--- /dev/null
+From 2bd281638040b916289f7290e6a5ce593c8145bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 19:21:15 +0530
+Subject: ASoC: codec: wcd938x: Add irq config support
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit 214174d9f56c7f81f4860a26b6b8b961a6b92654 ]
+
+This patch fixes compilation error in wcd98x codec driver.
+
+Fixes: 045442228868 ("ASoC: codecs: wcd938x: add audio routing and Kconfig")
+
+Signed-off-by: Venkata Prasad Potturu <potturu@codeaurora.org>
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/1633614675-27122-1-git-send-email-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
+index db16071205ba..dd1ae611fc2a 100644
+--- a/sound/soc/codecs/Kconfig
++++ b/sound/soc/codecs/Kconfig
+@@ -1564,6 +1564,7 @@ config SND_SOC_WCD938X
+ config SND_SOC_WCD938X_SDW
+ tristate "WCD9380/WCD9385 Codec - SDW"
+ select SND_SOC_WCD938X
++ select REGMAP_IRQ
+ depends on SOUNDWIRE
+ select REGMAP_SOUNDWIRE
+ help
+--
+2.33.0
+
--- /dev/null
+From 8d9c4a0ac852d5877e731c70f7a04bff6c4e992b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:34:29 -0800
+Subject: drm/kmb: Enable alpha blended second plane
+
+From: Edmund Dea <edmund.j.dea@intel.com>
+
+[ Upstream commit c026565fe9be813fe826f7e5533ed763283af5f0 ]
+
+Enable one additional plane that is alpha blended on top
+of the primary plane.
+
+This also fixes the below warnings when building with
+-Warray-bounds:
+
+drivers/gpu/drm/kmb/kmb_plane.c:135:20: warning: array subscript 3 is
+above array bounds of 'struct layer_status[1]' [-Warray-bounds]
+drivers/gpu/drm/kmb/kmb_plane.c:132:20: warning: array subscript 2 is
+above array bounds of 'struct layer_status[1]' [-Warray-bounds]
+drivers/gpu/drm/kmb/kmb_plane.c:129:20: warning: array subscript 1 is
+above array bounds of 'struct layer_status[1]' [-Warray-bounds]
+
+v2: corrected previous patch dependecies so it builds
+
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20210728003126.1425028-13-anitha.chrisanthus@intel.com/
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_drv.c | 8 ++--
+ drivers/gpu/drm/kmb/kmb_drv.h | 5 ++
+ drivers/gpu/drm/kmb/kmb_plane.c | 81 +++++++++++++++++++++++++++++----
+ drivers/gpu/drm/kmb/kmb_plane.h | 5 +-
+ drivers/gpu/drm/kmb/kmb_regs.h | 3 ++
+ 5 files changed, 87 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.c b/drivers/gpu/drm/kmb/kmb_drv.c
+index bb7eca9e13ae..d3091bf38cc0 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.c
++++ b/drivers/gpu/drm/kmb/kmb_drv.c
+@@ -173,10 +173,10 @@ static int kmb_setup_mode_config(struct drm_device *drm)
+ ret = drmm_mode_config_init(drm);
+ if (ret)
+ return ret;
+- drm->mode_config.min_width = KMB_MIN_WIDTH;
+- drm->mode_config.min_height = KMB_MIN_HEIGHT;
+- drm->mode_config.max_width = KMB_MAX_WIDTH;
+- drm->mode_config.max_height = KMB_MAX_HEIGHT;
++ drm->mode_config.min_width = KMB_FB_MIN_WIDTH;
++ drm->mode_config.min_height = KMB_FB_MIN_HEIGHT;
++ drm->mode_config.max_width = KMB_FB_MAX_WIDTH;
++ drm->mode_config.max_height = KMB_FB_MAX_HEIGHT;
+ drm->mode_config.funcs = &kmb_mode_config_funcs;
+
+ ret = kmb_setup_crtc(drm);
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.h b/drivers/gpu/drm/kmb/kmb_drv.h
+index 178aa14f2efc..5869890b8fc7 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.h
++++ b/drivers/gpu/drm/kmb/kmb_drv.h
+@@ -20,6 +20,11 @@
+ #define DRIVER_MAJOR 1
+ #define DRIVER_MINOR 1
+
++#define KMB_FB_MAX_WIDTH 1920
++#define KMB_FB_MAX_HEIGHT 1080
++#define KMB_FB_MIN_WIDTH 1
++#define KMB_FB_MIN_HEIGHT 1
++
+ #define KMB_LCD_DEFAULT_CLK 200000000
+ #define KMB_SYS_CLK_MHZ 500
+
+diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
+index 45cb096455b5..00404ba4126d 100644
+--- a/drivers/gpu/drm/kmb/kmb_plane.c
++++ b/drivers/gpu/drm/kmb/kmb_plane.c
+@@ -113,9 +113,10 @@ static int kmb_plane_atomic_check(struct drm_plane *plane,
+ if (ret)
+ return ret;
+
+- if (new_plane_state->crtc_w > KMB_MAX_WIDTH || new_plane_state->crtc_h > KMB_MAX_HEIGHT)
+- return -EINVAL;
+- if (new_plane_state->crtc_w < KMB_MIN_WIDTH || new_plane_state->crtc_h < KMB_MIN_HEIGHT)
++ if (new_plane_state->crtc_w > KMB_FB_MAX_WIDTH ||
++ new_plane_state->crtc_h > KMB_FB_MAX_HEIGHT ||
++ new_plane_state->crtc_w < KMB_FB_MIN_WIDTH ||
++ new_plane_state->crtc_h < KMB_FB_MIN_HEIGHT)
+ return -EINVAL;
+
+ /* Due to HW limitations, changing plane height or width after
+@@ -306,6 +307,44 @@ static void config_csc(struct kmb_drm_private *kmb, int plane_id)
+ kmb_write_lcd(kmb, LCD_LAYERn_CSC_OFF3(plane_id), csc_coef_lcd[11]);
+ }
+
++static void kmb_plane_set_alpha(struct kmb_drm_private *kmb,
++ const struct drm_plane_state *state,
++ unsigned char plane_id,
++ unsigned int *val)
++{
++ u16 plane_alpha = state->alpha;
++ u16 pixel_blend_mode = state->pixel_blend_mode;
++ int has_alpha = state->fb->format->has_alpha;
++
++ if (plane_alpha != DRM_BLEND_ALPHA_OPAQUE)
++ *val |= LCD_LAYER_ALPHA_STATIC;
++
++ if (has_alpha) {
++ switch (pixel_blend_mode) {
++ case DRM_MODE_BLEND_PIXEL_NONE:
++ break;
++ case DRM_MODE_BLEND_PREMULTI:
++ *val |= LCD_LAYER_ALPHA_EMBED | LCD_LAYER_ALPHA_PREMULT;
++ break;
++ case DRM_MODE_BLEND_COVERAGE:
++ *val |= LCD_LAYER_ALPHA_EMBED;
++ break;
++ default:
++ DRM_DEBUG("Missing pixel blend mode case (%s == %ld)\n",
++ __stringify(pixel_blend_mode),
++ (long)pixel_blend_mode);
++ break;
++ }
++ }
++
++ if (plane_alpha == DRM_BLEND_ALPHA_OPAQUE && !has_alpha) {
++ *val &= LCD_LAYER_ALPHA_DISABLED;
++ return;
++ }
++
++ kmb_write_lcd(kmb, LCD_LAYERn_ALPHA(plane_id), plane_alpha);
++}
++
+ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ struct drm_atomic_state *state)
+ {
+@@ -333,11 +372,12 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ fb = new_plane_state->fb;
+ if (!fb)
+ return;
++
+ num_planes = fb->format->num_planes;
+ kmb_plane = to_kmb_plane(plane);
+- plane_id = kmb_plane->id;
+
+ kmb = to_kmb(plane->dev);
++ plane_id = kmb_plane->id;
+
+ spin_lock_irq(&kmb->irq_lock);
+ if (kmb->kmb_under_flow || kmb->kmb_flush_done) {
+@@ -431,20 +471,32 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ config_csc(kmb, plane_id);
+ }
+
++ kmb_plane_set_alpha(kmb, plane->state, plane_id, &val);
++
+ kmb_write_lcd(kmb, LCD_LAYERn_CFG(plane_id), val);
+
++ /* Configure LCD_CONTROL */
++ ctrl = kmb_read_lcd(kmb, LCD_CONTROL);
++
++ /* Set layer blending config */
++ ctrl &= ~LCD_CTRL_ALPHA_ALL;
++ ctrl |= LCD_CTRL_ALPHA_BOTTOM_VL1 |
++ LCD_CTRL_ALPHA_BLEND_VL2;
++
++ ctrl &= ~LCD_CTRL_ALPHA_BLEND_BKGND_DISABLE;
++
+ switch (plane_id) {
+ case LAYER_0:
+- ctrl = LCD_CTRL_VL1_ENABLE;
++ ctrl |= LCD_CTRL_VL1_ENABLE;
+ break;
+ case LAYER_1:
+- ctrl = LCD_CTRL_VL2_ENABLE;
++ ctrl |= LCD_CTRL_VL2_ENABLE;
+ break;
+ case LAYER_2:
+- ctrl = LCD_CTRL_GL1_ENABLE;
++ ctrl |= LCD_CTRL_GL1_ENABLE;
+ break;
+ case LAYER_3:
+- ctrl = LCD_CTRL_GL2_ENABLE;
++ ctrl |= LCD_CTRL_GL2_ENABLE;
+ break;
+ }
+
+@@ -456,7 +508,7 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ */
+ ctrl |= LCD_CTRL_VHSYNC_IDLE_LVL;
+
+- kmb_set_bitmask_lcd(kmb, LCD_CONTROL, ctrl);
++ kmb_write_lcd(kmb, LCD_CONTROL, ctrl);
+
+ /* Enable pipeline AXI read transactions for the DMA
+ * after setting graphics layers. This must be done
+@@ -531,6 +583,9 @@ struct kmb_plane *kmb_plane_init(struct drm_device *drm)
+ enum drm_plane_type plane_type;
+ const u32 *plane_formats;
+ int num_plane_formats;
++ unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
++ BIT(DRM_MODE_BLEND_PREMULTI) |
++ BIT(DRM_MODE_BLEND_COVERAGE);
+
+ for (i = 0; i < KMB_MAX_PLANES; i++) {
+ plane = drmm_kzalloc(drm, sizeof(*plane), GFP_KERNEL);
+@@ -562,8 +617,16 @@ struct kmb_plane *kmb_plane_init(struct drm_device *drm)
+ drm_dbg(drm, "%s : %d i=%d type=%d",
+ __func__, __LINE__,
+ i, plane_type);
++ drm_plane_create_alpha_property(&plane->base_plane);
++
++ drm_plane_create_blend_mode_property(&plane->base_plane,
++ blend_caps);
++
++ drm_plane_create_zpos_immutable_property(&plane->base_plane, i);
++
+ drm_plane_helper_add(&plane->base_plane,
+ &kmb_plane_helper_funcs);
++
+ if (plane_type == DRM_PLANE_TYPE_PRIMARY) {
+ primary = plane;
+ kmb->plane = plane;
+diff --git a/drivers/gpu/drm/kmb/kmb_plane.h b/drivers/gpu/drm/kmb/kmb_plane.h
+index 99207b35365c..b51144044fe8 100644
+--- a/drivers/gpu/drm/kmb/kmb_plane.h
++++ b/drivers/gpu/drm/kmb/kmb_plane.h
+@@ -35,6 +35,9 @@
+ #define POSSIBLE_CRTCS 1
+ #define to_kmb_plane(x) container_of(x, struct kmb_plane, base_plane)
+
++#define POSSIBLE_CRTCS 1
++#define KMB_MAX_PLANES 2
++
+ enum layer_id {
+ LAYER_0,
+ LAYER_1,
+@@ -43,8 +46,6 @@ enum layer_id {
+ /* KMB_MAX_PLANES */
+ };
+
+-#define KMB_MAX_PLANES 1
+-
+ enum sub_plane_id {
+ Y_PLANE,
+ U_PLANE,
+diff --git a/drivers/gpu/drm/kmb/kmb_regs.h b/drivers/gpu/drm/kmb/kmb_regs.h
+index 48150569f702..9756101b0d32 100644
+--- a/drivers/gpu/drm/kmb/kmb_regs.h
++++ b/drivers/gpu/drm/kmb/kmb_regs.h
+@@ -43,8 +43,10 @@
+ #define LCD_CTRL_OUTPUT_ENABLED BIT(19)
+ #define LCD_CTRL_BPORCH_ENABLE BIT(21)
+ #define LCD_CTRL_FPORCH_ENABLE BIT(22)
++#define LCD_CTRL_ALPHA_BLEND_BKGND_DISABLE BIT(23)
+ #define LCD_CTRL_PIPELINE_DMA BIT(28)
+ #define LCD_CTRL_VHSYNC_IDLE_LVL BIT(31)
++#define LCD_CTRL_ALPHA_ALL (0xff << 6)
+
+ /* interrupts */
+ #define LCD_INT_STATUS (0x4 * 0x001)
+@@ -115,6 +117,7 @@
+ #define LCD_LAYER_ALPHA_EMBED BIT(5)
+ #define LCD_LAYER_ALPHA_COMBI (LCD_LAYER_ALPHA_STATIC | \
+ LCD_LAYER_ALPHA_EMBED)
++#define LCD_LAYER_ALPHA_DISABLED ~(LCD_LAYER_ALPHA_COMBI)
+ /* RGB multiplied with alpha */
+ #define LCD_LAYER_ALPHA_PREMULT BIT(6)
+ #define LCD_LAYER_INVERT_COL BIT(7)
+--
+2.33.0
+
--- /dev/null
+From 3e97c116e7722c7f2598b5f7bdc16043a334fc0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 14:34:13 -0800
+Subject: drm/kmb: Limit supported mode to 1080p
+
+From: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+
+[ Upstream commit a79f40cccd4644c32f6d5ae1ccf091a262e1dc57 ]
+
+KMB only supports single resolution(1080p), this commit checks for
+1920x1080x60 or 1920x1080x59 in crtc_mode_valid.
+Also, modes with vfp < 4 are not supported in KMB display. This change
+prunes display modes with vfp < 4.
+
+v2: added vfp check
+
+Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
+Co-developed-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link:https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-2-anitha.chrisanthus@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_crtc.c | 34 ++++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/kmb/kmb_drv.h | 9 ++++++++-
+ 2 files changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_crtc.c b/drivers/gpu/drm/kmb/kmb_crtc.c
+index 4f240466cf63..06613ffeaaf8 100644
+--- a/drivers/gpu/drm/kmb/kmb_crtc.c
++++ b/drivers/gpu/drm/kmb/kmb_crtc.c
+@@ -186,11 +186,45 @@ static void kmb_crtc_atomic_flush(struct drm_crtc *crtc,
+ spin_unlock_irq(&crtc->dev->event_lock);
+ }
+
++static enum drm_mode_status
++ kmb_crtc_mode_valid(struct drm_crtc *crtc,
++ const struct drm_display_mode *mode)
++{
++ int refresh;
++ struct drm_device *dev = crtc->dev;
++ int vfp = mode->vsync_start - mode->vdisplay;
++
++ if (mode->vdisplay < KMB_CRTC_MAX_HEIGHT) {
++ drm_dbg(dev, "height = %d less than %d",
++ mode->vdisplay, KMB_CRTC_MAX_HEIGHT);
++ return MODE_BAD_VVALUE;
++ }
++ if (mode->hdisplay < KMB_CRTC_MAX_WIDTH) {
++ drm_dbg(dev, "width = %d less than %d",
++ mode->hdisplay, KMB_CRTC_MAX_WIDTH);
++ return MODE_BAD_HVALUE;
++ }
++ refresh = drm_mode_vrefresh(mode);
++ if (refresh < KMB_MIN_VREFRESH || refresh > KMB_MAX_VREFRESH) {
++ drm_dbg(dev, "refresh = %d less than %d or greater than %d",
++ refresh, KMB_MIN_VREFRESH, KMB_MAX_VREFRESH);
++ return MODE_BAD;
++ }
++
++ if (vfp < KMB_CRTC_MIN_VFP) {
++ drm_dbg(dev, "vfp = %d less than %d", vfp, KMB_CRTC_MIN_VFP);
++ return MODE_BAD;
++ }
++
++ return MODE_OK;
++}
++
+ static const struct drm_crtc_helper_funcs kmb_crtc_helper_funcs = {
+ .atomic_begin = kmb_crtc_atomic_begin,
+ .atomic_enable = kmb_crtc_atomic_enable,
+ .atomic_disable = kmb_crtc_atomic_disable,
+ .atomic_flush = kmb_crtc_atomic_flush,
++ .mode_valid = kmb_crtc_mode_valid,
+ };
+
+ int kmb_setup_crtc(struct drm_device *drm)
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.h b/drivers/gpu/drm/kmb/kmb_drv.h
+index 5869890b8fc7..bf085e95b28f 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.h
++++ b/drivers/gpu/drm/kmb/kmb_drv.h
+@@ -20,11 +20,18 @@
+ #define DRIVER_MAJOR 1
+ #define DRIVER_MINOR 1
+
++/* Platform definitions */
++#define KMB_CRTC_MIN_VFP 4
++#define KMB_CRTC_MAX_WIDTH 1920 /* max width in pixels */
++#define KMB_CRTC_MAX_HEIGHT 1080 /* max height in pixels */
++#define KMB_CRTC_MIN_WIDTH 1920
++#define KMB_CRTC_MIN_HEIGHT 1080
+ #define KMB_FB_MAX_WIDTH 1920
+ #define KMB_FB_MAX_HEIGHT 1080
+ #define KMB_FB_MIN_WIDTH 1
+ #define KMB_FB_MIN_HEIGHT 1
+-
++#define KMB_MIN_VREFRESH 59 /*vertical refresh in Hz */
++#define KMB_MAX_VREFRESH 60 /*vertical refresh in Hz */
+ #define KMB_LCD_DEFAULT_CLK 200000000
+ #define KMB_SYS_CLK_MHZ 500
+
+--
+2.33.0
+
--- /dev/null
+From e6f839944d0e2345e93b0afeeb2e51a847f362f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 15:16:19 -0700
+Subject: mm/thp: decrease nr_thps in file's mapping on THP split
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1ca7554d05ac038c98271f8968ed821266ecaa9c ]
+
+Decrease nr_thps counter in file's mapping to ensure that the page cache
+won't be dropped excessively on file write access if page has been
+already split.
+
+I've tried a test scenario running a big binary, kernel remaps it with
+THPs, then force a THP split with /sys/kernel/debug/split_huge_pages.
+During any further open of that binary with O_RDWR or O_WRITEONLY kernel
+drops page cache for it, because of non-zero thps counter.
+
+Link: https://lkml.kernel.org/r/20211012120237.2600-1-m.szyprowski@samsung.com
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Fixes: 09d91cda0e82 ("mm,thp: avoid writes to file with THP in pagecache")
+Fixes: 06d3eff62d9d ("mm/thp: fix node page state in split_huge_page_to_list()")
+Acked-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: Yang Shi <shy828301@gmail.com>
+Cc: <sfoon.kim@samsung.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: William Kucharski <william.kucharski@oracle.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/huge_memory.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index afff3ac87067..163c2da2a654 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2724,12 +2724,14 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ if (mapping) {
+ int nr = thp_nr_pages(head);
+
+- if (PageSwapBacked(head))
++ if (PageSwapBacked(head)) {
+ __mod_lruvec_page_state(head, NR_SHMEM_THPS,
+ -nr);
+- else
++ } else {
+ __mod_lruvec_page_state(head, NR_FILE_THPS,
+ -nr);
++ filemap_nr_thps_dec(mapping);
++ }
+ }
+
+ __split_huge_page(page, list, end);
+--
+2.33.0
+
--- /dev/null
+From de39f43f38f95e3c9dc99f8b86aaeb6574c041c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:32 +0800
+Subject: net: hns3: fix for miscalculation of rx unused desc
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 9f9f0f19994b42b3e5e8735d41b9c5136828a76c ]
+
+rx unused desc is the desc that need attatching new buffer
+before refilling to hw to receive new packet, the number of
+desc need attatching new buffer is calculated using next_to_use
+and next_to_clean. when next_to_use == next_to_clean, currently
+hns3 driver assumes that all the desc has the buffer attatched,
+but 'next_to_use == next_to_clean' also means all the desc need
+attatching new buffer if hw has comsumed all the desc and the
+driver has not attatched any buffer to the desc yet.
+
+This patch adds 'refill' in desc_cb to indicate whether a new
+buffer has been refilled to a desc.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 1 +
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 02495ea34332..5aad7951308d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3263,6 +3263,7 @@ static void hns3_buffer_detach(struct hns3_enet_ring *ring, int i)
+ {
+ hns3_unmap_buffer(ring, &ring->desc_cb[i]);
+ ring->desc[i].addr = 0;
++ ring->desc_cb[i].refill = 0;
+ }
+
+ static void hns3_free_buffer_detach(struct hns3_enet_ring *ring, int i,
+@@ -3340,6 +3341,7 @@ static int hns3_alloc_and_attach_buffer(struct hns3_enet_ring *ring, int i)
+ return ret;
+
+ ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
++ ring->desc_cb[i].refill = 1;
+
+ return 0;
+ }
+@@ -3370,12 +3372,14 @@ static void hns3_replace_buffer(struct hns3_enet_ring *ring, int i,
+ hns3_unmap_buffer(ring, &ring->desc_cb[i]);
+ ring->desc_cb[i] = *res_cb;
+ ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
++ ring->desc_cb[i].refill = 1;
+ ring->desc[i].rx.bd_base_info = 0;
+ }
+
+ static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i)
+ {
+ ring->desc_cb[i].reuse_flag = 0;
++ ring->desc_cb[i].refill = 1;
+ ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma +
+ ring->desc_cb[i].page_offset);
+ ring->desc[i].rx.bd_base_info = 0;
+@@ -3482,6 +3486,9 @@ static int hns3_desc_unused(struct hns3_enet_ring *ring)
+ int ntc = ring->next_to_clean;
+ int ntu = ring->next_to_use;
+
++ if (unlikely(ntc == ntu && !ring->desc_cb[ntc].refill))
++ return ring->desc_num;
++
+ return ((ntc >= ntu) ? 0 : ring->desc_num) + ntc - ntu;
+ }
+
+@@ -3826,6 +3833,7 @@ static void hns3_rx_ring_move_fw(struct hns3_enet_ring *ring)
+ {
+ ring->desc[ring->next_to_clean].rx.bd_base_info &=
+ cpu_to_le32(~BIT(HNS3_RXD_VLD_B));
++ ring->desc_cb[ring->next_to_clean].refill = 0;
+ ring->next_to_clean += 1;
+
+ if (unlikely(ring->next_to_clean == ring->desc_num))
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+index 399ebeed6e7e..d146f44bfaca 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+@@ -322,6 +322,7 @@ struct hns3_desc_cb {
+ u32 length; /* length of the buffer */
+
+ u16 reuse_flag;
++ u16 refill;
+
+ /* desc type, used by the ring user to mark the type of the priv data */
+ u16 type;
+--
+2.33.0
+
--- /dev/null
+From 2c21e7c47a74ecf2a292a93becb33466cc648bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 16:05:38 +0300
+Subject: net/mlx5: Lag, change multipath and bonding to be mutually exclusive
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 14fe2471c62816ba82546fb68369d957c3a58b59 ]
+
+Both multipath and bonding events are changing the HW LAG state
+independently.
+Handling one of the features events while the other is already
+enabled can cause unwanted behavior, for example handling
+bonding event while multipath enabled will disable the lag and
+cause multipath to stop working.
+
+Fix it by ignoring bonding event while in multipath and ignoring FIB
+events while in bonding mode.
+
+Fixes: 544fe7c2e654 ("net/mlx5e: Activate HW multipath and handle port affinity based on FIB events")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 2 ++
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 ++
+ drivers/net/ethernet/mellanox/mlx5/core/lag.c | 4 ++++
+ drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 13 ++++++++-----
+ drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h | 2 ++
+ include/linux/mlx5/driver.h | 1 -
+ 6 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+index 1e2d117082d4..603d9884b6bd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+@@ -10,6 +10,8 @@
+ #include "en_tc.h"
+ #include "rep/tc.h"
+ #include "rep/neigh.h"
++#include "lag.h"
++#include "lag_mp.h"
+
+ struct mlx5e_tc_tun_route_attr {
+ struct net_device *out_dev;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 6eba574c5a36..c757209b47ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -72,6 +72,8 @@
+ #include "lib/fs_chains.h"
+ #include "diag/en_tc_tracepoint.h"
+ #include <asm/div64.h>
++#include "lag.h"
++#include "lag_mp.h"
+
+ #define nic_chains(priv) ((priv)->fs.tc.chains)
+ #define MLX5_MH_ACT_SZ MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+index 814440aae1ae..be6e7e10b252 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+@@ -375,6 +375,10 @@ static void mlx5_do_bond(struct mlx5_lag *ldev)
+ if (!mlx5_lag_is_ready(ldev)) {
+ do_bond = false;
+ } else {
++ /* VF LAG is in multipath mode, ignore bond change requests */
++ if (mlx5_lag_is_multipath(dev0))
++ return;
++
+ tracker = ldev->tracker;
+
+ do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
+index 516bfc2bd797..577e5d02bfdd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
+@@ -9,20 +9,23 @@
+ #include "eswitch.h"
+ #include "lib/mlx5.h"
+
++static bool __mlx5_lag_is_multipath(struct mlx5_lag *ldev)
++{
++ return !!(ldev->flags & MLX5_LAG_FLAG_MULTIPATH);
++}
++
+ static bool mlx5_lag_multipath_check_prereq(struct mlx5_lag *ldev)
+ {
+ if (!mlx5_lag_is_ready(ldev))
+ return false;
+
++ if (__mlx5_lag_is_active(ldev) && !__mlx5_lag_is_multipath(ldev))
++ return false;
++
+ return mlx5_esw_multipath_prereq(ldev->pf[MLX5_LAG_P1].dev,
+ ldev->pf[MLX5_LAG_P2].dev);
+ }
+
+-static bool __mlx5_lag_is_multipath(struct mlx5_lag *ldev)
+-{
+- return !!(ldev->flags & MLX5_LAG_FLAG_MULTIPATH);
+-}
+-
+ bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev)
+ {
+ struct mlx5_lag *ldev;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
+index 729c839397a8..dea199e79bed 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
+@@ -24,12 +24,14 @@ struct lag_mp {
+ void mlx5_lag_mp_reset(struct mlx5_lag *ldev);
+ int mlx5_lag_mp_init(struct mlx5_lag *ldev);
+ void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev);
++bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev);
+
+ #else /* CONFIG_MLX5_ESWITCH */
+
+ static inline void mlx5_lag_mp_reset(struct mlx5_lag *ldev) {};
+ static inline int mlx5_lag_mp_init(struct mlx5_lag *ldev) { return 0; }
+ static inline void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev) {}
++bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev) { return false; }
+
+ #endif /* CONFIG_MLX5_ESWITCH */
+ #endif /* __MLX5_LAG_MP_H__ */
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 25a8be58d289..9b8add8eac0c 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1135,7 +1135,6 @@ int mlx5_cmd_create_vport_lag(struct mlx5_core_dev *dev);
+ int mlx5_cmd_destroy_vport_lag(struct mlx5_core_dev *dev);
+ bool mlx5_lag_is_roce(struct mlx5_core_dev *dev);
+ bool mlx5_lag_is_sriov(struct mlx5_core_dev *dev);
+-bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev);
+ bool mlx5_lag_is_active(struct mlx5_core_dev *dev);
+ struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev);
+ u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev,
+--
+2.33.0
+
--- /dev/null
+From 502ba484f81d7d74072b819d4e921989104e33f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 16:19:57 -0700
+Subject: net/mlx5: Lag, move lag destruction to a workqueue
+
+From: Mark Bloch <mbloch@nvidia.com>
+
+[ Upstream commit 63d4a9afbcee4167ffb0d126b23b8884b15e5837 ]
+
+If a netdev is removed from the lag the lag should be destroyed.
+With downstream patches this might trigger a reconfiguration of
+representors on a different eswitch and such we don't have the proper
+locking to so from this path. Move the destruction to be done by the
+workqueue.
+
+As the destruction won't affect the netdev side it okay to do so.
+The RDMA side will be reconfigured and it already coded to handle such
+reconfiguration.
+
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/lag.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+index 40ef60f562b4..814440aae1ae 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+@@ -372,12 +372,13 @@ static void mlx5_do_bond(struct mlx5_lag *ldev)
+ bool do_bond, roce_lag;
+ int err;
+
+- if (!mlx5_lag_is_ready(ldev))
+- return;
+-
+- tracker = ldev->tracker;
++ if (!mlx5_lag_is_ready(ldev)) {
++ do_bond = false;
++ } else {
++ tracker = ldev->tracker;
+
+- do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev);
++ do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev);
++ }
+
+ if (do_bond && !__mlx5_lag_is_active(ldev)) {
+ roce_lag = !mlx5_sriov_is_enabled(dev0) &&
+@@ -691,11 +692,11 @@ void mlx5_lag_remove_netdev(struct mlx5_core_dev *dev,
+ if (!ldev)
+ return;
+
+- if (__mlx5_lag_is_active(ldev))
+- mlx5_disable_lag(ldev);
+-
+ mlx5_ldev_remove_netdev(ldev, netdev);
+ ldev->flags &= ~MLX5_LAG_FLAG_READY;
++
++ if (__mlx5_lag_is_active(ldev))
++ mlx5_queue_bond_work(ldev, 0);
+ }
+
+ /* Must be called with intf_mutex held */
+--
+2.33.0
+
--- /dev/null
+From db4189654eebf1e8df013822135ee7e73225bdba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Oct 2021 16:35:21 +0800
+Subject: sched/scs: Reset the shadow stack when idle_task_exit
+
+From: Woody Lin <woodylin@google.com>
+
+[ Upstream commit 63acd42c0d4942f74710b11c38602fb14dea7320 ]
+
+Commit f1a0a376ca0c ("sched/core: Initialize the idle task with
+preemption disabled") removed the init_idle() call from
+idle_thread_get(). This was the sole call-path on hotplug that resets
+the Shadow Call Stack (scs) Stack Pointer (sp).
+
+Not resetting the scs-sp leads to scs overflow after enough hotplug
+cycles. Therefore add an explicit scs_task_reset() to the hotplug code
+to make sure the scs-sp does get reset on hotplug.
+
+Fixes: f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled")
+Signed-off-by: Woody Lin <woodylin@google.com>
+[peterz: Changelog]
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Link: https://lore.kernel.org/r/20211012083521.973587-1-woodylin@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 399c37c95392..e165d28cf73b 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -8495,6 +8495,7 @@ void idle_task_exit(void)
+ finish_arch_post_lock_switch();
+ }
+
++ scs_task_reset(current);
+ /* finish_cpu(), as ran on the BP, will clean up the active_mm state */
+ }
+
+--
+2.33.0
+
--- /dev/null
+From a61d3e8d4c6473900c88699ce4f6bb33c5e7e9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Oct 2021 11:19:04 -0500
+Subject: scsi: iscsi: Fix set_param() handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 187a580c9e7895978dcd1e627b9c9e7e3d13ca96 ]
+
+In commit 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and
+sync thread") we meant to add a check where before we call ->set_param() we
+make sure the iscsi_cls_connection is bound. The problem is that between
+versions 4 and 5 of the patch the deletion of the unchecked set_param()
+call was dropped so we ended up with 2 calls. As a result we can still hit
+a crash where we access the unbound connection on the first call.
+
+This patch removes that first call.
+
+Fixes: 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread")
+Link: https://lore.kernel.org/r/20211010161904.60471-1-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Reviewed-by: Li Feng <fengli@smartx.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 922e4c7bd88e..78343d3f9385 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2930,8 +2930,6 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ session->recovery_tmo = value;
+ break;
+ default:
+- err = transport->set_param(conn, ev->u.set_param.param,
+- data, ev->u.set_param.len);
+ if ((conn->state == ISCSI_CONN_BOUND) ||
+ (conn->state == ISCSI_CONN_UP)) {
+ err = transport->set_param(conn, ev->u.set_param.param,
+--
+2.33.0
+
--- /dev/null
+From 050e0bb31d8373dec256ee7c1290bbad1c2944d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 11:24:25 +0530
+Subject: scsi: mpi3mr: Fix duplicate device entries when scanning through
+ sysfs
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+[ Upstream commit 97e6ea6d78064e7f1e9e19c45dc690aabbb71297 ]
+
+When scanning devices through the 'scan' attribute in sysfs, the user will
+observe duplicate device entries in lsscsi command output.
+
+Set the shost's max_channel to zero to avoid this.
+
+Link: https://lore.kernel.org/r/20211014055425.30719-1-sreekanth.reddy@broadcom.com
+Fixes: 824a156633df ("scsi: mpi3mr: Base driver code")
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index 24ac7ddec749..206c2598ade3 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -3755,7 +3755,7 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ shost->max_lun = -1;
+ shost->unique_id = mrioc->id;
+
+- shost->max_channel = 1;
++ shost->max_channel = 0;
+ shost->max_id = 0xFFFFFFFF;
+
+ if (prot_mask >= 0)
+--
+2.33.0
+
--- /dev/null
+From 94d9a3428d891a75d6abdc4e6049b469829957a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Oct 2021 12:18:33 -0700
+Subject: scsi: qla2xxx: Fix a memory leak in an error path of
+ qla2x00_process_els()
+
+From: Joy Gu <jgu@purestorage.com>
+
+[ Upstream commit 7fb223d0ad801f633c78cbe42b1d1b55f5d163ad ]
+
+Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of
+qla2x00_process_els()"), intended to change:
+
+ bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN
+
+to:
+
+ bsg_job->request->msgcode != FC_BSG_RPT_ELS
+
+but changed it to:
+
+ bsg_job->request->msgcode == FC_BSG_RPT_ELS
+
+instead.
+
+Change the == to a != to avoid leaking the fcport structure or freeing
+unallocated memory.
+
+Link: https://lore.kernel.org/r/20211012191834.90306-2-jgu@purestorage.com
+Fixes: 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Joy Gu <jgu@purestorage.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index d42b2ad84049..2304f54fdc93 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -415,7 +415,7 @@ done_unmap_sg:
+ goto done_free_fcport;
+
+ done_free_fcport:
+- if (bsg_request->msgcode == FC_BSG_RPT_ELS)
++ if (bsg_request->msgcode != FC_BSG_RPT_ELS)
+ qla2x00_free_fcport(fcport);
+ done:
+ return rval;
+--
+2.33.0
+
--- /dev/null
+From 5443c3b99f89b42d7344a605a06a419162869b52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Oct 2021 14:28:28 +0200
+Subject: scsi: storvsc: Fix validation for unsolicited incoming packets
+
+From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+
+[ Upstream commit 6fd13d699d24beaa28310848fe65fd898fbb9043 ]
+
+The validation on the length of incoming packets performed in
+storvsc_on_channel_callback() does not apply to unsolicited packets with ID
+of 0 sent by Hyper-V. Adjust the validation for such unsolicited packets.
+
+Link: https://lore.kernel.org/r/20211007122828.469289-1-parri.andrea@gmail.com
+Fixes: 91b1b640b834b2 ("scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()")
+Reported-by: Dexuan Cui <decui@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/storvsc_drv.c | 32 +++++++++++++++++++++++---------
+ 1 file changed, 23 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 37506b3fe5a9..5fa1120a87f7 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1285,11 +1285,15 @@ static void storvsc_on_channel_callback(void *context)
+ foreach_vmbus_pkt(desc, channel) {
+ struct vstor_packet *packet = hv_pkt_data(desc);
+ struct storvsc_cmd_request *request = NULL;
++ u32 pktlen = hv_pkt_datalen(desc);
+ u64 rqst_id = desc->trans_id;
++ u32 minlen = rqst_id ? sizeof(struct vstor_packet) -
++ stor_device->vmscsi_size_delta : sizeof(enum vstor_packet_operation);
+
+- if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) -
+- stor_device->vmscsi_size_delta) {
+- dev_err(&device->device, "Invalid packet len\n");
++ if (pktlen < minlen) {
++ dev_err(&device->device,
++ "Invalid pkt: id=%llu, len=%u, minlen=%u\n",
++ rqst_id, pktlen, minlen);
+ continue;
+ }
+
+@@ -1302,13 +1306,23 @@ static void storvsc_on_channel_callback(void *context)
+ if (rqst_id == 0) {
+ /*
+ * storvsc_on_receive() looks at the vstor_packet in the message
+- * from the ring buffer. If the operation in the vstor_packet is
+- * COMPLETE_IO, then we call storvsc_on_io_completion(), and
+- * dereference the guest memory address. Make sure we don't call
+- * storvsc_on_io_completion() with a guest memory address that is
+- * zero if Hyper-V were to construct and send such a bogus packet.
++ * from the ring buffer.
++ *
++ * - If the operation in the vstor_packet is COMPLETE_IO, then
++ * we call storvsc_on_io_completion(), and dereference the
++ * guest memory address. Make sure we don't call
++ * storvsc_on_io_completion() with a guest memory address
++ * that is zero if Hyper-V were to construct and send such
++ * a bogus packet.
++ *
++ * - If the operation in the vstor_packet is FCHBA_DATA, then
++ * we call cache_wwn(), and access the data payload area of
++ * the packet (wwn_packet); however, there is no guarantee
++ * that the packet is big enough to contain such area.
++ * Future-proof the code by rejecting such a bogus packet.
+ */
+- if (packet->operation == VSTOR_OPERATION_COMPLETE_IO) {
++ if (packet->operation == VSTOR_OPERATION_COMPLETE_IO ||
++ packet->operation == VSTOR_OPERATION_FCHBA_DATA) {
+ dev_err(&device->device, "Invalid packet with ID of 0\n");
+ continue;
+ }
+--
+2.33.0
+
libperf-tests-fix-test_stat_cpu.patch
perf-x86-msr-add-sapphire-rapids-cpu-support.patch
input-snvs_pwrkey-add-clk-handling.patch
+asoc-codec-wcd938x-add-irq-config-support.patch
+scsi-iscsi-fix-set_param-handling.patch
+scsi-storvsc-fix-validation-for-unsolicited-incoming.patch
+scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch
+scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch
+mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch
+sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch
+net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch
+net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch
+net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch
+drm-kmb-enable-alpha-blended-second-plane.patch
+drm-kmb-limit-supported-mode-to-1080p.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
