to handle checksum complete
+corrections for such flows i.e. IPsec trailer removal and consequently
+checksum value adjustment.
+
+Because of the above and in addition the ConnectX6DX is the first HW
+which supports IPsec crypto offload then it is safe to report csum
+complete for IPsec offloaded traffic.
+
+Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload")
+Signed-off-by: Raed Salem <raeds@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index f327b78261ec..117a59341453 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -999,14 +999,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ goto csum_unnecessary;
+
+ if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
+- u8 ipproto = get_ip_proto(skb, network_depth, proto);
+-
+- if (unlikely(ipproto == IPPROTO_SCTP))
++ if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
+ goto csum_unnecessary;
+
+- if (unlikely(mlx5_ipsec_is_rx_flow(cqe)))
+- goto csum_none;
+-
+ stats->csum_complete++;
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
+--
+2.33.0
+
--- /dev/null
+From 74ff364e6f25bd036fbc1693a86d1179f06e1322 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 14:03:42 +0100
+Subject: net: prefer socket bound to interface when not in VRF
+
+From: Mike Manning <mvrmanning@gmail.com>
+
+[ Upstream commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a ]
+
+The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be
+chosen when not in a VRF") modified compute_score() so that a device
+match is always made, not just in the case of an l3mdev skb, then
+increments the score also for unbound sockets. This ensures that
+sockets bound to an l3mdev are never selected when not in a VRF.
+But as unbound and bound sockets are now scored equally, this results
+in the last opened socket being selected if there are matches in the
+default VRF for an unbound socket and a socket bound to a dev that is
+not an l3mdev. However, handling prior to this commit was to always
+select the bound socket in this case. Reinstate this handling by
+incrementing the score only for bound sockets. The required isolation
+due to choosing between an unbound socket and a socket bound to an
+l3mdev remains in place due to the device match always being made.
+The same approach is taken for compute_score() for stream sockets.
+
+Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF")
+Fixes: e78190581aff ("net: ensure unbound stream socket to be chosen when not in a VRF")
+Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_hashtables.c | 4 +++-
+ net/ipv4/udp.c | 3 ++-
+ net/ipv6/inet6_hashtables.c | 2 +-
+ net/ipv6/udp.c | 3 ++-
+ 4 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 45fb450b4522..f3fd5c911ed0 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -242,8 +242,10 @@ static inline int compute_score(struct sock *sk, struct net *net,
+
+ if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
+ return -1;
++ score = sk->sk_bound_dev_if ? 2 : 1;
+
+- score = sk->sk_family == PF_INET ? 2 : 1;
++ if (sk->sk_family == PF_INET)
++ score++;
+ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+ }
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index bd7fd9b1f24c..655f0d8a13d3 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -390,7 +390,8 @@ static int compute_score(struct sock *sk, struct net *net,
+ dif, sdif);
+ if (!dev_match)
+ return -1;
+- score += 4;
++ if (sk->sk_bound_dev_if)
++ score += 4;
+
+ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
+index 55c290d55605..67c9114835c8 100644
+--- a/net/ipv6/inet6_hashtables.c
++++ b/net/ipv6/inet6_hashtables.c
+@@ -106,7 +106,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
+ if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
+ return -1;
+
+- score = 1;
++ score = sk->sk_bound_dev_if ? 2 : 1;
+ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 1943ae5103eb..bae6b51a9bd4 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -133,7 +133,8 @@ static int compute_score(struct sock *sk, struct net *net,
+ dev_match = udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif);
+ if (!dev_match)
+ return -1;
+- score++;
++ if (sk->sk_bound_dev_if)
++ score++;
+
+ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+--
+2.33.0
+
--- /dev/null
+From c3e15489bfba94522f6a5f75128035f13d6db9e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 12:55:22 -0700
+Subject: net/sched: sch_taprio: properly cancel timer from taprio_destroy()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 ]
+
+There is a comment in qdisc_create() about us not calling ops->reset()
+in some cases.
+
+err_out4:
+ /*
+ * Any broken qdiscs that would require a ops->reset() here?
+ * The qdisc was never in action so it shouldn't be necessary.
+ */
+
+As taprio sets a timer before actually receiving a packet, we need
+to cancel it from ops->destroy, just in case ops->reset has not
+been called.
+
+syzbot reported:
+
+ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22
+WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505
+Modules linked in:
+CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505
+Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
+RSP: 0018:ffffc9000130f330 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
+RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58
+RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
+R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020
+R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000
+FS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ __debug_check_no_obj_freed lib/debugobjects.c:987 [inline]
+ debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018
+ slab_free_hook mm/slub.c:1603 [inline]
+ slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653
+ slab_free mm/slub.c:3213 [inline]
+ kfree+0xe4/0x540 mm/slub.c:4267
+ qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299
+ tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663
+ rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
+ netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
+ netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
+ netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
+ sock_sendmsg_nosec net/socket.c:704 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:724
+ ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2457
+ __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+
+Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Davide Caratti <dcaratti@redhat.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Acked-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_taprio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
+index cb5e5220da55..93899559ba6d 100644
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1630,6 +1630,10 @@ static void taprio_destroy(struct Qdisc *sch)
+ list_del(&q->taprio_list);
+ spin_unlock(&taprio_list_lock);
+
++ /* Note that taprio_reset() might not be called if an error
++ * happens in qdisc_create(), after taprio_init() has been called.
++ */
++ hrtimer_cancel(&q->advance_timer);
+
+ taprio_disable_offload(dev, q, NULL);
+
+--
+2.33.0
+
--- /dev/null
+From f2124b67854d4edeb42840cc239cfeb799bd9e32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 17:50:02 -0400
+Subject: net: sfp: Fix typo in state machine debug string
+
+From: Sean Anderson <sean.anderson@seco.com>
+
+[ Upstream commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 ]
+
+The string should be "tx_disable" to match the state enum.
+
+Fixes: 4005a7cb4f55 ("net: phy: sftp: print debug message with text, not numbers")
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 2fff62695455..32c34c728c7a 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -133,7 +133,7 @@ static const char * const sm_state_strings[] = {
+ [SFP_S_LINK_UP] = "link_up",
+ [SFP_S_TX_FAULT] = "tx_fault",
+ [SFP_S_REINIT] = "reinit",
+- [SFP_S_TX_DISABLE] = "rx_disable",
++ [SFP_S_TX_DISABLE] = "tx_disable",
+ };
+
+ static const char *sm_state_to_str(unsigned short sm_state)
+--
+2.33.0
+
--- /dev/null
+From f01469027834bd0973ec77d9597f893349a2776e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 14:22:39 -0700
+Subject: net_sched: fix NULL deref in fifo_set_limit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc ]
+
+syzbot reported another NULL deref in fifo_set_limit() [1]
+
+I could repro the issue with :
+
+unshare -n
+tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit
+tc qd replace dev lo parent 1:0 pfifo_fast
+tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit
+
+pfifo_fast does not have a change() operation.
+Make fifo_set_limit() more robust about this.
+
+[1]
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0
+Oops: 0010 [#1] PREEMPT SMP KASAN
+CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+RIP: 0010:0x0
+Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
+RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246
+RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000
+RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947
+R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910
+R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800
+FS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ fifo_set_limit net/sched/sch_fifo.c:242 [inline]
+ fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227
+ tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418
+ qdisc_change net/sched/sch_api.c:1332 [inline]
+ tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634
+ rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
+ netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
+ netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
+ netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
+ sock_sendmsg_nosec net/socket.c:704 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:724
+ ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
+ __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: fb0305ce1b03 ("net-sched: consolidate default fifo qdisc setup")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Link: https://lore.kernel.org/r/20210930212239.3430364-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_fifo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
+index a579a4131d22..e1040421b797 100644
+--- a/net/sched/sch_fifo.c
++++ b/net/sched/sch_fifo.c
+@@ -233,6 +233,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit)
+ if (strncmp(q->ops->id + 1, "fifo", 4) != 0)
+ return 0;
+
++ if (!q->ops->change)
++ return 0;
++
+ nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
+ if (nla) {
+ nla->nla_type = RTM_NEWQDISC;
+--
+2.33.0
+
--- /dev/null
+From 73a023f3eb633bdce8c3d516cce0e5565d2436a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 14:24:15 -0700
+Subject: netlink: annotate data races around nlk->bound
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7707a4d01a648e4c655101a469c956cb11273655 ]
+
+While existing code is correct, KCSAN is reporting
+a data-race in netlink_insert / netlink_sendmsg [1]
+
+It is correct to read nlk->bound without a lock, as netlink_autobind()
+will acquire all needed locks.
+
+[1]
+BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg
+
+write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0:
+ netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597
+ netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842
+ netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892
+ sock_sendmsg_nosec net/socket.c:703 [inline]
+ sock_sendmsg net/socket.c:723 [inline]
+ ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392
+ ___sys_sendmsg net/socket.c:2446 [inline]
+ __sys_sendmsg+0x1ed/0x270 net/socket.c:2475
+ __do_sys_sendmsg net/socket.c:2484 [inline]
+ __se_sys_sendmsg net/socket.c:2482 [inline]
+ __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1:
+ netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891
+ sock_sendmsg_nosec net/socket.c:703 [inline]
+ sock_sendmsg net/socket.c:723 [inline]
+ __sys_sendto+0x2a8/0x370 net/socket.c:2019
+ __do_sys_sendto net/socket.c:2031 [inline]
+ __se_sys_sendto net/socket.c:2027 [inline]
+ __x64_sys_sendto+0x74/0x90 net/socket.c:2027
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: da314c9923fe ("netlink: Replace rhash_portid with bound")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 8434da3c0487..0886267ea81e 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -586,7 +586,10 @@ static int netlink_insert(struct sock *sk, u32 portid)
+
+ /* We need to ensure that the socket is hashed and visible. */
+ smp_wmb();
+- nlk_sk(sk)->bound = portid;
++ /* Paired with lockless reads from netlink_bind(),
++ * netlink_connect() and netlink_sendmsg().
++ */
++ WRITE_ONCE(nlk_sk(sk)->bound, portid);
+
+ err:
+ release_sock(sk);
+@@ -1004,7 +1007,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ if (nlk->ngroups < BITS_PER_LONG)
+ groups &= (1UL << nlk->ngroups) - 1;
+
+- bound = nlk->bound;
++ /* Paired with WRITE_ONCE() in netlink_insert() */
++ bound = READ_ONCE(nlk->bound);
+ if (bound) {
+ /* Ensure nlk->portid is up-to-date. */
+ smp_rmb();
+@@ -1090,8 +1094,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
+
+ /* No need for barriers here as we return to user-space without
+ * using any of the bound attributes.
++ * Paired with WRITE_ONCE() in netlink_insert().
+ */
+- if (!nlk->bound)
++ if (!READ_ONCE(nlk->bound))
+ err = netlink_autobind(sock);
+
+ if (err == 0) {
+@@ -1880,7 +1885,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ dst_group = nlk->dst_group;
+ }
+
+- if (!nlk->bound) {
++ /* Paired with WRITE_ONCE() in netlink_insert() */
++ if (!READ_ONCE(nlk->bound)) {
+ err = netlink_autobind(sock);
+ if (err)
+ goto out;
+--
+2.33.0
+
--- /dev/null
+From 0dc92836e430af112273f3c70465a96f3b57a0b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 16:13:27 -0700
+Subject: PCI: hv: Fix sleep while in non-sleep context when removing child
+ devices from the bus
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit 41608b64b10b80fe00dd253cd8326ec8ad85930f ]
+
+In hv_pci_bus_exit, the code is holding a spinlock while calling
+pci_destroy_slot(), which takes a mutex.
+
+This is not safe for spinlock. Fix this by moving the children to be
+deleted to a list on the stack, and removing them after spinlock is
+released.
+
+Fixes: 94d22763207a ("PCI: hv: Fix a race condition when removing the device")
+
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Wei Liu <wei.liu@kernel.org>
+Cc: Dexuan Cui <decui@microsoft.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Rob Herring <robh@kernel.org>
+Cc: "Krzysztof Wilczyński" <kw@linux.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Michael Kelley <mikelley@microsoft.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/linux-hyperv/20210823152130.GA21501@kili/
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: Wei Liu <wei.liu@kernel.org>
+Link: https://lore.kernel.org/r/1630365207-20616-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-hyperv.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 44e15f0e3a2e..ad3e3cde1c20 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -3259,9 +3259,17 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)
+ return 0;
+
+ if (!keep_devs) {
+- /* Delete any children which might still exist. */
++ struct list_head removed;
++
++ /* Move all present children to the list on stack */
++ INIT_LIST_HEAD(&removed);
+ spin_lock_irqsave(&hbus->device_list_lock, flags);
+- list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry) {
++ list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry)
++ list_move_tail(&hpdev->list_entry, &removed);
++ spin_unlock_irqrestore(&hbus->device_list_lock, flags);
++
++ /* Remove all children in the list */
++ list_for_each_entry_safe(hpdev, tmp, &removed, list_entry) {
+ list_del(&hpdev->list_entry);
+ if (hpdev->pci_slot)
+ pci_destroy_slot(hpdev->pci_slot);
+@@ -3269,7 +3277,6 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)
+ put_pcichild(hpdev);
+ put_pcichild(hpdev);
+ }
+- spin_unlock_irqrestore(&hbus->device_list_lock, flags);
+ }
+
+ ret = hv_send_resources_released(hdev);
+--
+2.33.0
+
--- /dev/null
+From 0c4a177970c0dfe7742bf860b5a6d90010e8f8fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Sep 2021 18:29:38 +0800
+Subject: perf jevents: Free the sys_event_tables list after processing entries
+
+From: Like Xu <likexu@tencent.com>
+
+[ Upstream commit b94729919db2c6737501c36ea6526a36d5d63fa2 ]
+
+The compiler reports that free_sys_event_tables() is dead code.
+
+But according to the semantics, the "LIST_HEAD(sys_event_tables)" should
+also be released, just like we do with 'arch_std_events' in main().
+
+Fixes: e9d32c1bf0cd7a98 ("perf vendor events: Add support for arch standard events")
+Signed-off-by: Like Xu <likexu@tencent.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210928102938.69681-1-likexu@tencent.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/jevents.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index c679a79aef51..66ded0f9e85d 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -1185,6 +1185,7 @@ int main(int argc, char *argv[])
+ }
+
+ free_arch_std_events();
++ free_sys_event_tables();
+ free(mapfile);
+ return 0;
+
+@@ -1206,6 +1207,7 @@ err_close_eventsfp:
+ create_empty_mapping(output_file);
+ err_out:
+ free_arch_std_events();
++ free_sys_event_tables();
+ free(mapfile);
+ return ret;
+ }
+--
+2.33.0
+
--- /dev/null
+From 9e9c0d137602f74c0e76f01156a8bce0a2df6c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 19:02:26 +0800
+Subject: perf jevents: Tidy error handling
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit fa1b41a74d1136cbdd6960f36d7b9c7aa35c8139 ]
+
+There is much duplication in the error handling for directory transvering
+for prcessing JSONs.
+
+Factor out the common code to tidy a bit.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-By: Kajol Jain<kjain@linux.ibm.com>
+Link: https://lore.kernel.org/r/1603364547-197086-2-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/jevents.c | 83 ++++++++++++++-------------------
+ 1 file changed, 35 insertions(+), 48 deletions(-)
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index dcfdf6a322dc..c679a79aef51 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -1100,12 +1100,13 @@ static int process_one_file(const char *fpath, const struct stat *sb,
+ */
+ int main(int argc, char *argv[])
+ {
+- int rc, ret = 0;
++ int rc, ret = 0, empty_map = 0;
+ int maxfds;
+ char ldirname[PATH_MAX];
+ const char *arch;
+ const char *output_file;
+ const char *start_dirname;
++ char *err_string_ext = "";
+ struct stat stbuf;
+
+ prog = basename(argv[0]);
+@@ -1133,7 +1134,8 @@ int main(int argc, char *argv[])
+ /* If architecture does not have any event lists, bail out */
+ if (stat(ldirname, &stbuf) < 0) {
+ pr_info("%s: Arch %s has no PMU event lists\n", prog, arch);
+- goto empty_map;
++ empty_map = 1;
++ goto err_close_eventsfp;
+ }
+
+ /* Include pmu-events.h first */
+@@ -1150,75 +1152,60 @@ int main(int argc, char *argv[])
+ */
+
+ maxfds = get_maxfds();
+- mapfile = NULL;
+ rc = nftw(ldirname, preprocess_arch_std_files, maxfds, 0);
+- if (rc && verbose) {
+- pr_info("%s: Error preprocessing arch standard files %s\n",
+- prog, ldirname);
+- goto empty_map;
+- } else if (rc < 0) {
+- /* Make build fail */
+- fclose(eventsfp);
+- free_arch_std_events();
+- return 1;
+- } else if (rc) {
+- goto empty_map;
+- }
++ if (rc)
++ goto err_processing_std_arch_event_dir;
+
+ rc = nftw(ldirname, process_one_file, maxfds, 0);
+- if (rc && verbose) {
+- pr_info("%s: Error walking file tree %s\n", prog, ldirname);
+- goto empty_map;
+- } else if (rc < 0) {
+- /* Make build fail */
+- fclose(eventsfp);
+- free_arch_std_events();
+- ret = 1;
+- goto out_free_mapfile;
+- } else if (rc) {
+- goto empty_map;
+- }
++ if (rc)
++ goto err_processing_dir;
+
+ sprintf(ldirname, "%s/test", start_dirname);
+
+ rc = nftw(ldirname, process_one_file, maxfds, 0);
+- if (rc && verbose) {
+- pr_info("%s: Error walking file tree %s rc=%d for test\n",
+- prog, ldirname, rc);
+- goto empty_map;
+- } else if (rc < 0) {
+- /* Make build fail */
+- free_arch_std_events();
+- ret = 1;
+- goto out_free_mapfile;
+- } else if (rc) {
+- goto empty_map;
+- }
++ if (rc)
++ goto err_processing_dir;
+
+ if (close_table)
+ print_events_table_suffix(eventsfp);
+
+ if (!mapfile) {
+ pr_info("%s: No CPU->JSON mapping?\n", prog);
+- goto empty_map;
++ empty_map = 1;
++ goto err_close_eventsfp;
+ }
+
+- if (process_mapfile(eventsfp, mapfile)) {
++ rc = process_mapfile(eventsfp, mapfile);
++ fclose(eventsfp);
++ if (rc) {
+ pr_info("%s: Error processing mapfile %s\n", prog, mapfile);
+ /* Make build fail */
+- fclose(eventsfp);
+- free_arch_std_events();
+ ret = 1;
++ goto err_out;
+ }
+
++ free_arch_std_events();
++ free(mapfile);
++ return 0;
+
+- goto out_free_mapfile;
+-
+-empty_map:
++err_processing_std_arch_event_dir:
++ err_string_ext = " for std arch event";
++err_processing_dir:
++ if (verbose) {
++ pr_info("%s: Error walking file tree %s%s\n", prog, ldirname,
++ err_string_ext);
++ empty_map = 1;
++ } else if (rc < 0) {
++ ret = 1;
++ } else {
++ empty_map = 1;
++ }
++err_close_eventsfp:
+ fclose(eventsfp);
+- create_empty_mapping(output_file);
++ if (empty_map)
++ create_empty_mapping(output_file);
++err_out:
+ free_arch_std_events();
+-out_free_mapfile:
+ free(mapfile);
+ return ret;
+ }
+--
+2.33.0
+
--- /dev/null
+From d0137c91479f9adc0a5c86cba28a48aaecbd5b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 20:50:28 +0300
+Subject: phy: mdio: fix memory leak
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit ca6e11c337daf7925ff8a2aac8e84490a8691905 ]
+
+Syzbot reported memory leak in MDIO bus interface, the problem was in
+wrong state logic.
+
+MDIOBUS_ALLOCATED indicates 2 states:
+ 1. Bus is only allocated
+ 2. Bus allocated and __mdiobus_register() fails, but
+ device_register() was called
+
+In case of device_register() has been called we should call put_device()
+to correctly free the memory allocated for this device, but mdiobus_free()
+calls just kfree(dev) in case of MDIOBUS_ALLOCATED state
+
+To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED
+_before_ calling device_register(), because put_device() should be
+called even in case of device_register() failure.
+
+Link: https://lore.kernel.org/netdev/YVMRWNDZDUOvQjHL@shell.armlinux.org.uk/
+Fixes: 46abc02175b3 ("phylib: give mdio buses a device tree presence")
+Reported-and-tested-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/eceae1429fbf8fa5c73dd2a0d39d525aa905074d.1633024062.git.paskripkin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio_bus.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index b848439fa837..2645ca35103c 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -534,6 +534,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ bus->dev.groups = NULL;
+ dev_set_name(&bus->dev, "%s", bus->id);
+
++ /* We need to set state to MDIOBUS_UNREGISTERED to correctly release
++ * the device in mdiobus_free()
++ *
++ * State will be updated later in this function in case of success
++ */
++ bus->state = MDIOBUS_UNREGISTERED;
++
+ err = device_register(&bus->dev);
+ if (err) {
+ pr_err("mii_bus %s failed to register\n", bus->id);
+--
+2.33.0
+
--- /dev/null
+From 8fe51bf0ea7d230fb9edfe0e621f2ea6280188de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Oct 2021 11:04:09 +0200
+Subject: powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 ]
+
+Property phy-connection-type contains invalid value "sgmii-2500" per scheme
+defined in file ethernet-controller.yaml.
+
+Correct phy-connection-type value should be "2500base-x".
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 84e0f1c13806 ("powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)")
+Acked-by: Scott Wood <oss@buserror.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
+index 5ba6fbfca274..f82f85c65964 100644
+--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts
++++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
+@@ -154,7 +154,7 @@
+
+ fm1mac3: ethernet@e4000 {
+ phy-handle = <&sgmii_aqr_phy3>;
+- phy-connection-type = "sgmii-2500";
++ phy-connection-type = "2500base-x";
+ sleep = <&rcpm 0x20000000>;
+ };
+
+--
+2.33.0
+
--- /dev/null
+From dcb58b92bd7205d7c4c1bbb81d34de81990996cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Oct 2021 19:20:33 +0300
+Subject: ptp_pch: Load module automatically if ID matches
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b ]
+
+The driver can't be loaded automatically because it misses
+module alias to be provided. Add corresponding MODULE_DEVICE_TABLE()
+call to the driver.
+
+Fixes: 863d08ece9bf ("supports eg20t ptp clock")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_pch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
+index ce10ecd41ba0..9492ed09518f 100644
+--- a/drivers/ptp/ptp_pch.c
++++ b/drivers/ptp/ptp_pch.c
+@@ -651,6 +651,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = {
+ },
+ {0}
+ };
++MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id);
+
+ static SIMPLE_DEV_PM_OPS(pch_pm_ops, pch_suspend, pch_resume);
+
+--
+2.33.0
+
--- /dev/null
+From 31b989e42cd9d73512c32ce7ef064e28f9793b3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 14:04:17 -0700
+Subject: rtnetlink: fix if_nlmsg_stats_size() under estimation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ]
+
+rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure.
+
+nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags);
+
+But if_nlmsg_stats_size() never considered the needed storage.
+
+This bug did not show up because alloc_skb(X) allocates skb with
+extra tailroom, because of added alignments. This could very well
+be changed in the future to have deterministic behavior.
+
+Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Roopa Prabhu <roopa@nvidia.com>
+Acked-by: Roopa Prabhu <roopa@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 7266571d5c7e..27ffa83ffeb3 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -5257,7 +5257,7 @@ nla_put_failure:
+ static size_t if_nlmsg_stats_size(const struct net_device *dev,
+ u32 filter_mask)
+ {
+- size_t size = 0;
++ size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg));
+
+ if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0))
+ size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64));
+--
+2.33.0
+
arm-dts-imx6dl-yapp4-fix-lp5562-led-driver-probe.patch
arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch
riscv-flush-current-cpu-icache-before-other-cpus.patch
+bus-ti-sysc-add-break-in-switch-statement-in-sysc_in.patch
+soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch
+arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch
+arm-at91-pm-do-not-panic-if-ram-controllers-are-not-.patch
+soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch
+arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch
+arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch
+arm-dts-imx6qdl-pico-fix-ethernet-support.patch
+pci-hv-fix-sleep-while-in-non-sleep-context-when-rem.patch
+ath5k-fix-building-with-leds-m.patch
+arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch
+xtensa-use-config_use_of-instead-of-config_of.patch
+xtensa-call-irqchip_init-only-when-config_use_of-is-.patch
+iwlwifi-pcie-add-configuration-of-a-wi-fi-adapter-on.patch
+bpf-arm-fix-register-clobbering-in-div-mod-implement.patch
+soc-ti-omap-prm-fix-external-abort-for-am335x-pruss.patch
+bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch
+net-mlx5e-ipsec-rx-enable-checksum-complete.patch
+net-mlx5-e-switch-fix-double-allocation-of-acl-flow-.patch
+phy-mdio-fix-memory-leak.patch
+net_sched-fix-null-deref-in-fifo_set_limit.patch
+powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch
+ptp_pch-load-module-automatically-if-id-matches.patch
+arm64-dts-ls1028a-add-missing-can-nodes.patch
+dt-bindings-drm-bridge-ti-sn65dsi86-fix-reg-value.patch
+arm-imx6-disable-the-gic-cpu-interface-before-callin.patch
+net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch
+net-bridge-fix-under-estimation-in-br_get_linkxstats.patch
+net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch
+net-sfp-fix-typo-in-state-machine-debug-string.patch
+netlink-annotate-data-races-around-nlk-bound.patch
+perf-jevents-tidy-error-handling.patch
+perf-jevents-free-the-sys_event_tables-list-after-pr.patch
+bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch
+drm-sun4i-dw-hdmi-fix-hdmi-phy-clock-setup.patch
+video-fbdev-gbefb-only-instantiate-device-when-built.patch
+drm-nouveau-avoid-a-use-after-free-when-bo-init-fail.patch
+drm-nouveau-kms-nv50-fix-file-release-memory-leak.patch
+drm-nouveau-debugfs-fix-file-release-memory-leak.patch
+gve-correct-available-tx-qpl-check.patch
+gve-avoid-freeing-null-pointer.patch
+rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch
+gve-fix-gve_get_stats.patch
+gve-report-64bit-tx_bytes-counter-from-gve_handle_re.patch
+i40e-fix-endless-loop-under-rtnl.patch
+i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch
+net-prefer-socket-bound-to-interface-when-not-in-vrf.patch
--- /dev/null
+From 3f6c781f414614d51caf46701162fab31e4f2605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Aug 2021 15:02:02 +0800
+Subject: soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ]
+
+PT_LOAD type denotes that the segment should be loaded into the final
+firmware memory region. Hash segment is not one such, because it's only
+needed for PAS init and shouldn't be in the final firmware memory region.
+That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and
+hash segment. This actually makes the hash segment type check in
+qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment,
+it won't be loaded into firmware memory region anyway, due to the
+QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD
+type for some reason (misusing or abusing?).
+
+Some firmware files on Sony phones are such examples, e.g WCNSS firmware
+of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD.
+Drop the unnecessary hash segment type check in qcom_mdt_read_metadata()
+to fix firmware loading failure on these phones, while hash segment is
+still kept away from the final firmware memory region.
+
+Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images")
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index eba7f76f9d61..6034cd8992b0 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -98,7 +98,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
+ if (ehdr->e_phnum < 2)
+ return ERR_PTR(-EINVAL);
+
+- if (phdrs[0].p_type == PT_LOAD || phdrs[1].p_type == PT_LOAD)
++ if (phdrs[0].p_type == PT_LOAD)
+ return ERR_PTR(-EINVAL);
+
+ if ((phdrs[1].p_flags & QCOM_MDT_TYPE_MASK) != QCOM_MDT_TYPE_HASH)
+--
+2.33.0
+
--- /dev/null
+From b50dcca5b7f56967ed552f22451fdb8fb498f580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 17:24:39 -0700
+Subject: soc: qcom: socinfo: Fixed argument passed to platform_set_data()
+
+From: Antonio Martorana <amartora@codeaurora.org>
+
+[ Upstream commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 ]
+
+Set qcom_socinfo pointer as data being stored instead of pointer
+to soc_device structure. Aligns with future calls to platform_get_data()
+which expects qcom_socinfo pointer.
+
+Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
+Signed-off-by: Antonio Martorana <amartora@codeaurora.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/1629159879-95777-1-git-send-email-amartora@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/socinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
+index e0620416e574..60c82dcaa8d1 100644
+--- a/drivers/soc/qcom/socinfo.c
++++ b/drivers/soc/qcom/socinfo.c
+@@ -521,7 +521,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev)
+ /* Feed the soc specific unique data into entropy pool */
+ add_device_randomness(info, item_size);
+
+- platform_set_drvdata(pdev, qs->soc_dev);
++ platform_set_drvdata(pdev, qs);
+
+ return 0;
+ }
+--
+2.33.0
+
--- /dev/null
+From 79afff3561635cbbfe6a3f1fcab891a9d93436a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 11:30:03 +0300
+Subject: soc: ti: omap-prm: Fix external abort for am335x pruss
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit b232537074fcaf0c2837abbb217429c097bb7598 ]
+
+Starting with v5.15-rc1, we may now see some am335x beaglebone black
+device produce the following error on pruss probe:
+
+Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000
+
+This has started with the enabling of pruss for am335x in the dts files.
+
+Turns out the is caused by the PRM reset handling not waiting for the
+reset bit to clear. To fix the issue, let's always wait for the reset
+bit to clear, even if there is a separate reset status register.
+
+We attempted to fix a similar issue for dra7 iva with a udelay() in
+commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset
+deassert for dra7 iva"). There is no longer a need for the udelay()
+for dra7 iva reset either with the check added for reset bit clearing.
+
+Cc: Drew Fustini <pdp7pdp7@gmail.com>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: "H. Nikolaus Schaller" <hns@goldelico.com>
+Cc: Robert Nelson <robertcnelson@gmail.com>
+Cc: Yongqin Liu <yongqin.liu@linaro.org>
+Fixes: effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva")
+Reported-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Tested-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/omap_prm.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
+index fb067b5e4a97..4a782bfd753c 100644
+--- a/drivers/soc/ti/omap_prm.c
++++ b/drivers/soc/ti/omap_prm.c
+@@ -509,25 +509,28 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,
+ writel_relaxed(v, reset->prm->base + reset->prm->data->rstctrl);
+ spin_unlock_irqrestore(&reset->lock, flags);
+
+- if (!has_rstst)
+- goto exit;
++ /* wait for the reset bit to clear */
++ ret = readl_relaxed_poll_timeout_atomic(reset->prm->base +
++ reset->prm->data->rstctrl,
++ v, !(v & BIT(id)), 1,
++ OMAP_RESET_MAX_WAIT);
++ if (ret)
++ pr_err("%s: timedout waiting for %s:%lu\n", __func__,
++ reset->prm->data->name, id);
+
+ /* wait for the status to be set */
+- ret = readl_relaxed_poll_timeout_atomic(reset->prm->base +
++ if (has_rstst) {
++ ret = readl_relaxed_poll_timeout_atomic(reset->prm->base +
+ reset->prm->data->rstst,
+ v, v & BIT(st_bit), 1,
+ OMAP_RESET_MAX_WAIT);
+- if (ret)
+- pr_err("%s: timedout waiting for %s:%lu\n", __func__,
+- reset->prm->data->name, id);
++ if (ret)
++ pr_err("%s: timedout waiting for %s:%lu\n", __func__,
++ reset->prm->data->name, id);
++ }
+
+-exit:
+- if (reset->clkdm) {
+- /* At least dra7 iva needs a delay before clkdm idle */
+- if (has_rstst)
+- udelay(1);
++ if (reset->clkdm)
+ pdata->clkdm_allow_idle(reset->clkdm);
+- }
+
+ return ret;
+ }
+--
+2.33.0
+
--- /dev/null
+From 12e61ba7f3427b5bd7af17ee399e247affe330e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 22:21:02 +0100
+Subject: video: fbdev: gbefb: Only instantiate device when built for IP32
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 ]
+
+The gbefb driver not only registers a driver but also the device for that
+driver. This is all well and good when run on the IP32 machines that are
+supported by the driver but since the driver supports building with
+COMPILE_TEST we might also be building on other platforms which do not have
+this hardware and will crash instantiating the driver. Add an IS_ENABLED()
+check so we compile out the device registration if we don't have the Kconfig
+option for the machine enabled.
+
+Fixes: 552ccf6b259d290c0c ("video: fbdev: gbefb: add COMPILE_TEST support")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210921212102.30803-1-broonie@kernel.org
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/gbefb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/gbefb.c b/drivers/video/fbdev/gbefb.c
+index 31270a8986e8..8f8ca1f88fe2 100644
+--- a/drivers/video/fbdev/gbefb.c
++++ b/drivers/video/fbdev/gbefb.c
+@@ -1269,7 +1269,7 @@ static struct platform_device *gbefb_device;
+ static int __init gbefb_init(void)
+ {
+ int ret = platform_driver_register(&gbefb_driver);
+- if (!ret) {
++ if (IS_ENABLED(CONFIG_SGI_IP32) && !ret) {
+ gbefb_device = platform_device_alloc("gbefb", 0);
+ if (gbefb_device) {
+ ret = platform_device_add(gbefb_device);
+--
+2.33.0
+
--- /dev/null
+From d33c319790b60c50bfe286290ce62337681f7c8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 09:46:33 -0700
+Subject: xtensa: call irqchip_init only when CONFIG_USE_OF is selected
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+[ Upstream commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 ]
+
+During boot time kernel configured with OF=y but USE_OF=n displays the
+following warnings and hangs shortly after starting userspace:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0
+irq_create_mapping_affinity(, 6) called with NULL domain
+CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30
+Call Trace:
+ __warn+0x69/0xc4
+ warn_slowpath_fmt+0x6c/0x94
+ irq_create_mapping_affinity+0x29/0xc0
+ local_timer_setup+0x40/0x88
+ time_init+0xb1/0xe8
+ start_kernel+0x31d/0x3f4
+ _startup+0x13b/0x13b
+---[ end trace 1e6630e1c5eda35b ]---
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88
+error: can't map timer irq
+CPU: 0 PID: 0 Comm: swapper Tainted: G W 5.15.0-rc3-00001-gd67ed2510d28 #30
+Call Trace:
+ __warn+0x69/0xc4
+ warn_slowpath_fmt+0x6c/0x94
+ local_timer_setup+0x58/0x88
+ time_init+0xb1/0xe8
+ start_kernel+0x31d/0x3f4
+ _startup+0x13b/0x13b
+---[ end trace 1e6630e1c5eda35c ]---
+Failed to request irq 0 (timer)
+
+Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and
+calling legacy interrupt controller init otherwise.
+
+Fixes: da844a81779e ("xtensa: add device trees support")
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/kernel/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
+index a48bf2d10ac2..80cc9770a8d2 100644
+--- a/arch/xtensa/kernel/irq.c
++++ b/arch/xtensa/kernel/irq.c
+@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq)
+
+ void __init init_IRQ(void)
+ {
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ irqchip_init();
+ #else
+ #ifdef CONFIG_HAVE_SMP
+--
+2.33.0
+
--- /dev/null
+From 40794250dd50fc25a2183d1e53e303d87957669e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 20:29:51 -0700
+Subject: xtensa: use CONFIG_USE_OF instead of CONFIG_OF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d67ed2510d28a1eb33171010d35cf52178cfcbdd ]
+
+CONFIG_OF can be set by a randconfig or by a user -- without setting the
+early flattree option (OF_EARLY_FLATTREE). This causes build errors.
+However, if randconfig or a user sets USE_OF in the Xtensa config,
+the right kconfig symbols are set to fix the build.
+
+Fixes these build errors:
+
+../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’?
+ 67 | void *dtb_start = __dtb_start;
+ | ^~~~~~~~~~~
+../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area':
+../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration]
+ 201 | if (!of_flat_dt_is_compatible(node, "simple-bus"))
+../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration]
+ 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len);
+../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
+ 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len);
+ | ^
+../arch/xtensa/kernel/setup.c: In function 'early_init_devtree':
+../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration]
+ 228 | early_init_dt_scan(params);
+../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration]
+ 229 | of_scan_flat_dt(xtensa_dt_io_area, NULL);
+
+xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr'
+
+Fixes: da844a81779e ("xtensa: add device trees support")
+Fixes: 6cb971114f63 ("xtensa: remap io area defined in device tree")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/include/asm/kmem_layout.h | 2 +-
+ arch/xtensa/kernel/setup.c | 12 ++++++------
+ arch/xtensa/mm/mmu.c | 2 +-
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/xtensa/include/asm/kmem_layout.h b/arch/xtensa/include/asm/kmem_layout.h
+index 7cbf68ca7106..6fc05cba61a2 100644
+--- a/arch/xtensa/include/asm/kmem_layout.h
++++ b/arch/xtensa/include/asm/kmem_layout.h
+@@ -78,7 +78,7 @@
+ #endif
+ #define XCHAL_KIO_SIZE 0x10000000
+
+-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF)
++#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_USE_OF)
+ #define XCHAL_KIO_PADDR xtensa_get_kio_paddr()
+ #ifndef __ASSEMBLY__
+ extern unsigned long xtensa_kio_paddr;
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index ed184106e4cf..ee9082a142fe 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -63,7 +63,7 @@ extern unsigned long initrd_end;
+ extern int initrd_below_start_ok;
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ void *dtb_start = __dtb_start;
+ #endif
+
+@@ -125,7 +125,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
+
+ #endif /* CONFIG_BLK_DEV_INITRD */
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ static int __init parse_tag_fdt(const bp_tag_t *tag)
+ {
+@@ -135,7 +135,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag)
+
+ __tagtable(BP_TAG_FDT, parse_tag_fdt);
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+
+ static int __init parse_tag_cmdline(const bp_tag_t* tag)
+ {
+@@ -183,7 +183,7 @@ static int __init parse_bootparam(const bp_tag_t *tag)
+ }
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ #if !XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY
+ unsigned long xtensa_kio_paddr = XCHAL_KIO_DEFAULT_PADDR;
+@@ -232,7 +232,7 @@ void __init early_init_devtree(void *params)
+ strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+ }
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+
+ /*
+ * Initialize architecture. (Early stage)
+@@ -253,7 +253,7 @@ void __init init_arch(bp_tag_t *bp_start)
+ if (bp_start)
+ parse_bootparam(bp_start);
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ early_init_devtree(dtb_start);
+ #endif
+
+diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
+index fd2193df8a14..511bb92518f2 100644
+--- a/arch/xtensa/mm/mmu.c
++++ b/arch/xtensa/mm/mmu.c
+@@ -100,7 +100,7 @@ void init_mmu(void)
+
+ void init_kio(void)
+ {
+-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
++#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF)
+ /*
+ * Update the IO area mapping in case xtensa_kio_paddr has changed
+ */
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
