--- /dev/null
+From 30e65a610219bfe1eedca05686354c1ce2b86ee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 14:30:48 -0700
+Subject: ACPI: CPPC: Replace cppc_attr with kobj_attribute
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 2bc6262c6117dd18106d5aa50d53e945b5d99c51 ]
+
+All of the CPPC sysfs show functions are called via indirect call in
+kobj_attr_show(), where they should be of type
+
+ssize_t (*show)(struct kobject *kobj, struct kobj_attribute *attr, char *buf);
+
+because that is the type of the ->show() member in
+'struct kobj_attribute' but they are actually of type
+
+ssize_t (*show)(struct kobject *kobj, struct attribute *attr, char *buf);
+
+because of the ->show() member in 'struct cppc_attr', resulting in a
+Control Flow Integrity violation [1].
+
+$ cat /sys/devices/system/cpu/cpu0/acpi_cppc/highest_perf
+3400
+
+$ dmesg | grep "CFI failure"
+[ 175.970559] CFI failure (target: show_highest_perf+0x0/0x8):
+
+As far as I can tell, the only difference between 'struct cppc_attr'
+and 'struct kobj_attribute' aside from the type of the attr parameter
+is the type of the count parameter in the ->store() member (ssize_t vs.
+size_t), which does not actually matter because all of these nodes are
+read-only.
+
+Eliminate 'struct cppc_attr' in favor of 'struct kobj_attribute' to fix
+the violation.
+
+[1]: https://lore.kernel.org/r/20210401233216.2540591-1-samitolvanen@google.com/
+
+Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1343
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index f9b1a2abdbe2..2826bd45c61a 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -118,23 +118,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr);
+ */
+ #define NUM_RETRIES 500ULL
+
+-struct cppc_attr {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *kobj,
+- struct attribute *attr, char *buf);
+- ssize_t (*store)(struct kobject *kobj,
+- struct attribute *attr, const char *c, ssize_t count);
+-};
+-
+ #define define_one_cppc_ro(_name) \
+-static struct cppc_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0444, show_##_name, NULL)
+
+ #define to_cpc_desc(a) container_of(a, struct cpc_desc, kobj)
+
+ #define show_cppc_data(access_fn, struct_name, member_name) \
+ static ssize_t show_##member_name(struct kobject *kobj, \
+- struct attribute *attr, char *buf) \
++ struct kobj_attribute *attr, char *buf) \
+ { \
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \
+ struct struct_name st_name = {0}; \
+@@ -160,7 +152,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);
+ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
+
+ static ssize_t show_feedback_ctrs(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj);
+ struct cppc_perf_fb_ctrs fb_ctrs = {0};
+--
+2.30.2
+
--- /dev/null
+From 971f7766a4f1b6b65b66f2a7f2a23b7e0e6f0b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 13:19:23 +0200
+Subject: ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
+
+From: Jia Zhou <zhou.jia2@zte.com.cn>
+
+[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ]
+
+modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between
+register and disconnect") resulting in this problem.
+
+Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect")
+Signed-off-by: Jia Zhou <zhou.jia2@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/init.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/sound/core/init.c b/sound/core/init.c
+index db99b7fad6ad..45bbc4884ef0 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -384,10 +384,8 @@ int snd_card_disconnect(struct snd_card *card)
+ return 0;
+ }
+ card->shutdown = 1;
+- spin_unlock(&card->files_lock);
+
+ /* replace file->f_op with special dummy operations */
+- spin_lock(&card->files_lock);
+ list_for_each_entry(mfile, &card->files_list, list) {
+ /* it's critical part, use endless loop */
+ /* we have no room to fail */
+--
+2.30.2
+
--- /dev/null
+From fc06581b957d79e760b3d22c945c872679c5b756 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 13:35:34 +0200
+Subject: ALSA: usb-audio: Add error checks for usb_driver_claim_interface()
+ calls
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ]
+
+There are a few calls of usb_driver_claim_interface() but all of those
+miss the proper error checks, as reported by Coverity. This patch
+adds those missing checks.
+
+Along with it, replace the magic pointer with -1 with a constant
+USB_AUDIO_IFACE_UNUSED for better readability.
+
+Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
+Addresses-Coverity-ID: 1475943 ("Error handling issues")
+Addresses-Coverity-ID: 1475944 ("Error handling issues")
+Addresses-Coverity-ID: 1475945 ("Error handling issues")
+Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once")
+Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code")
+Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook
+Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 14 +++++++-------
+ sound/usb/quirks.c | 16 ++++++++++++----
+ sound/usb/usbaudio.h | 2 ++
+ 3 files changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 230d862cfa3a..c2dd18c5cadb 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -176,9 +176,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+ ctrlif, interface);
+ return -EINVAL;
+ }
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
+-
+- return 0;
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
+@@ -198,7 +197,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+
+ if (! snd_usb_parse_audio_interface(chip, interface)) {
+ usb_set_interface(dev, interface, 0); /* reset the current interface */
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ return 0;
+@@ -703,7 +703,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)
+ struct snd_card *card;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return;
+
+ card = chip->card;
+@@ -811,7 +811,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ struct usb_mixer_interface *mixer;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ if (!chip->num_suspended_intf++) {
+@@ -842,7 +842,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+ struct list_head *p;
+ int err = 0;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ atomic_inc(&chip->active); /* avoid autopm */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 3d1585c12b07..186e90e3636c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -55,8 +55,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,
+ if (!iface)
+ continue;
+ if (quirk->ifnum != probed_ifnum &&
+- !usb_interface_claimed(iface))
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ !usb_interface_claimed(iface)) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+@@ -390,8 +394,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,
+ continue;
+
+ err = create_autodetect_quirk(chip, iface, driver);
+- if (err >= 0)
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ if (err >= 0) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 55a2119c2411..ff97fdcf63bd 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -59,6 +59,8 @@ struct snd_usb_audio {
+ struct media_intf_devnode *ctl_intf_media_devnode;
+ };
+
++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L)
++
+ #define usb_audio_err(chip, fmt, args...) \
+ dev_err(&(chip)->dev->dev, fmt, ##args)
+ #define usb_audio_warn(chip, fmt, args...) \
+--
+2.30.2
+
--- /dev/null
+From 89d9c021f6adb054b2087addc7f50eae90b3fd4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 14:47:19 +0100
+Subject: ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check
+ fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ]
+
+Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL)
+the error return path returns -ENOMEM via the exit label "error". Other
+uses of the same error exit label set the err variable to -ENOMEM but this
+is not being used. I believe the original intent was for the error exit
+path to return the value in err rather than the hard coded -ENOMEM, so
+return this rather than the hard coded -ENOMEM.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 738d9edcfd44 ("ALSA: usb-audio: Add sanity checks for invalid EPs")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210420134719.381409-1-colin.king@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/midi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 1cc17c449407..c205a26ef509 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1332,7 +1332,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
+
+ error:
+ snd_usbmidi_in_endpoint_delete(ep);
+- return -ENOMEM;
++ return err;
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 2e2ca8e76869736da5f045d67b5240e3c80cb3bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:19 +0100
+Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8a45f33bd36efbb624198cfa9fdf1f66fd1c3d26 ]
+
+The Maxim fuel gauge datasheets describe the interrupt line as active
+low with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: e8614292cd41 ("ARM: dts: Add Maxim 77693 fuel gauge node for exynos4412-trats2")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-3-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index 83be3a797411..342abf97921e 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -187,7 +187,7 @@
+ max77693-fuel-gauge@36 {
+ compatible = "maxim,max17047";
+ interrupt-parent = <&gpx2>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_fuel_irq>;
+ reg = <0x36>;
+--
+2.30.2
+
--- /dev/null
+From 51999bc9924487a6710065093e704bb99336ef5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:20 +0100
+Subject: ARM: dts: exynos: correct MUIC interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 15107e443ab8c6cb35eff10438993e4bc944d9ae ]
+
+The Maxim MUIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 7eec1266751b ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-4-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index 342abf97921e..79e6bd56f9ad 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -139,7 +139,7 @@
+ max77693@66 {
+ compatible = "maxim,max77693";
+ interrupt-parent = <&gpx1>;
+- interrupts = <5 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_irq>;
+ reg = <0x66>;
+--
+2.30.2
+
--- /dev/null
+From 6b0d5c8c6e0cc02fbafe4d8d5d0ede219a0abc5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:21 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Midas
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e52dcd6e70fab51f53292e53336ecb007bb60889 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 15dfdfad2d4a ("ARM: dts: Add basic dts for Exynos4412-based Trats 2 board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-5-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index 79e6bd56f9ad..fedb21377c66 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -588,7 +588,7 @@
+ max77686: max77686_pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&max77686_irq>;
+ pinctrl-names = "default";
+ reg = <0x09>;
+--
+2.30.2
+
--- /dev/null
+From 825e6af55498f3e5bc5f2bc7196b597f400715a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:24 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+index 6dc96948a9cc..70a2b6e2ad3f 100644
+--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+@@ -133,7 +133,7 @@
+ compatible = "maxim,max77686";
+ reg = <0x09>;
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ wakeup-source;
+--
+2.30.2
+
--- /dev/null
+From 05faa9112166533e427c83f3aee421885e563aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:25 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+index c952a615148e..737f0e20a452 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+@@ -292,7 +292,7 @@
+ max77686: max77686@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ wakeup-source;
+--
+2.30.2
+
--- /dev/null
+From 74b4b8db88a7fe684d42a2559006559134088f1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:25:22 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ]
+
+The Maxim PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Additionally, the interrupt line is shared so using level sensitive
+interrupt is here especially important to avoid races.
+
+Fixes: eea6653aae7b ("ARM: dts: Enable PMIC interrupts for exynos4412-odroid-common")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212534.216197-6-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+index ea55f377d17c..424d12ecc901 100644
+--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+@@ -274,7 +274,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ reg = <0x09>;
+--
+2.30.2
+
--- /dev/null
+From 3f532f3030b76b812a65d3d4043dc715cfab7851 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 02:31:48 +0900
+Subject: ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins
+ for RTL8211E
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ]
+
+UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX
+delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
+
+After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the delays are working correctly, however, "rgmii" means
+no delay and the phy doesn't work. So need to set the phy-mode to
+"rgmii-id" to show that RX/TX delays are enabled.
+
+Fixes: e3cc931921d2 ("ARM: dts: uniphier: add AVE ethernet node")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+index 4eddbb8d7fca..60a588ce45e1 100644
+--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi
++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+@@ -571,7 +571,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+--
+2.30.2
+
--- /dev/null
+From fea96d0e6394ec3e155d1ad2ff65445bbc926f67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:31:04 +0800
+Subject: arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit de3abdf3d15c6e7f456e2de3f9da78f3a31414cc ]
+
+The last cell of 'gpio-ranges' should be number of GPIO pins, and in
+case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather
+than msm_pinctrl_soc_data.ngpio - 1.
+
+This fixes the problem that when the last GPIO pin in the range is
+configured with the following call sequence, it always fails with
+-EPROBE_DEFER.
+
+ pinctrl_gpio_set_config()
+ pinctrl_get_device_gpio_range()
+ pinctrl_match_gpio_range()
+
+Fixes: e13c6d144fa0 ("arm64: dts: qcom: sm8150: Add base dts file")
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Link: https://lore.kernel.org/r/20210303033106.549-3-shawn.guo@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 8f23fcadecb8..9573da378826 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -336,7 +336,7 @@
+ <0x0 0x03D00000 0x0 0x300000>;
+ reg-names = "west", "east", "north", "south";
+ interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+- gpio-ranges = <&tlmm 0 0 175>;
++ gpio-ranges = <&tlmm 0 0 176>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+--
+2.30.2
+
--- /dev/null
+From 45e5e3f773db10a5477be107769e454f4f0f304d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 18:47:35 +0100
+Subject: arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
+
+[ Upstream commit c8aebc1346522d3569690867ce3996642ad52e01 ]
+
+This fixes the bindings in media framework:
+The CSI40 is endpoint number 2
+The CSI41 is endpoint number 3
+
+Signed-off-by: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20210312174735.2118212-1-niklas.soderlund+renesas@ragnatech.se
+Fixes: 3182aa4e0bf4d0ee ("arm64: dts: renesas: r8a77980: add CSI2/VIN support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77980.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+index e81cd83b138b..4b9d4f1bbe01 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+@@ -990,8 +990,8 @@
+
+ reg = <1>;
+
+- vin4csi41: endpoint@2 {
+- reg = <2>;
++ vin4csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin4>;
+ };
+ };
+@@ -1018,8 +1018,8 @@
+
+ reg = <1>;
+
+- vin5csi41: endpoint@2 {
+- reg = <2>;
++ vin5csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin5>;
+ };
+ };
+@@ -1046,8 +1046,8 @@
+
+ reg = <1>;
+
+- vin6csi41: endpoint@2 {
+- reg = <2>;
++ vin6csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin6>;
+ };
+ };
+@@ -1074,8 +1074,8 @@
+
+ reg = <1>;
+
+- vin7csi41: endpoint@2 {
+- reg = <2>;
++ vin7csi41: endpoint@3 {
++ reg = <3>;
+ remote-endpoint = <&csi41vin7>;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 9ea6138cb91d96ccb4e9aee07b026527e1e23fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 02:31:49 +0900
+Subject: arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay
+ pins for RTL8211E
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ]
+
+UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have
+the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY
+pins.
+
+After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the delays are working correctly, however, "rgmii" means
+no delay and the phy doesn't work. So need to set the phy-mode to
+"rgmii-id" to show that RX/TX delays are enabled.
+
+Fixes: c73730ee4c9a ("arm64: dts: uniphier: add AVE ethernet node")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +-
+ arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+index b658f2b641e2..3348a32f7d0b 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+@@ -718,7 +718,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+index d6f6cee4d549..6537c69de3dd 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+@@ -509,7 +509,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+@@ -530,7 +530,7 @@
+ clocks = <&sys_clk 7>;
+ reset-names = "ether";
+ resets = <&sys_rst 7>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 1>;
+
+--
+2.30.2
+
--- /dev/null
+From 1c11d251b1724e309706a0e4f1fb0575b69a4c4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 14:33:43 +0800
+Subject: ASoC: ak5558: correct reset polarity
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ]
+
+Reset (aka power off) happens when the reset gpio is made active.
+The reset gpio is GPIO_ACTIVE_LOW
+
+Fixes: 920884777480 ("ASoC: ak5558: Add support for AK5558 ADC driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1618382024-31725-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak5558.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c
+index 5eb4168bb9d9..e98312a6b840 100644
+--- a/sound/soc/codecs/ak5558.c
++++ b/sound/soc/codecs/ak5558.c
+@@ -264,7 +264,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
+ usleep_range(1000, 2000);
+ }
+
+@@ -273,7 +273,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
+ usleep_range(1000, 2000);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1675d0cab190d07e42bf744e1c96376ab3bf9b1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:20:27 +0200
+Subject: ASoC: simple-card: fix possible uninitialized single_cpu local
+ variable
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit fa74c223b6fd78a5314b4c61b9abdbed3c2185b4 ]
+
+The 'single_cpu' local variable is assigned by asoc_simple_parse_dai()
+and later used in a asoc_simple_canonicalize_cpu() call, assuming the
+entire function did not exit on errors.
+
+However the first function returns 0 if passed device_node is NULL,
+thus leaving the variable uninitialized and reporting success.
+
+Addresses-Coverity: Uninitialized scalar variable
+Fixes: 8f7f298a3337 ("ASoC: simple-card-utils: separate asoc_simple_card_parse_dai()")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20210407092027.60769-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/audio-graph-card.c | 2 +-
+ sound/soc/generic/simple-card.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 6007e6305735..1bc498124689 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -340,7 +340,7 @@ static int graph_dai_link_of(struct asoc_simple_priv *priv,
+ struct device_node *top = dev->of_node;
+ struct asoc_simple_dai *cpu_dai;
+ struct asoc_simple_dai *codec_dai;
+- int ret, single_cpu;
++ int ret, single_cpu = 0;
+
+ /* Do it only CPU turn */
+ if (!li->cpu)
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index fc9c753db8dd..4484c40c7a39 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -258,7 +258,7 @@ static int simple_dai_link_of(struct asoc_simple_priv *priv,
+ struct device_node *plat = NULL;
+ char prop[128];
+ char *prefix = "";
+- int ret, single_cpu;
++ int ret, single_cpu = 0;
+
+ /*
+ * |CPU |Codec : turn
+--
+2.30.2
+
--- /dev/null
+From 3e5986633f04a417fbeb43d772cb108d08af7c3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Mar 2021 23:15:06 +0300
+Subject: ata: libahci_platform: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ]
+
+Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0
+early (as if the call was successful). Override IRQ0 with -EINVAL instead
+as the 'libata' regards 0 as "no IRQ" (thus polling) anyway...
+
+Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci_platform.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index a1cbb894e5f0..416cfbf2f1c2 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -582,11 +582,13 @@ int ahci_platform_init_host(struct platform_device *pdev,
+ int i, irq, n_ports, rc;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ if (irq < 0) {
+ if (irq != -EPROBE_DEFER)
+ dev_err(dev, "no irq\n");
+ return irq;
+ }
++ if (!irq)
++ return -EINVAL;
+
+ hpriv->irq = irq;
+
+--
+2.30.2
+
--- /dev/null
+From 3b0ef8fed8569956b40846f57e9ea29d466ab095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 17:02:28 -0600
+Subject: ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without
+ lock
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ]
+
+ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock
+winthout locking it first when peer reason doesn't match the valid
+cases for this function.
+
+Add a default case to return without unlocking.
+
+Fixes: 09078368d516 ("ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()")
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210406230228.31301-1-skhan@linuxfoundation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index d38276ac375e..315d20f5c8eb 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -461,6 +461,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
+ GFP_ATOMIC
+ );
+ break;
++ default:
++ kfree(tb);
++ return;
+ }
+
+ exit:
+--
+2.30.2
+
--- /dev/null
+From eff69bc2d1a26b87ff14bac471e86b89a10a3f5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 19:08:19 +0100
+Subject: ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]
+
+When the error check in ath9k_hw_read_revisions() was added, it checked for
+-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However,
+for plain ath9k, the register read function uses ioread32(), which just
+returns -1 on error. So if such a read fails, it still gets passed through
+and ends up as a weird mac revision in the log output.
+
+Fix this by changing ath9k_regread() to return -1 on error like ioread32()
+does, and fix the error check to look for that instead of -EIO.
+
+Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
+ drivers/net/wireless/ath/ath9k/hw.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 40a065028ebe..11054c17a9b5 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
+ if (unlikely(r)) {
+ ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n",
+ reg_offset, r);
+- return -EIO;
++ return -1;
+ }
+
+ return be32_to_cpu(val);
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 052deffb4c9d..9fd8e64288ff 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+
+ srev = REG_READ(ah, AR_SREV);
+
+- if (srev == -EIO) {
++ if (srev == -1) {
+ ath_err(ath9k_hw_common(ah),
+ "Failed to read SREV register");
+ return false;
+--
+2.30.2
+
--- /dev/null
+From 1b53f519d2d3289126b8e2ae820b328d3a7ad10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 18:13:19 -0400
+Subject: bnxt_en: Fix RX consumer index logic in the error path.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit bbd6f0a948139970f4a615dff189d9a503681a39 ]
+
+In bnxt_rx_pkt(), the RX buffers are expected to complete in order.
+If the RX consumer index indicates an out of order buffer completion,
+it means we are hitting a hardware bug and the driver will abort all
+remaining RX packets and reset the RX ring. The RX consumer index
+that we pass to bnxt_discard_rx() is not correct. We should be
+passing the current index (tmp_raw_cons) instead of the old index
+(raw_cons). This bug can cause us to be at the wrong index when
+trying to abort the next RX packet. It can crash like this:
+
+ #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007
+ #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232
+ #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e
+ #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978
+ #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0
+ #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e
+ #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24
+ #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e
+ #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12
+ #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5
+ [exception RIP: bnxt_rx_pkt+237]
+ RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213
+ RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000
+ RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000
+ RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d
+ R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0
+ R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+
+Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 04386e4078de..588389697cf9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1728,12 +1728,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+
+ cons = rxcmp->rx_cmp_opaque;
+ if (unlikely(cons != rxr->rx_next_cons)) {
+- int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
++ int rc1 = bnxt_discard_rx(bp, cpr, &tmp_raw_cons, rxcmp);
+
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+ cons, rxr->rx_next_cons);
+ bnxt_sched_reset(bp, rxr);
+- return rc1;
++ if (rc1)
++ return rc1;
++ goto next_rx_no_prod_no_len;
+ }
+ rx_buf = &rxr->rx_buf_ring[cons];
+ data = rx_buf->data;
+--
+2.30.2
+
--- /dev/null
+From ba510d46382927e277e7b88229a1bbf18ac73c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 12:10:28 +0300
+Subject: bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ]
+
+The problem is that bnxt_show_temp() returns long but "rc" is an int
+and "len" is a u32. With ternary operations the type promotion is quite
+tricky. The negative "rc" is first promoted to u32 and then to long so
+it ends up being a high positive value instead of a a negative as we
+intended.
+
+Fix this by removing the ternary.
+
+Fixes: d69753fa1ecb ("bnxt_en: return proper error codes in bnxt_show_temp")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 5a7831a97a13..04386e4078de 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8954,7 +8954,9 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ if (!rc)
+ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+- return rc ?: len;
++ if (rc)
++ return rc;
++ return len;
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+--
+2.30.2
+
--- /dev/null
+From 697e5ace4b3ec6a1abc4ca404ee0ec914b748507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 14:33:07 +0000
+Subject: bug: Remove redundant condition check in report_bug
+
+From: Andrew Scull <ascull@google.com>
+
+[ Upstream commit 3ad1a6cb0abc63d036fc866bd7c2c5983516dec5 ]
+
+report_bug() will return early if it cannot find a bug corresponding to
+the provided address. The subsequent test for the bug will always be
+true so remove it.
+
+Fixes: 1b4cfe3c0a30d ("lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()")
+Signed-off-by: Andrew Scull <ascull@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210318143311.839894-2-ascull@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/bug.c | 33 +++++++++++++++------------------
+ 1 file changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/lib/bug.c b/lib/bug.c
+index 8c98af0bf585..c3aa22cbc876 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -155,30 +155,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
+
+ file = NULL;
+ line = 0;
+- warning = 0;
+
+- if (bug) {
+ #ifdef CONFIG_DEBUG_BUGVERBOSE
+ #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS
+- file = bug->file;
++ file = bug->file;
+ #else
+- file = (const char *)bug + bug->file_disp;
++ file = (const char *)bug + bug->file_disp;
+ #endif
+- line = bug->line;
++ line = bug->line;
+ #endif
+- warning = (bug->flags & BUGFLAG_WARNING) != 0;
+- once = (bug->flags & BUGFLAG_ONCE) != 0;
+- done = (bug->flags & BUGFLAG_DONE) != 0;
+-
+- if (warning && once) {
+- if (done)
+- return BUG_TRAP_TYPE_WARN;
+-
+- /*
+- * Since this is the only store, concurrency is not an issue.
+- */
+- bug->flags |= BUGFLAG_DONE;
+- }
++ warning = (bug->flags & BUGFLAG_WARNING) != 0;
++ once = (bug->flags & BUGFLAG_ONCE) != 0;
++ done = (bug->flags & BUGFLAG_DONE) != 0;
++
++ if (warning && once) {
++ if (done)
++ return BUG_TRAP_TYPE_WARN;
++
++ /*
++ * Since this is the only store, concurrency is not an issue.
++ */
++ bug->flags |= BUGFLAG_DONE;
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 7649c88b92b13dbc7c85cb45be0e260f55a2f2c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 03:49:07 -0800
+Subject: bus: qcom: Put child node before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 ]
+
+Put child node before return to fix potential reference count leak.
+Generally, the reference count of child is incremented and decremented
+automatically in the macro for_each_available_child_of_node() and should
+be decremented manually if the loop is broken in loop body.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Fixes: 335a12754808 ("bus: qcom: add EBI2 driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/qcom-ebi2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
+index 03ddcf426887..0b8f53a688b8 100644
+--- a/drivers/bus/qcom-ebi2.c
++++ b/drivers/bus/qcom-ebi2.c
+@@ -353,8 +353,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
+
+ /* Figure out the chipselect */
+ ret = of_property_read_u32(child, "reg", &csindex);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ return ret;
++ }
+
+ if (csindex > 5) {
+ dev_err(dev,
+--
+2.30.2
+
--- /dev/null
+From 5a0a28522ad8a05168163f902f9e1cac5510d8a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:18 +0200
+Subject: clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz
+ to 1 GHz
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 4decb9187589f61fe9fc2bc4d9b01160b0a610c5 ]
+
+It was observed that the workaround introduced by commit 61c40f35f5cd
+("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to
+1.2GHz") when base CPU frequency is 1.2 GHz is also required when base
+CPU frequency is 1 GHz. Otherwise switching CPU frequency directly from
+L2 (250 MHz) to L0 (1 GHz) causes a crash.
+
+When base CPU frequency is just 800 MHz no crashed were observed during
+switch from L2 to L0.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index d5226ab8e26f..5193dc817197 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -485,8 +485,10 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ /*
+- * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+- * respectively) to L0 frequency (1.2 Ghz) requires a significant
++ * Workaround when base CPU frequnecy is 1000 or 1200 MHz
++ *
++ * Switching the CPU from the L2 or L3 frequencies (250/300 or 200 MHz
++ * respectively) to L0 frequency (1/1.2 GHz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+@@ -496,15 +498,15 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+- * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
++ * 1. First switch from L2/L3 (200/250/300 MHz) to L1 (500/600 MHz)
+ * 2. Sleep 20ms for stabling VDD voltage
+- * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
++ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz).
+ */
+ static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
+ {
+ unsigned int cur_level;
+
+- if (rate != 1200 * 1000 * 1000)
++ if (rate < 1000 * 1000 * 1000)
+ return;
+
+ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+--
+2.30.2
+
--- /dev/null
+From 52f72eb8a8060cffdbbbf3f709de42040648408b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:19 +0200
+Subject: clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1
+ to L0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit e93033aff684641f71a436ca7a9d2a742126baaf ]
+
+When CPU frequency is at 250 MHz and set_rate() is called with 500 MHz (L1)
+quickly followed by a call with 1 GHz (L0), the CPU does not necessarily
+stay in L1 for at least 20ms as is required by Marvell errata.
+
+This situation happens frequently with the ondemand cpufreq governor and
+can be also reproduced with userspace governor. In most cases it causes CPU
+to crash.
+
+This change fixes the above issue and ensures that the CPU always stays in
+L1 for at least 20ms when switching from any state to L0.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 61c40f35f5cd ("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to 1.2GHz")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 45 ++++++++++++++++++++++----
+ 1 file changed, 39 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index 5193dc817197..07e47c34e073 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -84,6 +84,7 @@ struct clk_pm_cpu {
+ void __iomem *reg_div;
+ u8 shift_div;
+ struct regmap *nb_pm_base;
++ unsigned long l1_expiration;
+ };
+
+ #define to_clk_double_div(_hw) container_of(_hw, struct clk_double_div, hw)
+@@ -502,22 +503,52 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ * 2. Sleep 20ms for stabling VDD voltage
+ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz).
+ */
+-static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
++static void clk_pm_cpu_set_rate_wa(struct clk_pm_cpu *pm_cpu,
++ unsigned int new_level, unsigned long rate,
++ struct regmap *base)
+ {
+ unsigned int cur_level;
+
+- if (rate < 1000 * 1000 * 1000)
+- return;
+-
+ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+ cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+- if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
++
++ if (cur_level == new_level)
++ return;
++
++ /*
++ * System wants to go to L1 on its own. If we are going from L2/L3,
++ * remember when 20ms will expire. If from L0, set the value so that
++ * next switch to L0 won't have to wait.
++ */
++ if (new_level == ARMADA_37XX_DVFS_LOAD_1) {
++ if (cur_level == ARMADA_37XX_DVFS_LOAD_0)
++ pm_cpu->l1_expiration = jiffies;
++ else
++ pm_cpu->l1_expiration = jiffies + msecs_to_jiffies(20);
+ return;
++ }
++
++ /*
++ * If we are setting to L2/L3, just invalidate L1 expiration time,
++ * sleeping is not needed.
++ */
++ if (rate < 1000*1000*1000)
++ goto invalidate_l1_exp;
++
++ /*
++ * We are going to L0 with rate >= 1GHz. Check whether we have been at
++ * L1 for long enough time. If not, go to L1 for 20ms.
++ */
++ if (pm_cpu->l1_expiration && jiffies >= pm_cpu->l1_expiration)
++ goto invalidate_l1_exp;
+
+ regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+ ARMADA_37XX_NB_CPU_LOAD_MASK,
+ ARMADA_37XX_DVFS_LOAD_1);
+ msleep(20);
++
++invalidate_l1_exp:
++ pm_cpu->l1_expiration = 0;
+ }
+
+ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -551,7 +582,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+ reg = ARMADA_37XX_NB_CPU_LOAD;
+ mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+- clk_pm_cpu_set_rate_wa(rate, base);
++ /* Apply workaround when base CPU frequency is 1000 or 1200 MHz */
++ if (parent_rate >= 1000*1000*1000)
++ clk_pm_cpu_set_rate_wa(pm_cpu, load_level, rate, base);
+
+ regmap_update_bits(base, reg, mask, load_level);
+
+--
+2.30.2
+
--- /dev/null
+From 05179cf2ce74aec78e9709b94a4d2a27d4696d9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:16 +0200
+Subject: clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM
+ clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 4e435a9dd26c46ac018997cc0562d50b1a96f372 ]
+
+Remove the .set_parent method in clk_pm_cpu_ops.
+
+This method was supposed to be needed by the armada-37xx-cpufreq driver,
+but was never actually called due to wrong assumptions in the cpufreq
+driver. After this was fixed in the cpufreq driver, this method is not
+needed anymore.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Pali Rohár <pali@kernel.org>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 28 --------------------------
+ 1 file changed, 28 deletions(-)
+
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index 5fc6d486a381..d5226ab8e26f 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -438,33 +438,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw)
+ return val;
+ }
+
+-static int clk_pm_cpu_set_parent(struct clk_hw *hw, u8 index)
+-{
+- struct clk_pm_cpu *pm_cpu = to_clk_pm_cpu(hw);
+- struct regmap *base = pm_cpu->nb_pm_base;
+- int load_level;
+-
+- /*
+- * We set the clock parent only if the DVFS is available but
+- * not enabled.
+- */
+- if (IS_ERR(base) || armada_3700_pm_dvfs_is_enabled(base))
+- return -EINVAL;
+-
+- /* Set the parent clock for all the load level */
+- for (load_level = 0; load_level < LOAD_LEVEL_NR; load_level++) {
+- unsigned int reg, mask, val,
+- offset = ARMADA_37XX_NB_TBG_SEL_OFF;
+-
+- armada_3700_pm_dvfs_update_regs(load_level, ®, &offset);
+-
+- val = index << offset;
+- mask = ARMADA_37XX_NB_TBG_SEL_MASK << offset;
+- regmap_update_bits(base, reg, mask, val);
+- }
+- return 0;
+-}
+-
+ static unsigned long clk_pm_cpu_recalc_rate(struct clk_hw *hw,
+ unsigned long parent_rate)
+ {
+@@ -590,7 +563,6 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops clk_pm_cpu_ops = {
+ .get_parent = clk_pm_cpu_get_parent,
+- .set_parent = clk_pm_cpu_set_parent,
+ .round_rate = clk_pm_cpu_round_rate,
+ .set_rate = clk_pm_cpu_set_rate,
+ .recalc_rate = clk_pm_cpu_recalc_rate,
+--
+2.30.2
+
--- /dev/null
+From 2a6c658b80901cf916e79b1091415f5023482520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 16:23:51 +0800
+Subject: clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
+
+From: Chen Hui <clare.chenhui@huawei.com>
+
+[ Upstream commit 790b516ada10a4dcc0f0a56dc0ced475d86d5820 ]
+
+CONFIG_QCOM_A53PLL is tristate option and therefore this driver can be
+compiled as a module. This patch adds missing MODULE_DEVICE_TABLE
+definition which generates correct modalias for automatic loading of
+this driver when it is built as an external module.
+
+Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support")
+Signed-off-by: Chen Hui <clare.chenhui@huawei.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210409082352.233810-3-clare.chenhui@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/a53-pll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c
+index 45cfc57bff92..af6ac17c7dae 100644
+--- a/drivers/clk/qcom/a53-pll.c
++++ b/drivers/clk/qcom/a53-pll.c
+@@ -93,6 +93,7 @@ static const struct of_device_id qcom_a53pll_match_table[] = {
+ { .compatible = "qcom,msm8916-a53pll" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, qcom_a53pll_match_table);
+
+ static struct platform_driver qcom_a53pll_driver = {
+ .probe = qcom_a53pll_probe,
+--
+2.30.2
+
--- /dev/null
+From 74146868aeb2215922562bb8fa2f75642904cf5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 10:01:03 +0100
+Subject: clk: uniphier: Fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f6b1340dc751a6caa2a0567b667d0f4f4172cd58 ]
+
+The for-loop iterates with a u8 loop counter i and compares this
+with the loop upper limit of num_parents that is an int type.
+There is a potential infinite loop if num_parents is larger than
+the u8 loop counter. Fix this by making the loop counter the same
+type as num_parents. Also make num_parents an unsigned int to
+match the return type of the call to clk_hw_get_num_parents.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Link: https://lore.kernel.org/r/20210409090104.629722-1-colin.king@canonical.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c
+index c0f4631601e2..babca032352a 100644
+--- a/drivers/clk/uniphier/clk-uniphier-mux.c
++++ b/drivers/clk/uniphier/clk-uniphier-mux.c
+@@ -31,10 +31,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
+ {
+ struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
+- int num_parents = clk_hw_get_num_parents(hw);
++ unsigned int num_parents = clk_hw_get_num_parents(hw);
+ int ret;
+ unsigned int val;
+- u8 i;
++ unsigned int i;
+
+ ret = regmap_read(mux->regmap, mux->reg, &val);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 1adf5bf08b173bc97f48552654ede1a9ca335b9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 23:40:15 +0800
+Subject: clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit d7fd3f9f53df8bb2212dff70f66f12cae0e1a653 ]
+
+The round_rate callback should only perform rate calculation and not
+involve calling zynqmp_pll_set_mode to change the pll mode. So let's
+move zynqmp_pll_set_mode out of round_rate and to set_rate callback.
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210406154015.602779-1-quanyang.wang@windriver.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/pll.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c
+index a541397a172c..18fee827602a 100644
+--- a/drivers/clk/zynqmp/pll.c
++++ b/drivers/clk/zynqmp/pll.c
+@@ -103,9 +103,7 @@ static long zynqmp_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+ /* Enable the fractional mode if needed */
+ rate_div = (rate * FRAC_DIV) / *prate;
+ f = rate_div % FRAC_DIV;
+- zynqmp_pll_set_mode(hw, !!f);
+-
+- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) {
++ if (f) {
+ if (rate > PS_PLL_VCO_MAX) {
+ fbdiv = rate / PS_PLL_VCO_MAX;
+ rate = rate / (fbdiv + 1);
+@@ -179,10 +177,12 @@ static int zynqmp_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ int ret;
+ const struct zynqmp_eemi_ops *eemi_ops = zynqmp_pm_get_eemi_ops();
+
+- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) {
+- rate_div = (rate * FRAC_DIV) / parent_rate;
++ rate_div = (rate * FRAC_DIV) / parent_rate;
++ f = rate_div % FRAC_DIV;
++ zynqmp_pll_set_mode(hw, !!f);
++
++ if (f) {
+ m = rate_div / FRAC_DIV;
+- f = rate_div % FRAC_DIV;
+ m = clamp_t(u32, m, (PLL_FBDIV_MIN), (PLL_FBDIV_MAX));
+ rate = parent_rate * m;
+ frac = (parent_rate * f) / FRAC_DIV;
+--
+2.30.2
+
--- /dev/null
+From bf6c01edb01f6286ef2c6168bd8951beac507d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:21 +0200
+Subject: cpufreq: armada-37xx: Fix determining base CPU frequency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 8bad3bf23cbc40abe1d24cec08a114df6facf858 ]
+
+When current CPU load is not L0 then loading armada-37xx-cpufreq.ko driver
+fails with following error:
+
+ # modprobe armada-37xx-cpufreq
+ [ 502.702097] Unsupported CPU frequency 250 MHz
+
+This issue was partially fixed by commit 8db82563451f ("cpufreq:
+armada-37xx: fix frequency calculation for opp"), but only for calculating
+CPU frequency for opp.
+
+Fix this also for determination of base CPU frequency.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 1ab2113daef5..e4782f562e7a 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -469,7 +469,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ return -EINVAL;
+ }
+
+- dvfs = armada_37xx_cpu_freq_info_get(cur_frequency);
++ dvfs = armada_37xx_cpu_freq_info_get(base_frequency);
+ if (!dvfs) {
+ clk_put(clk);
+ return -EINVAL;
+--
+2.30.2
+
--- /dev/null
+From ed623683974c5b2785cb1fcbda26684f2ffd99f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:20 +0200
+Subject: cpufreq: armada-37xx: Fix driver cleanup when registration failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 92963903a8e11b9576eb7249f8e81eefa93b6f96 ]
+
+Commit 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for
+opp") changed calculation of frequency passed to the dev_pm_opp_add()
+function call. But the code for dev_pm_opp_remove() function call was not
+updated, so the driver cleanup phase does not work when registration fails.
+
+This fixes the issue by using the same frequency in both calls.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for opp")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index c7683d447b11..1ab2113daef5 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -521,7 +521,7 @@ disable_dvfs:
+ remove_opp:
+ /* clean-up the already added opp before leaving */
+ while (load_lvl-- > ARMADA_37XX_DVFS_LOAD_0) {
+- freq = cur_frequency / dvfs->divider[load_lvl];
++ freq = base_frequency / dvfs->divider[load_lvl];
+ dev_pm_opp_remove(cpu_dev, freq);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 11719c3c552c946b00daa6c5bb1d423b3f297275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:15 +0200
+Subject: cpufreq: armada-37xx: Fix setting TBG parent for load levels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 22592df194e31baf371906cc720da38fa0ab68f5 ]
+
+With CPU frequency determining software [1] we have discovered that
+after this driver does one CPU frequency change, the base frequency of
+the CPU is set to the frequency of TBG-A-P clock, instead of the TBG
+that is parent to the CPU.
+
+This can be reproduced on EspressoBIN and Turris MOX:
+ cd /sys/devices/system/cpu/cpufreq/policy0
+ echo powersave >scaling_governor
+ echo performance >scaling_governor
+
+Running the mhz tool before this driver is loaded reports 1000 MHz, and
+after loading the driver and executing commands above the tool reports
+800 MHz.
+
+The change of TBG clock selector is supposed to happen in function
+armada37xx_cpufreq_dvfs_setup. Before the function returns, it does
+this:
+ parent = clk_get_parent(clk);
+ clk_set_parent(clk, parent);
+
+The armada-37xx-periph clock driver has the .set_parent method
+implemented correctly for this, so if the method was actually called,
+this would work. But since the introduction of the common clock
+framework in commit b2476490ef11 ("clk: introduce the common clock..."),
+the clk_set_parent function checks whether the parent is actually
+changing, and if the requested new parent is same as the old parent
+(which is obviously the case for the code above), the .set_parent method
+is not called at all.
+
+This patch fixes this issue by filling the correct TBG clock selector
+directly in the armada37xx_cpufreq_dvfs_setup during the filling of
+other registers at the same address. But the determination of CPU TBG
+index cannot be done via the common clock framework, therefore we need
+to access the North Bridge Peripheral Clock registers directly in this
+driver.
+
+[1] https://github.com/wtarreau/mhz
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Pali Rohár <pali@kernel.org>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 35 ++++++++++++++++++---------
+ 1 file changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index b4af4094309b..b8dc6c849579 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -25,6 +25,10 @@
+
+ #include "cpufreq-dt.h"
+
++/* Clk register set */
++#define ARMADA_37XX_CLK_TBG_SEL 0
++#define ARMADA_37XX_CLK_TBG_SEL_CPU_OFF 22
++
+ /* Power management in North Bridge register set */
+ #define ARMADA_37XX_NB_L0L1 0x18
+ #define ARMADA_37XX_NB_L2L3 0x1C
+@@ -120,10 +124,15 @@ static struct armada_37xx_dvfs *armada_37xx_cpu_freq_info_get(u32 freq)
+ * will be configured then the DVFS will be enabled.
+ */
+ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+- struct clk *clk, u8 *divider)
++ struct regmap *clk_base, u8 *divider)
+ {
++ u32 cpu_tbg_sel;
+ int load_lvl;
+- struct clk *parent;
++
++ /* Determine to which TBG clock is CPU connected */
++ regmap_read(clk_base, ARMADA_37XX_CLK_TBG_SEL, &cpu_tbg_sel);
++ cpu_tbg_sel >>= ARMADA_37XX_CLK_TBG_SEL_CPU_OFF;
++ cpu_tbg_sel &= ARMADA_37XX_NB_TBG_SEL_MASK;
+
+ for (load_lvl = 0; load_lvl < LOAD_LEVEL_NR; load_lvl++) {
+ unsigned int reg, mask, val, offset = 0;
+@@ -142,6 +151,11 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+ mask = (ARMADA_37XX_NB_CLK_SEL_MASK
+ << ARMADA_37XX_NB_CLK_SEL_OFF);
+
++ /* Set TBG index, for all levels we use the same TBG */
++ val = cpu_tbg_sel << ARMADA_37XX_NB_TBG_SEL_OFF;
++ mask = (ARMADA_37XX_NB_TBG_SEL_MASK
++ << ARMADA_37XX_NB_TBG_SEL_OFF);
++
+ /*
+ * Set cpu divider based on the pre-computed array in
+ * order to have balanced step.
+@@ -160,14 +174,6 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+
+ regmap_update_bits(base, reg, mask, val);
+ }
+-
+- /*
+- * Set cpu clock source, for all the level we keep the same
+- * clock source that the one already configured. For this one
+- * we need to use the clock framework
+- */
+- parent = clk_get_parent(clk);
+- clk_set_parent(clk, parent);
+ }
+
+ /*
+@@ -358,11 +364,16 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ struct platform_device *pdev;
+ unsigned long freq;
+ unsigned int cur_frequency, base_frequency;
+- struct regmap *nb_pm_base, *avs_base;
++ struct regmap *nb_clk_base, *nb_pm_base, *avs_base;
+ struct device *cpu_dev;
+ int load_lvl, ret;
+ struct clk *clk, *parent;
+
++ nb_clk_base =
++ syscon_regmap_lookup_by_compatible("marvell,armada-3700-periph-clock-nb");
++ if (IS_ERR(nb_clk_base))
++ return -ENODEV;
++
+ nb_pm_base =
+ syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm");
+
+@@ -439,7 +450,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ armada37xx_cpufreq_avs_configure(avs_base, dvfs);
+ armada37xx_cpufreq_avs_setup(avs_base, dvfs);
+
+- armada37xx_cpufreq_dvfs_setup(nb_pm_base, clk, dvfs->divider);
++ armada37xx_cpufreq_dvfs_setup(nb_pm_base, nb_clk_base, dvfs->divider);
+ clk_put(clk);
+
+ for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR;
+--
+2.30.2
+
--- /dev/null
+From df2ae81cc2be142e7db7a44b91b8097be262e7b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:42:17 +0200
+Subject: cpufreq: armada-37xx: Fix the AVS value for load L1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit d118ac2062b5b8331c8768ac81e016617e0996ee ]
+
+The original CPU voltage value for load L1 is too low for Armada 37xx SoC
+when base CPU frequency is 1000 or 1200 MHz. It leads to instabilities
+where CPU gets stuck soon after dynamic voltage scaling from load L1 to L0.
+
+Update the CPU voltage value for load L1 accordingly when base frequency is
+1000 or 1200 MHz. The minimal L1 value for base CPU frequency 1000 MHz is
+updated from the original 1.05V to 1.108V and for 1200 MHz is updated to
+1.155V. This minimal L1 value is used only in the case when it is lower
+than value for L0.
+
+This change fixes CPU instability issues on 1 GHz and 1.2 GHz variants of
+Espressobin and 1 GHz Turris Mox.
+
+Marvell previously for 1 GHz variant of Espressobin provided a patch [1]
+suitable only for their Marvell Linux kernel 4.4 fork which workarounded
+this issue. Patch forced CPU voltage value to 1.108V in all loads. But
+such change does not fix CPU instability issues on 1.2 GHz variants of
+Armada 3720 SoC.
+
+During testing we come to the conclusion that using 1.108V as minimal
+value for L1 load makes 1 GHz variants of Espressobin and Turris Mox boards
+stable. And similarly 1.155V for 1.2 GHz variant of Espressobin.
+
+These two values 1.108V and 1.155V are documented in Armada 3700 Hardware
+Specifications as typical initial CPU voltage values.
+
+Discussion about this issue is also at the Armbian forum [2].
+
+[1] - https://github.com/MarvellEmbeddedProcessors/linux-marvell/commit/dc33b62c90696afb6adc7dbcc4ebbd48bedec269
+[2] - https://forum.armbian.com/topic/10429-how-to-make-espressobin-v7-stable/
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Tested-by: Anders Trier Olesen <anders.trier.olesen@gmail.com>
+Tested-by: Philip Soares <philips@netisense.com>
+Fixes: 1c3528232f4b ("cpufreq: armada-37xx: Add AVS support")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 37 +++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index b8dc6c849579..c7683d447b11 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -73,6 +73,8 @@
+ #define LOAD_LEVEL_NR 4
+
+ #define MIN_VOLT_MV 1000
++#define MIN_VOLT_MV_FOR_L1_1000MHZ 1108
++#define MIN_VOLT_MV_FOR_L1_1200MHZ 1155
+
+ /* AVS value for the corresponding voltage (in mV) */
+ static int avs_map[] = {
+@@ -208,6 +210,8 @@ static u32 armada_37xx_avs_val_match(int target_vm)
+ * - L2 & L3 voltage should be about 150mv smaller than L0 voltage.
+ * This function calculates L1 & L2 & L3 AVS values dynamically based
+ * on L0 voltage and fill all AVS values to the AVS value table.
++ * When base CPU frequency is 1000 or 1200 MHz then there is additional
++ * minimal avs value for load L1.
+ */
+ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ struct armada_37xx_dvfs *dvfs)
+@@ -239,6 +243,19 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ for (load_level = 1; load_level < LOAD_LEVEL_NR; load_level++)
+ dvfs->avs[load_level] = avs_min;
+
++ /*
++ * Set the avs values for load L0 and L1 when base CPU frequency
++ * is 1000/1200 MHz to its typical initial values according to
++ * the Armada 3700 Hardware Specifications.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++ dvfs->avs[0] = dvfs->avs[1] = avs_min;
++ }
++
+ return;
+ }
+
+@@ -258,6 +275,26 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ target_vm = avs_map[l0_vdd_min] - 150;
+ target_vm = target_vm > MIN_VOLT_MV ? target_vm : MIN_VOLT_MV;
+ dvfs->avs[2] = dvfs->avs[3] = armada_37xx_avs_val_match(target_vm);
++
++ /*
++ * Fix the avs value for load L1 when base CPU frequency is 1000/1200 MHz,
++ * otherwise the CPU gets stuck when switching from load L1 to load L0.
++ * Also ensure that avs value for load L1 is not higher than for L0.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ u32 avs_min_l1;
++
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++
++ if (avs_min_l1 > dvfs->avs[0])
++ avs_min_l1 = dvfs->avs[0];
++
++ if (dvfs->avs[1] < avs_min_l1)
++ dvfs->avs[1] = avs_min_l1;
++ }
+ }
+
+ static void __init armada37xx_cpufreq_avs_setup(struct regmap *base,
+--
+2.30.2
+
--- /dev/null
+From 8546f9ec84c7c01d5f0c566cffcd51aa184fccdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 23:40:00 -0400
+Subject: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ]
+
+ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()
+before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the
+vf2pf_lock is initialized in adf_dev_init(), which can fail and when it
+fail, the vf2pf_lock is either not initialized or destroyed, a subsequent
+use of vf2pf_lock will cause issue.
+To fix this issue, only set this flag if adf_dev_init() returns 0.
+
+[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0
+[ 7.180345] Call Trace:
+[ 7.182576] mutex_lock+0xc9/0xd0
+[ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat]
+[ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]
+[ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat]
+[ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf]
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running")
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
+ drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
+ drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+index 1dc5ac859f7b..bdd4e36763f1 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+@@ -233,12 +233,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+index a68358b31292..538d9592c951 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+@@ -233,12 +233,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+index 1b762eefc6c1..5e0568c0113e 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+@@ -233,12 +233,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+--
+2.30.2
+
--- /dev/null
+From 072aab578247ee3248ac5daaaa080b6495abee87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 23:39:59 -0400
+Subject: crypto: qat - don't release uninitialized resources
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ]
+
+adf_vf_isr_resource_alloc() is not unwinding correctly when error
+happens and it want to release uninitialized resources.
+To fix this, only release initialized resources.
+
+[ 1.792845] Trying to free already-free IRQ 11
+[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
+[ 1.801340] Call Trace:
+[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
+[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
+[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver")
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index 4a73fc70f7a9..df9a1f35b832 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+ goto err_out;
+
+ if (adf_setup_pf2vf_bh(accel_dev))
+- goto err_out;
++ goto err_disable_msi;
+
+ if (adf_setup_bh(accel_dev))
+- goto err_out;
++ goto err_cleanup_pf2vf_bh;
+
+ if (adf_request_msi_irq(accel_dev))
+- goto err_out;
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_cleanup_pf2vf_bh:
++ adf_cleanup_pf2vf_bh(accel_dev);
++
++err_disable_msi:
++ adf_disable_msi(accel_dev);
++
+ err_out:
+- adf_vf_isr_resource_free(accel_dev);
+ return -EFAULT;
+ }
+ EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
+--
+2.30.2
+
--- /dev/null
+From ab0eee2b5123b8117bc2c02b8ac1d11d2fd2e56e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 10:13:48 -0700
+Subject: crypto: qat - Fix a double free in adf_create_ring
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ]
+
+In adf_create_ring, if the callee adf_init_ring() failed, the callee will
+free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then
+adf_create_ring will goto err and the ring->base_addr will be freed again
+in adf_cleanup_ring().
+
+My patch sets ring->base_addr to NULL after the first freed to avoid the
+double free.
+
+Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_transport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
+index 2136cbe4bf6c..f65ebc4117d1 100644
+--- a/drivers/crypto/qat/qat_common/adf_transport.c
++++ b/drivers/crypto/qat/qat_common/adf_transport.c
+@@ -197,6 +197,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring)
+ dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n");
+ dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes,
+ ring->base_addr, ring->dma_addr);
++ ring->base_addr = NULL;
+ return -EFAULT;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 56f953255772e4a606eb8820a1fcc45f272367d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 08:34:18 +0000
+Subject: crypto: qat - fix error path in adf_isr_resource_alloc()
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ]
+
+The function adf_isr_resource_alloc() is not unwinding correctly in case
+of error.
+This patch fixes the error paths and propagate the errors to the caller.
+
+Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_isr.c | 29 ++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
+index cd1cdf5305bc..4898ef41fd9f 100644
+--- a/drivers/crypto/qat/qat_common/adf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_isr.c
+@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+
+ ret = adf_isr_alloc_msix_entry_table(accel_dev);
+ if (ret)
+- return ret;
+- if (adf_enable_msix(accel_dev))
+ goto err_out;
+
+- if (adf_setup_bh(accel_dev))
+- goto err_out;
++ ret = adf_enable_msix(accel_dev);
++ if (ret)
++ goto err_free_msix_table;
+
+- if (adf_request_irqs(accel_dev))
+- goto err_out;
++ ret = adf_setup_bh(accel_dev);
++ if (ret)
++ goto err_disable_msix;
++
++ ret = adf_request_irqs(accel_dev);
++ if (ret)
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_disable_msix:
++ adf_disable_msix(&accel_dev->accel_pci_dev);
++
++err_free_msix_table:
++ adf_isr_free_msix_entry_table(accel_dev);
++
+ err_out:
+- adf_isr_resource_free(accel_dev);
+- return -EFAULT;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(adf_isr_resource_alloc);
+--
+2.30.2
+
--- /dev/null
+From 152dd06a359bbd7bdd747f8dbd9b295de0677009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 12:08:57 +0100
+Subject: cxgb4: Fix unintentional sign extension issues
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dd2c79677375c37f8f9f8d663eb4708495d595ef ]
+
+The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to
+the left will be promoted to a 32 bit signed int and then
+sign-extended to a u64. In the event that the top bit of the u8
+is set then all then all the upper 32 bits of the u64 end up as
+also being set because of the sign-extension. Fix this by
+casting the u8 values to a u64 before the 24 bit left shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index cb50b41cd3df..64a2453e06ba 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_lip[15] |
+ f->fs.nat_lip[14] << 8 |
+ f->fs.nat_lip[13] << 16 |
+- f->fs.nat_lip[12] << 24, 1);
++ (u64)f->fs.nat_lip[12] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1,
+ WORD_MASK, f->fs.nat_lip[11] |
+ f->fs.nat_lip[10] << 8 |
+ f->fs.nat_lip[9] << 16 |
+- f->fs.nat_lip[8] << 24, 1);
++ (u64)f->fs.nat_lip[8] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2,
+ WORD_MASK, f->fs.nat_lip[7] |
+ f->fs.nat_lip[6] << 8 |
+ f->fs.nat_lip[5] << 16 |
+- f->fs.nat_lip[4] << 24, 1);
++ (u64)f->fs.nat_lip[4] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3,
+ WORD_MASK, f->fs.nat_lip[3] |
+ f->fs.nat_lip[2] << 8 |
+ f->fs.nat_lip[1] << 16 |
+- f->fs.nat_lip[0] << 24, 1);
++ (u64)f->fs.nat_lip[0] << 24, 1);
+ } else {
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W,
+ WORD_MASK, f->fs.nat_lip[3] |
+ f->fs.nat_lip[2] << 8 |
+ f->fs.nat_lip[1] << 16 |
+- f->fs.nat_lip[0] << 24, 1);
++ (u64)f->fs.nat_lip[0] << 25, 1);
+ }
+ }
+
+@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_fip[15] |
+ f->fs.nat_fip[14] << 8 |
+ f->fs.nat_fip[13] << 16 |
+- f->fs.nat_fip[12] << 24, 1);
++ (u64)f->fs.nat_fip[12] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1,
+ WORD_MASK, f->fs.nat_fip[11] |
+ f->fs.nat_fip[10] << 8 |
+ f->fs.nat_fip[9] << 16 |
+- f->fs.nat_fip[8] << 24, 1);
++ (u64)f->fs.nat_fip[8] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2,
+ WORD_MASK, f->fs.nat_fip[7] |
+ f->fs.nat_fip[6] << 8 |
+ f->fs.nat_fip[5] << 16 |
+- f->fs.nat_fip[4] << 24, 1);
++ (u64)f->fs.nat_fip[4] << 24, 1);
+
+ set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3,
+ WORD_MASK, f->fs.nat_fip[3] |
+ f->fs.nat_fip[2] << 8 |
+ f->fs.nat_fip[1] << 16 |
+- f->fs.nat_fip[0] << 24, 1);
++ (u64)f->fs.nat_fip[0] << 24, 1);
+
+ } else {
+ set_tcb_field(adap, f, tid,
+@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ WORD_MASK, f->fs.nat_fip[3] |
+ f->fs.nat_fip[2] << 8 |
+ f->fs.nat_fip[1] << 16 |
+- f->fs.nat_fip[0] << 24, 1);
++ (u64)f->fs.nat_fip[0] << 24, 1);
+ }
+ }
+
+ set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK,
+ (dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) |
+- (sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0),
++ (sp ? (nat_fp[1] << 16 | (u64)nat_fp[0] << 24) : 0),
+ 1);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 202fe8e4a4af6e4af0adfc11be254008a66b20aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 07:32:29 -0700
+Subject: drivers/block/null_blk/main: Fix a double free in null_init.
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 72ce11ddfa4e9e1879103581a60b7e34547eaa0a ]
+
+In null_init, null_add_dev(dev) is called.
+In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones
+via kvfree(dev->zones) in out_cleanup_zone branch and returns err.
+Then null_init accept the err code and then calls null_free_dev(dev).
+
+But in null_free_dev(dev), dev->zones is freed again by
+null_free_zoned_dev().
+
+My patch set dev->zones to NULL in null_free_zoned_dev() after
+kvfree(dev->zones) is called, to avoid the double free.
+
+Fixes: 2984c8684f962 ("nullb: factor disk parameters")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Link: https://lore.kernel.org/r/20210426143229.7374-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk_zoned.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
+index 5f1376578ea3..90dcf4a915f4 100644
+--- a/drivers/block/null_blk_zoned.c
++++ b/drivers/block/null_blk_zoned.c
+@@ -73,6 +73,7 @@ int null_zone_init(struct nullb_device *dev)
+ void null_zone_exit(struct nullb_device *dev)
+ {
+ kvfree(dev->zones);
++ dev->zones = NULL;
+ }
+
+ int null_zone_report(struct gendisk *disk, sector_t sector,
+--
+2.30.2
+
--- /dev/null
+From 38511d51f3e13d2c53e18176cd345905d2af16cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 21:48:09 -0700
+Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 ]
+
+When running in Azure, disks may be connected to a Linux VM with
+read/write caching enabled. If a VM panics and issues a VMbus
+UNLOAD request to Hyper-V, the response is delayed until all dirty
+data in the disk cache is flushed. In extreme cases, this flushing
+can take 10's of seconds, depending on the disk speed and the amount
+of dirty data. If kdump is configured for the VM, the current 10 second
+timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD
+complete message may arrive well after the kdump kernel is already
+running, causing problems. Note that no problem occurs if kdump is
+not enabled because Hyper-V waits for the cache flush before doing
+a reboot through the BIOS/UEFI code.
+
+Fix this problem by increasing the timeout in vmbus_wait_for_unload()
+to 100 seconds. Also output periodic messages so that if anyone is
+watching the serial console, they won't think the VM is completely
+hung.
+
+Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload")
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 0b55bc146b29..9260ad47350f 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -763,6 +763,12 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ free_cpumask_var(available_mask);
+ }
+
++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */
++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */
++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS)
++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */
++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS)
++
+ static void vmbus_wait_for_unload(void)
+ {
+ int cpu;
+@@ -780,12 +786,17 @@ static void vmbus_wait_for_unload(void)
+ * vmbus_connection.unload_event. If not, the last thing we can do is
+ * read message pages for all CPUs directly.
+ *
+- * Wait no more than 10 seconds so that the panic path can't get
+- * hung forever in case the response message isn't seen.
++ * Wait up to 100 seconds since an Azure host must writeback any dirty
++ * data in its disk cache before the VMbus UNLOAD request will
++ * complete. This flushing has been empirically observed to take up
++ * to 50 seconds in cases with a lot of dirty data, so allow additional
++ * leeway and for inaccuracies in mdelay(). But eventually time out so
++ * that the panic path can't get hung forever in case the response
++ * message isn't seen.
+ */
+- for (i = 0; i < 1000; i++) {
++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) {
+ if (completion_done(&vmbus_connection.unload_event))
+- break;
++ goto completed;
+
+ for_each_online_cpu(cpu) {
+ struct hv_per_cpu_context *hv_cpu
+@@ -808,9 +819,18 @@ static void vmbus_wait_for_unload(void)
+ vmbus_signal_eom(msg, message_type);
+ }
+
+- mdelay(10);
++ /*
++ * Give a notice periodically so someone watching the
++ * serial output won't think it is completely hung.
++ */
++ if (!(i % UNLOAD_MSG_LOOPS))
++ pr_notice("Waiting for VMBus UNLOAD to complete\n");
++
++ mdelay(UNLOAD_DELAY_UNIT_MS);
+ }
++ pr_err("Continuing even though VMBus UNLOAD did not complete\n");
+
++completed:
+ /*
+ * We're crashing and already got the UNLOAD_RESPONSE, cleanup all
+ * maybe-pending messages on all CPUs to be able to receive new
+--
+2.30.2
+
--- /dev/null
+From 404a83f3d3d70442985ed769b530148e30df8fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 22:15:42 -0500
+Subject: drm/amdkfd: fix build error with AMD_IOMMU_V2=m
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 1e87068570a2cc4db5f95a881686add71729e769 ]
+
+Using 'imply AMD_IOMMU_V2' does not guarantee that the driver can link
+against the exported functions. If the GPU driver is built-in but the
+IOMMU driver is a loadable module, the kfd_iommu.c file is indeed
+built but does not work:
+
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_bind_process_to_device':
+kfd_iommu.c:(.text+0x516): undefined reference to `amd_iommu_bind_pasid'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_unbind_process':
+kfd_iommu.c:(.text+0x691): undefined reference to `amd_iommu_unbind_pasid'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_suspend':
+kfd_iommu.c:(.text+0x966): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0x97f): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0x9a4): undefined reference to `amd_iommu_free_device'
+x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_resume':
+kfd_iommu.c:(.text+0xa9a): undefined reference to `amd_iommu_init_device'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xadc): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xaff): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xc72): undefined reference to `amd_iommu_bind_pasid'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe08): undefined reference to `amd_iommu_set_invalidate_ctx_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe26): undefined reference to `amd_iommu_set_invalid_ppr_cb'
+x86_64-linux-ld: kfd_iommu.c:(.text+0xe42): undefined reference to `amd_iommu_free_device'
+
+Use IS_REACHABLE to only build IOMMU-V2 support if the amd_iommu symbols
+are reachable by the amdkfd driver. Output a warning if they are not,
+because that may not be what the user was expecting.
+
+Fixes: 64d1c3a43a6f ("drm/amdkfd: Centralize IOMMUv2 code and make it conditional")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 6 ++++++
+ drivers/gpu/drm/amd/amdkfd/kfd_iommu.h | 9 +++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+index 5f35df23fb18..9266c8e76be7 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+@@ -20,6 +20,10 @@
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
++
+ #include <linux/printk.h>
+ #include <linux/device.h>
+ #include <linux/slab.h>
+@@ -358,3 +362,5 @@ int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+
+ return 0;
+ }
++
++#endif
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+index dd23d9fdf6a8..afd420b01a0c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+@@ -23,7 +23,9 @@
+ #ifndef __KFD_IOMMU_H__
+ #define __KFD_IOMMU_H__
+
+-#if defined(CONFIG_AMD_IOMMU_V2_MODULE) || defined(CONFIG_AMD_IOMMU_V2)
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
+
+ #define KFD_SUPPORT_IOMMU_V2
+
+@@ -46,6 +48,9 @@ static inline int kfd_iommu_check_device(struct kfd_dev *kfd)
+ }
+ static inline int kfd_iommu_device_init(struct kfd_dev *kfd)
+ {
++#if IS_MODULE(CONFIG_AMD_IOMMU_V2)
++ WARN_ONCE(1, "iommu_v2 module is not usable by built-in KFD");
++#endif
+ return 0;
+ }
+
+@@ -73,6 +78,6 @@ static inline int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+ return 0;
+ }
+
+-#endif /* defined(CONFIG_AMD_IOMMU_V2) */
++#endif /* IS_REACHABLE(CONFIG_AMD_IOMMU_V2) */
+
+ #endif /* __KFD_IOMMU_H__ */
+--
+2.30.2
+
--- /dev/null
+From 8d7804c83c1deb405839e7d271a099eae028f2b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 09:01:38 +0300
+Subject: drm/i915/gvt: Fix error code in intel_gvt_init_device()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ]
+
+The intel_gvt_init_vgpu_type_groups() function is only called from
+intel_gvt_init_device(). If it fails then the intel_gvt_init_device()
+prints the error code and propagates it back again. That's a bug
+because false is zero/success. The fix is to modify it to return zero
+or negative error codes and make everything consistent.
+
+Fixes: c5d71cb31723 ("drm/i915/gvt: Move vGPU type related code into gvt file")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/YHaFQtk/DIVYK1u5@mwanda
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
+index 8f37eefa0a02..a738c7e456dd 100644
+--- a/drivers/gpu/drm/i915/gvt/gvt.c
++++ b/drivers/gpu/drm/i915/gvt/gvt.c
+@@ -128,7 +128,7 @@ static bool intel_get_gvt_attrs(struct attribute ***type_attrs,
+ return true;
+ }
+
+-static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
++static int intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ {
+ int i, j;
+ struct intel_vgpu_type *type;
+@@ -146,7 +146,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ gvt_vgpu_type_groups[i] = group;
+ }
+
+- return true;
++ return 0;
+
+ unwind:
+ for (j = 0; j < i; j++) {
+@@ -154,7 +154,7 @@ unwind:
+ kfree(group);
+ }
+
+- return false;
++ return -ENOMEM;
+ }
+
+ static void intel_gvt_cleanup_vgpu_type_groups(struct intel_gvt *gvt)
+@@ -362,7 +362,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
+ goto out_clean_thread;
+
+ ret = intel_gvt_init_vgpu_type_groups(gvt);
+- if (ret == false) {
++ if (ret) {
+ gvt_err("failed to init vgpu type groups: %d\n", ret);
+ goto out_clean_types;
+ }
+--
+2.30.2
+
--- /dev/null
+From c69b2ed5ffbfee56fb8993bd6a63d4b16f2ec081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 05:42:00 -0400
+Subject: firmware: qcom-scm: Fix QCOM_SCM configuration
+
+From: He Ying <heying24@huawei.com>
+
+[ Upstream commit 2954a6f12f250890ec2433cec03ba92784d613e8 ]
+
+When CONFIG_QCOM_SCM is y and CONFIG_HAVE_ARM_SMCCC
+is not set, compiling errors are encountered as follows:
+
+drivers/firmware/qcom_scm-smc.o: In function `__scm_smc_do_quirk':
+qcom_scm-smc.c:(.text+0x36): undefined reference to `__arm_smccc_smc'
+drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call':
+qcom_scm-legacy.c:(.text+0xe2): undefined reference to `__arm_smccc_smc'
+drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call_atomic':
+qcom_scm-legacy.c:(.text+0x1f0): undefined reference to `__arm_smccc_smc'
+
+Note that __arm_smccc_smc is defined when HAVE_ARM_SMCCC is y.
+So add dependency on HAVE_ARM_SMCCC in QCOM_SCM configuration.
+
+Fixes: 916f743da354 ("firmware: qcom: scm: Move the scm driver to drivers/firmware")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: He Ying <heying24@huawei.com>
+Link: https://lore.kernel.org/r/20210406094200.60952-1-heying24@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index e40a77bfe821..7dfbd0f6b76b 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -237,6 +237,7 @@ config INTEL_STRATIX10_RSU
+ config QCOM_SCM
+ bool
+ depends on ARM || ARM64
++ depends on HAVE_ARM_SMCCC
+ select RESET_CONTROLLER
+
+ config QCOM_SCM_32
+--
+2.30.2
+
--- /dev/null
+From c4d33f8f4310100d6ad89f73d068ea4281cac0ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:15 +0100
+Subject: fotg210-udc: Complete OUT requests on short packets
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ]
+
+A short packet indicates the end of a transfer and marks the request as
+complete.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 5e2f84818896..c313d07ec16f 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -849,12 +849,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
+ {
+ struct fotg210_request *req = list_entry(ep->queue.next,
+ struct fotg210_request, queue);
++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
+
+ fotg210_start_dma(ep, req);
+
+- /* finish out transfer */
++ /* Complete the request when it's full or a short packet arrived.
++ * Like other drivers, short_not_ok isn't handled.
++ */
++
+ if (req->req.length == req->req.actual ||
+- req->req.actual < ep->ep.maxpacket)
++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
+ fotg210_done(ep, req, 0);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 18dc0cf35111314b954201492ad03ea6412d280f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:14 +0100
+Subject: fotg210-udc: Don't DMA more than the buffer can take
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ]
+
+Before this, it wrote as much as available into the buffer, even if it
+didn't fit.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index c287dc7d430f..5e2f84818896 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -338,8 +338,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
+ } else {
+ buffer = req->req.buf + req->req.actual;
+ length = ioread32(ep->fotg210->reg +
+- FOTG210_FIBCR(ep->epnum - 1));
+- length &= FIBCR_BCFX;
++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
++ if (length > req->req.length - req->req.actual)
++ length = req->req.length - req->req.actual;
+ }
+ } else {
+ buffer = req->req.buf + req->req.actual;
+--
+2.30.2
+
--- /dev/null
+From 0d2366c750883b279bfa6bed8ec8b31dc85d0880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:09 +0100
+Subject: fotg210-udc: Fix DMA on EP0 for length > max packet size
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ]
+
+For a 75 Byte request, it would send the first 64 separately, then detect
+that the remaining 11 Byte fit into a single DMA, but due to this bug set
+the length to the original 75 Bytes. This leads to a DMA failure (which is
+ignored...) and the request completes without the remaining bytes having
+been sent.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 21f3e6c4e4d6..dc09284a3434 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -346,7 +346,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
+ if (req->req.length - req->req.actual > ep->ep.maxpacket)
+ length = ep->ep.maxpacket;
+ else
+- length = req->req.length;
++ length = req->req.length - req->req.actual;
+ }
+
+ d = dma_map_single(dev, buffer, length,
+--
+2.30.2
+
--- /dev/null
+From f8db5c5db8a8edc0cd500ccae1dfd4198e689143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:10 +0100
+Subject: fotg210-udc: Fix EP0 IN requests bigger than two packets
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ]
+
+For a 134 Byte packet, it sends the first two 64 Byte packets just fine,
+but then notice that less than a packet is remaining and call fotg210_done
+without actually sending the rest.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index dc09284a3434..7abd56ad29bc 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -820,7 +820,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210)
+ if (req->req.length)
+ fotg210_start_dma(ep, req);
+
+- if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
++ if (req->req.actual == req->req.length)
+ fotg210_done(ep, req, 0);
+ } else {
+ fotg210_set_cxdone(fotg210);
+--
+2.30.2
+
--- /dev/null
+From a58fddebed338b9326fe893217ed0119f4f8d657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:12 +0100
+Subject: fotg210-udc: Mask GRP2 interrupts we don't handle
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ]
+
+Currently it leaves unhandled interrupts unmasked, but those are never
+acked. In the case of a "device idle" interrupt, this leads to an
+effectively frozen system until plugging it in.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index b2c75c8ca3d7..c287dc7d430f 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -1026,6 +1026,12 @@ static void fotg210_init(struct fotg210_udc *fotg210)
+ value &= ~DMCR_GLINT_EN;
+ iowrite32(value, fotg210->reg + FOTG210_DMCR);
+
++ /* enable only grp2 irqs we handle */
++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
++ fotg210->reg + FOTG210_DMISGR2);
++
+ /* disable all fifo interrupt */
+ iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
+
+--
+2.30.2
+
--- /dev/null
+From 486d8a8f730c455e6dc22f31033ced8866bd5492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 15:11:11 +0100
+Subject: fotg210-udc: Remove a dubious condition leading to fotg210_done
+
+From: Fabian Vogt <fabian@ritter-vogt.de>
+
+[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ]
+
+When the EP0 IN request was not completed but less than a packet sent,
+it would complete the request successfully. That doesn't make sense
+and can't really happen as fotg210_start_dma always sends
+min(length, maxpkt) bytes.
+
+Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
+Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
+Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 7abd56ad29bc..b2c75c8ca3d7 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -379,8 +379,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep,
+ }
+ if (ep->dir_in) { /* if IN */
+ fotg210_start_dma(ep, req);
+- if ((req->req.length == req->req.actual) ||
+- (req->req.actual < ep->ep.maxpacket))
++ if (req->req.length == req->req.actual)
+ fotg210_done(ep, req, 0);
+ } else { /* OUT */
+ u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);
+--
+2.30.2
+
--- /dev/null
+From c0a9d0093e8b8fe7590c78ab5e40cc110324c1a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Apr 2021 12:53:06 +0000
+Subject: gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 ]
+
+Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment")
+did the right thing, but missed the fact that napi_gro_frags() logics
+calls for skb_gro_reset_offset() *before* pulling Ethernet header
+to the skb linear space.
+That said, the introduced check for frag0 address being aligned to 4
+always fails for it as Ethernet header is obviously 14 bytes long,
+and in case with NET_IP_ALIGN its start is not aligned to 4.
+
+Fix this by adding @nhoff argument to skb_gro_reset_offset() which
+tells if an IP header is placed right at the start of frag0 or not.
+This restores Fast GRO for napi_gro_frags() that became very slow
+after the mentioned commit, and preserves the introduced check to
+avoid silent unaligned accesses.
+
+From v1 [0]:
+ - inline tiny skb_gro_reset_offset() to let the code be optimized
+ more efficively (esp. for the !NET_IP_ALIGN case) (Eric);
+ - pull in Reviewed-by from Eric.
+
+[0] https://lore.kernel.org/netdev/20210418114200.5839-1-alobakin@pm.me
+
+Fixes: 38ec4944b593 ("gro: ensure frag0 meets IP header alignment")
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 91909e5d6807..a30878346f54 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5395,7 +5395,7 @@ static struct list_head *gro_list_prepare(struct napi_struct *napi,
+ return head;
+ }
+
+-static void skb_gro_reset_offset(struct sk_buff *skb)
++static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff)
+ {
+ const struct skb_shared_info *pinfo = skb_shinfo(skb);
+ const skb_frag_t *frag0 = &pinfo->frags[0];
+@@ -5407,7 +5407,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
+ if (skb_mac_header(skb) == skb_tail_pointer(skb) &&
+ pinfo->nr_frags &&
+ !PageHighMem(skb_frag_page(frag0)) &&
+- (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
++ (!NET_IP_ALIGN || !((skb_frag_off(frag0) + nhoff) & 3))) {
+ NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
+ NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
+ skb_frag_size(frag0),
+@@ -5640,7 +5640,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+ skb_mark_napi_id(skb, napi);
+ trace_napi_gro_receive_entry(skb);
+
+- skb_gro_reset_offset(skb);
++ skb_gro_reset_offset(skb, 0);
+
+ ret = napi_skb_finish(napi, skb, dev_gro_receive(napi, skb));
+ trace_napi_gro_receive_exit(ret);
+@@ -5733,7 +5733,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+ napi->skb = NULL;
+
+ skb_reset_mac_header(skb);
+- skb_gro_reset_offset(skb);
++ skb_gro_reset_offset(skb, hlen);
+
+ if (unlikely(skb_gro_header_hard(skb, hlen))) {
+ eth = skb_gro_header_slow(skb, hlen, 0);
+--
+2.30.2
+
--- /dev/null
+From 64e1801608025bf27f63b934144112a9995fcf64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Feb 2021 16:47:40 +0200
+Subject: HID: plantronics: Workaround for double volume key presses
+
+From: Maxim Mikityanskiy <maxtram95@gmail.com>
+
+[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ]
+
+Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice
+for each volume key press. This patch adds a quirk to hid-plantronics
+for this product ID, which will ignore the second volume key press if
+it happens within 5 ms from the last one that was handled.
+
+The patch was tested on the mentioned model only, it shouldn't affect
+other models, however, this quirk might be needed for them too.
+Auto-repeat (when a key is held pressed) is not affected, because the
+rate is about 3 times per second, which is far less frequent than once
+in 5 ms.
+
+Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls")
+Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++--
+ include/linux/hid.h | 2 ++
+ 3 files changed, 61 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d9e8105045a6..1bfa690143d7 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -932,6 +932,7 @@
+ #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003
+
+ #define USB_VENDOR_ID_PLANTRONICS 0x047f
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056
+
+ #define USB_VENDOR_ID_PANASONIC 0x04da
+ #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
+diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
+index 85b685efc12f..e81b7cec2d12 100644
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/hid.h>
+ #include <linux/module.h>
++#include <linux/jiffies.h>
+
+ #define PLT_HID_1_0_PAGE 0xffa00000
+ #define PLT_HID_2_0_PAGE 0xffa20000
+@@ -36,6 +37,16 @@
+ #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \
+ (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)
+
++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
++
++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
++
++struct plt_drv_data {
++ unsigned long device_type;
++ unsigned long last_volume_key_ts;
++ u32 quirks;
++};
++
+ static int plantronics_input_mapping(struct hid_device *hdev,
+ struct hid_input *hi,
+ struct hid_field *field,
+@@ -43,7 +54,8 @@ static int plantronics_input_mapping(struct hid_device *hdev,
+ unsigned long **bit, int *max)
+ {
+ unsigned short mapped_key;
+- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++ unsigned long plt_type = drv_data->device_type;
+
+ /* special case for PTT products */
+ if (field->application == HID_GD_JOYSTICK)
+@@ -105,6 +117,30 @@ mapped:
+ return 1;
+ }
+
++static int plantronics_event(struct hid_device *hdev, struct hid_field *field,
++ struct hid_usage *usage, __s32 value)
++{
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++
++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) {
++ unsigned long prev_ts, cur_ts;
++
++ /* Usages are filtered in plantronics_usages. */
++
++ if (!value) /* Handle key presses only. */
++ return 0;
++
++ prev_ts = drv_data->last_volume_key_ts;
++ cur_ts = jiffies;
++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT)
++ return 1; /* Ignore the repeated key. */
++
++ drv_data->last_volume_key_ts = cur_ts;
++ }
++
++ return 0;
++}
++
+ static unsigned long plantronics_device_type(struct hid_device *hdev)
+ {
+ unsigned i, col_page;
+@@ -133,15 +169,24 @@ exit:
+ static int plantronics_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
++ struct plt_drv_data *drv_data;
+ int ret;
+
++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
++ if (!drv_data)
++ return -ENOMEM;
++
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+ goto err;
+ }
+
+- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev));
++ drv_data->device_type = plantronics_device_type(hdev);
++ drv_data->quirks = id->driver_data;
++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT);
++
++ hid_set_drvdata(hdev, drv_data);
+
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT |
+ HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE);
+@@ -153,15 +198,26 @@ err:
+ }
+
+ static const struct hid_device_id plantronics_devices[] = {
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, plantronics_devices);
+
++static const struct hid_usage_id plantronics_usages[] = {
++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID },
++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID },
++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR }
++};
++
+ static struct hid_driver plantronics_driver = {
+ .name = "plantronics",
+ .id_table = plantronics_devices,
++ .usage_table = plantronics_usages,
+ .input_mapping = plantronics_input_mapping,
++ .event = plantronics_event,
+ .probe = plantronics_probe,
+ };
+ module_hid_driver(plantronics_driver);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index c7044a14200e..ae906deb42e8 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -261,6 +261,8 @@ struct hid_item {
+ #define HID_CP_SELECTION 0x000c0080
+ #define HID_CP_MEDIASELECTION 0x000c0087
+ #define HID_CP_SELECTDISC 0x000c00ba
++#define HID_CP_VOLUMEUP 0x000c00e9
++#define HID_CP_VOLUMEDOWN 0x000c00ea
+ #define HID_CP_PLAYBACKSPEED 0x000c00f1
+ #define HID_CP_PROXIMITY 0x000c0109
+ #define HID_CP_SPEAKERSYSTEM 0x000c0160
+--
+2.30.2
+
--- /dev/null
+From c4b11da3abc8943e77e3c83cf7f90da21e7b63eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:08:17 +0300
+Subject: HSI: core: fix resource leaks in hsi_add_client_from_dt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ]
+
+If some of the allocations fail between the dev_set_name() and the
+device_register() then the name will not be freed. Fix this by
+moving dev_set_name() directly in front of the call to device_register().
+
+Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/hsi_core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
+index 47f0208aa7c3..a5f92e2889cb 100644
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -210,8 +210,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ if (err)
+ goto err;
+
+- dev_set_name(&cl->device, "%s", name);
+-
+ err = hsi_of_property_parse_mode(client, "hsi-mode", &mode);
+ if (err) {
+ err = hsi_of_property_parse_mode(client, "hsi-rx-mode",
+@@ -293,6 +291,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ cl->device.release = hsi_client_release;
+ cl->device.of_node = client;
+
++ dev_set_name(&cl->device, "%s", name);
+ if (device_register(&cl->device) < 0) {
+ pr_err("hsi: failed to register client: %s\n", name);
+ put_device(&cl->device);
+--
+2.30.2
+
--- /dev/null
+From d4843496ced9be5739bc92b9250a0b4c9afe768b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:14:35 +0300
+Subject: i2c: cadence: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index a51d3b795770..17f0dd1f891e 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -901,7 +901,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
+ if (IS_ERR(id->membase))
+ return PTR_ERR(id->membase);
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++ id->irq = ret;
+
+ id->adap.owner = THIS_MODULE;
+ id->adap.dev.of_node = pdev->dev.of_node;
+--
+2.30.2
+
--- /dev/null
+From dca09ced7721e3796deb77ff12179b6964522d3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:16:41 +0300
+Subject: i2c: emev2: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: 5faf6e1f58b4 ("i2c: emev2: add driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-emev2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index 959d4912ec0d..0230a13a6ab7 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -397,7 +397,10 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- priv->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_clk;
++ priv->irq = ret;
+ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 2f8dc4a1c2f2d4babcb7d3734e71d0be645cb622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:39 +0800
+Subject: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ]
+
+The PM reference count is not expected to be incremented on
+return in functions img_i2c_xfer and img_i2c_init.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 93222bd9b966 ("i2c: img-scb: Add runtime PM")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-img-scb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
+index 20a4fbc53007..a1f8a9a91213 100644
+--- a/drivers/i2c/busses/i2c-img-scb.c
++++ b/drivers/i2c/busses/i2c-img-scb.c
+@@ -1057,7 +1057,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ atomic = true;
+ }
+
+- ret = pm_runtime_get_sync(adap->dev.parent);
++ ret = pm_runtime_resume_and_get(adap->dev.parent);
+ if (ret < 0)
+ return ret;
+
+@@ -1158,7 +1158,7 @@ static int img_i2c_init(struct img_i2c *i2c)
+ u32 rev;
+ int ret;
+
+- ret = pm_runtime_get_sync(i2c->adap.dev.parent);
++ ret = pm_runtime_resume_and_get(i2c->adap.dev.parent);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 99f4c8a44b0b5763c7e29d1d9efc79f9a4e9967f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:40 +0800
+Subject: i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 ]
+
+The PM reference count is not expected to be incremented on
+return in lpi2c_imx_master_enable.
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
+index c92b56485fa6..a0d045c1bc9e 100644
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -265,7 +265,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx)
+ unsigned int temp;
+ int ret;
+
+- ret = pm_runtime_get_sync(lpi2c_imx->adapter.dev.parent);
++ ret = pm_runtime_resume_and_get(lpi2c_imx->adapter.dev.parent);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 4669915411f5b798450c12c22d7369e76fa15b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:18:31 +0300
+Subject: i2c: jz4780: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-jz4780.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
+index 8f0e1f802f2d..a5e960cd8245 100644
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -751,7 +751,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
+
+ jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0);
+
+- i2c->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err;
++ i2c->irq = ret;
+ ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0,
+ dev_name(&pdev->dev), i2c);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 8410e5abfa4006516406595a8285964f4097bfbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:43 +0800
+Subject: i2c: omap: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 780f629741257ed6c54bd3eb53b57f648eabf200 ]
+
+The PM reference count is not expected to be incremented on
+return in omap_i2c_probe() and omap_i2c_remove().
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here. I Replace it with pm_runtime_resume_and_get
+to keep usage counter balanced.
+
+What's more, error path 'err_free_mem' seems not like a proper
+name any more. So I change the name to err_disable_pm and move
+pm_runtime_disable below, for pm_runtime of 'pdev->dev' should
+be disabled when pm_runtime_resume_and_get fails.
+
+Fixes: 3b0fb97c8dc4 ("I2C: OMAP: Handle error check for pm runtime")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-omap.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 2dfea357b131..c36522849325 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1408,9 +1408,9 @@ omap_i2c_probe(struct platform_device *pdev)
+ pm_runtime_set_autosuspend_delay(omap->dev, OMAP_I2C_PM_TIMEOUT);
+ pm_runtime_use_autosuspend(omap->dev);
+
+- r = pm_runtime_get_sync(omap->dev);
++ r = pm_runtime_resume_and_get(omap->dev);
+ if (r < 0)
+- goto err_free_mem;
++ goto err_disable_pm;
+
+ /*
+ * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
+@@ -1518,8 +1518,8 @@ err_unuse_clocks:
+ omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0);
+ pm_runtime_dont_use_autosuspend(omap->dev);
+ pm_runtime_put_sync(omap->dev);
++err_disable_pm:
+ pm_runtime_disable(&pdev->dev);
+-err_free_mem:
+
+ return r;
+ }
+@@ -1530,7 +1530,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
+ int ret;
+
+ i2c_del_adapter(&omap->adapter);
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 878e573bc15deec79af0705415e036a612d2d17c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Apr 2021 23:25:10 +0300
+Subject: i2c: sh7760: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_irq() with invalid
+IRQ #s.
+
+Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sh7760.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
+index c2005c789d2b..c79c9f542c5a 100644
+--- a/drivers/i2c/busses/i2c-sh7760.c
++++ b/drivers/i2c/busses/i2c-sh7760.c
+@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
+ goto out2;
+ }
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++ id->irq = ret;
+
+ id->adap.nr = pdev->id;
+ id->adap.algo = &sh7760_i2c_algo;
+--
+2.30.2
+
--- /dev/null
+From 11445450696ffba1009ee91ac56045c531248d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Apr 2021 22:05:05 +0300
+Subject: i2c: sh7760: fix IRQ error path
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]
+
+While adding the invalid IRQ check after calling platform_get_irq(),
+I managed to overlook that the driver has a complex error path in its
+probe() method, thus a simple *return* couldn't be used. Use a proper
+*goto* instead!
+
+Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sh7760.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
+index c79c9f542c5a..319d1fa617c8 100644
+--- a/drivers/i2c/busses/i2c-sh7760.c
++++ b/drivers/i2c/busses/i2c-sh7760.c
+@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
+
+ ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto out3;
+ id->irq = ret;
+
+ id->adap.nr = pdev->id;
+--
+2.30.2
+
--- /dev/null
+From 651092d6a03e46f46638d8a782a9bc7cb3ace916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 17:31:44 +0800
+Subject: i2c: sprd: fix reference leak when pm_runtime_get_sync fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 3a4f326463117cee3adcb72999ca34a9aaafda93 ]
+
+The PM reference count is not expected to be incremented on
+return in sprd_i2c_master_xfer() and sprd_i2c_remove().
+
+However, pm_runtime_get_sync will increment the PM reference
+count even failed. Forgetting to putting operation will result
+in a reference leak here.
+
+Replace it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sprd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
+index b2dc80286464..92ba0183fd8a 100644
+--- a/drivers/i2c/busses/i2c-sprd.c
++++ b/drivers/i2c/busses/i2c-sprd.c
+@@ -290,7 +290,7 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,
+ struct sprd_i2c *i2c_dev = i2c_adap->algo_data;
+ int im, ret;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -577,7 +577,7 @@ static int sprd_i2c_remove(struct platform_device *pdev)
+ struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev);
+ int ret;
+
+- ret = pm_runtime_get_sync(i2c_dev->dev);
++ ret = pm_runtime_resume_and_get(i2c_dev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 3ef47fea94d43cd498aab6911944a0347b1622e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:40 +0000
+Subject: IB/hfi1: Fix error return code in parse_platform_config()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210408113140.103032-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/firmware.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c
+index 2b57ba70ddd6..c09080712485 100644
+--- a/drivers/infiniband/hw/hfi1/firmware.c
++++ b/drivers/infiniband/hw/hfi1/firmware.c
+@@ -1924,6 +1924,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ dd_dev_err(dd, "%s: Failed CRC check at offset %ld\n",
+ __func__, (ptr -
+ (u32 *)dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail;
+ }
+ /* Jump the CRC DWORD */
+--
+2.30.2
+
--- /dev/null
+From 4374fb5d3746b71f5ab34567d5f6ed327d51297b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 14:53:37 -0700
+Subject: inet: use bigger hash table for IP ID generation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba ]
+
+In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
+I used a very small hash table that could be abused
+by patient attackers to reveal sensitive information.
+
+Switch to a dynamic sizing, depending on RAM size.
+
+Typical big hosts will now use 128x more storage (2 MB)
+to get a similar increase in security and reduction
+of hash collisions.
+
+As a bonus, use of alloc_large_system_hash() spreads
+allocated memory among all NUMA nodes.
+
+Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
+Reported-by: Amit Klein <aksecurity@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 42 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 53c5cf5723aa..3ff702380b62 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -66,6 +66,7 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
++#include <linux/memblock.h>
+ #include <linux/string.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+@@ -476,8 +477,10 @@ static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
+ __ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
+ }
+
+-#define IP_IDENTS_SZ 2048u
+-
++/* Hash tables of size 2048..262144 depending on RAM size.
++ * Each bucket uses 8 bytes.
++ */
++static u32 ip_idents_mask __read_mostly;
+ static atomic_t *ip_idents __read_mostly;
+ static u32 *ip_tstamps __read_mostly;
+
+@@ -487,12 +490,16 @@ static u32 *ip_tstamps __read_mostly;
+ */
+ u32 ip_idents_reserve(u32 hash, int segs)
+ {
+- u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
+- atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
+- u32 old = READ_ONCE(*p_tstamp);
+- u32 now = (u32)jiffies;
++ u32 bucket, old, now = (u32)jiffies;
++ atomic_t *p_id;
++ u32 *p_tstamp;
+ u32 delta = 0;
+
++ bucket = hash & ip_idents_mask;
++ p_tstamp = ip_tstamps + bucket;
++ p_id = ip_idents + bucket;
++ old = READ_ONCE(*p_tstamp);
++
+ if (old != now && cmpxchg(p_tstamp, old, now) == old)
+ delta = prandom_u32_max(now - old);
+
+@@ -3459,18 +3466,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
+
+ int __init ip_rt_init(void)
+ {
++ void *idents_hash;
+ int cpu;
+
+- ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
+- GFP_KERNEL);
+- if (!ip_idents)
+- panic("IP: failed to allocate ip_idents\n");
++ /* For modern hosts, this will use 2 MB of memory */
++ idents_hash = alloc_large_system_hash("IP idents",
++ sizeof(*ip_idents) + sizeof(*ip_tstamps),
++ 0,
++ 16, /* one bucket per 64 KB */
++ HASH_ZERO,
++ NULL,
++ &ip_idents_mask,
++ 2048,
++ 256*1024);
++
++ ip_idents = idents_hash;
+
+- prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++ prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
+
+- ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
+- if (!ip_tstamps)
+- panic("IP: failed to allocate ip_tstamps\n");
++ ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
+
+ for_each_possible_cpu(cpu) {
+ struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
+--
+2.30.2
+
--- /dev/null
+From 33b92e106a3bc6496370769211538d87560b44cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 14:18:35 +0100
+Subject: irqchip/gic-v3: Fix OF_BAD_ADDR error handling
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e13d96670a4c050d4883e6743a9e9858e5cfe10 ]
+
+When building with extra warnings enabled, clang points out a
+mistake in the error handling:
+
+drivers/irqchip/irq-gic-v3-mbi.c:306:21: error: result of comparison of constant 18446744073709551615 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
+ if (mbi_phys_base == OF_BAD_ADDR) {
+
+Truncate the constant to the same type as the variable it gets compared
+to, to shut make the check work and void the warning.
+
+Fixes: 505287525c24 ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210323131842.2773094-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-mbi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
+index 563a9b366294..e81e89a81cb5 100644
+--- a/drivers/irqchip/irq-gic-v3-mbi.c
++++ b/drivers/irqchip/irq-gic-v3-mbi.c
+@@ -303,7 +303,7 @@ int __init mbi_init(struct fwnode_handle *fwnode, struct irq_domain *parent)
+ reg = of_get_property(np, "mbi-alias", NULL);
+ if (reg) {
+ mbi_phys_base = of_translate_address(np, reg);
+- if (mbi_phys_base == OF_BAD_ADDR) {
++ if (mbi_phys_base == (phys_addr_t)OF_BAD_ADDR) {
+ ret = -ENXIO;
+ goto err_free_mbi;
+ }
+--
+2.30.2
+
--- /dev/null
+From 58def9e343e4bbe9f563f5baf713c107b6e2a986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:54:15 -0700
+Subject: kfifo: fix ternary sign extension bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]
+
+The intent with this code was to return negative error codes but instead
+it returns positives.
+
+The problem is how type promotion works with ternary operations. These
+functions return long, "ret" is an int and "copied" is a u32. The
+negative error code is first cast to u32 so it becomes a high positive and
+then cast to long where it's still a positive.
+
+We could fix this by declaring "ret" as a ssize_t but let's just get rid
+of the ternaries instead.
+
+Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda
+Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/kfifo/bytestream-example.c | 8 ++++++--
+ samples/kfifo/inttype-example.c | 8 ++++++--
+ samples/kfifo/record-example.c | 8 ++++++--
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c
+index 9ca3e4400c98..ecae2139274f 100644
+--- a/samples/kfifo/bytestream-example.c
++++ b/samples/kfifo/bytestream-example.c
+@@ -122,8 +122,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -138,8 +140,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c
+index 6cdeb72f83f1..7b4489e7a9a5 100644
+--- a/samples/kfifo/inttype-example.c
++++ b/samples/kfifo/inttype-example.c
+@@ -115,8 +115,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -131,8 +133,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c
+index 79ae8bb04120..eafe0838997d 100644
+--- a/samples/kfifo/record-example.c
++++ b/samples/kfifo/record-example.c
+@@ -129,8 +129,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -145,8 +147,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+--
+2.30.2
+
--- /dev/null
+From 17f98abba1128e847860c9ffc936ea44e1aea89d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 15:48:57 +0100
+Subject: KVM: arm64: Initialize VCPU mdcr_el2 before loading it
+
+From: Alexandru Elisei <alexandru.elisei@arm.com>
+
+[ Upstream commit 263d6287da1433aba11c5b4046388f2cdf49675c ]
+
+When a VCPU is created, the kvm_vcpu struct is initialized to zero in
+kvm_vm_ioctl_create_vcpu(). On VHE systems, the first time
+vcpu.arch.mdcr_el2 is loaded on hardware is in vcpu_load(), before it is
+set to a sensible value in kvm_arm_setup_debug() later in the run loop. The
+result is that KVM executes for a short time with MDCR_EL2 set to zero.
+
+This has several unintended consequences:
+
+* Setting MDCR_EL2.HPMN to 0 is constrained unpredictable according to ARM
+ DDI 0487G.a, page D13-3820. The behavior specified by the architecture
+ in this case is for the PE to behave as if MDCR_EL2.HPMN is set to a
+ value less than or equal to PMCR_EL0.N, which means that an unknown
+ number of counters are now disabled by MDCR_EL2.HPME, which is zero.
+
+* The host configuration for the other debug features controlled by
+ MDCR_EL2 is temporarily lost. This has been harmless so far, as Linux
+ doesn't use the other fields, but that might change in the future.
+
+Let's avoid both issues by initializing the VCPU's mdcr_el2 field in
+kvm_vcpu_vcpu_first_run_init(), thus making sure that the MDCR_EL2 register
+has a consistent value after each vcpu_load().
+
+Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions")
+Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210407144857.199746-3-alexandru.elisei@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/kvm_host.h | 1 +
+ arch/arm64/kvm/debug.c | 88 +++++++++++++++++++++----------
+ virt/kvm/arm/arm.c | 2 +
+ 3 files changed, 63 insertions(+), 28 deletions(-)
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index dfa6dc4575be..697702a1a1ff 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -552,6 +552,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {}
+
+ void kvm_arm_init_debug(void);
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_clear_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu);
+diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
+index dbc890511631..2484b2cca74b 100644
+--- a/arch/arm64/kvm/debug.c
++++ b/arch/arm64/kvm/debug.c
+@@ -68,6 +68,64 @@ void kvm_arm_init_debug(void)
+ __this_cpu_write(mdcr_el2, kvm_call_hyp_ret(__kvm_get_mdcr_el2));
+ }
+
++/**
++ * kvm_arm_setup_mdcr_el2 - configure vcpu mdcr_el2 value
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * This ensures we will trap access to:
++ * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
++ * - Debug ROM Address (MDCR_EL2_TDRA)
++ * - OS related registers (MDCR_EL2_TDOSA)
++ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ */
++static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu)
++{
++ /*
++ * This also clears MDCR_EL2_E2PB_MASK to disable guest access
++ * to the profiling buffer.
++ */
++ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
++ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
++ MDCR_EL2_TPMS |
++ MDCR_EL2_TTRF |
++ MDCR_EL2_TPMCR |
++ MDCR_EL2_TDRA |
++ MDCR_EL2_TDOSA);
++
++ /* Is the VM being debugged by userspace? */
++ if (vcpu->guest_debug)
++ /* Route all software debug exceptions to EL2 */
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
++
++ /*
++ * Trap debug register access when one of the following is true:
++ * - Userspace is using the hardware to debug the guest
++ * (KVM_GUESTDBG_USE_HW is set).
++ * - The guest is not using debug (KVM_ARM64_DEBUG_DIRTY is clear).
++ */
++ if ((vcpu->guest_debug & KVM_GUESTDBG_USE_HW) ||
++ !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY))
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
++
++ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
++}
++
++/**
++ * kvm_arm_vcpu_init_debug - setup vcpu debug traps
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * Set vcpu initial mdcr_el2 value.
++ */
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu)
++{
++ preempt_disable();
++ kvm_arm_setup_mdcr_el2(vcpu);
++ preempt_enable();
++}
++
+ /**
+ * kvm_arm_reset_debug_ptr - reset the debug ptr to point to the vcpu state
+ */
+@@ -83,13 +141,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+ * @vcpu: the vcpu pointer
+ *
+ * This is called before each entry into the hypervisor to setup any
+- * debug related registers. Currently this just ensures we will trap
+- * access to:
+- * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
+- * - Debug ROM Address (MDCR_EL2_TDRA)
+- * - OS related registers (MDCR_EL2_TDOSA)
+- * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
+- * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ * debug related registers.
+ *
+ * Additionally, KVM only traps guest accesses to the debug registers if
+ * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY
+@@ -101,28 +153,14 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ {
+- bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY);
+ unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2;
+
+ trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug);
+
+- /*
+- * This also clears MDCR_EL2_E2PB_MASK to disable guest access
+- * to the profiling buffer.
+- */
+- vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
+- vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
+- MDCR_EL2_TPMS |
+- MDCR_EL2_TTRF |
+- MDCR_EL2_TPMCR |
+- MDCR_EL2_TDRA |
+- MDCR_EL2_TDOSA);
++ kvm_arm_setup_mdcr_el2(vcpu);
+
+ /* Is Guest debugging in effect? */
+ if (vcpu->guest_debug) {
+- /* Route all software debug exceptions to EL2 */
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
+-
+ /* Save guest debug state */
+ save_guest_debug_regs(vcpu);
+
+@@ -176,7 +214,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.debug_ptr = &vcpu->arch.external_debug_state;
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+- trap_debug = true;
+
+ trace_kvm_arm_set_regset("BKPTS", get_num_brps(),
+ &vcpu->arch.debug_ptr->dbg_bcr[0],
+@@ -191,10 +228,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ BUG_ON(!vcpu->guest_debug &&
+ vcpu->arch.debug_ptr != &vcpu->arch.vcpu_debug_state);
+
+- /* Trap debug register access */
+- if (trap_debug)
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
+-
+ /* If KDE or MDE are set, perform a full save/restore cycle. */
+ if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE))
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+@@ -203,7 +236,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2)
+ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
+
+- trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
+ trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1));
+ }
+
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 2e7d2b3f2907..4af85605730e 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -579,6 +579,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.has_run_once = true;
+
++ kvm_arm_vcpu_init_debug(vcpu);
++
+ if (likely(irqchip_in_kernel(kvm))) {
+ /*
+ * Map the VGIC hardware resources before running a vcpu the
+--
+2.30.2
+
--- /dev/null
+From 546217e47ad8c738d65d4bacf690079572756d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 11:48:34 +1000
+Subject: KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 5088eb4092df12d701af8e0e92860b7186365279 ]
+
+The host CTRL (runlatch) value is not restored after guest exit. The
+host CTRL should always be 1 except in CPU idle code, so this can result
+in the host running with runlatch clear, and potentially switching to
+a different vCPU which then runs with runlatch clear as well.
+
+This has little effect on P9 machines, CTRL is only responsible for some
+PMU counter logic in the host and so other than corner cases of software
+relying on that, or explicitly reading the runlatch value (Linux does
+not appear to be affected but it's possible non-Linux guests could be),
+there should be no execution correctness problem, though it could be
+used as a covert channel between guests.
+
+There may be microcontrollers, firmware or monitoring tools that sample
+the runlatch value out-of-band, however since the register is writable
+by guests, these values would (should) not be relied upon for correct
+operation of the host, so suboptimal performance or incorrect reporting
+should be the worst problem.
+
+Fixes: 95a6432ce9038 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210412014845.1517916-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index dd9b19b1f459..6938b793a015 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -3638,7 +3638,10 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
+ vcpu->arch.dec_expires = dec + tb;
+ vcpu->cpu = -1;
+ vcpu->arch.thread_cpu = -1;
++ /* Save guest CTRL register, set runlatch to 1 */
+ vcpu->arch.ctrl = mfspr(SPRN_CTRLF);
++ if (!(vcpu->arch.ctrl & 1))
++ mtspr(SPRN_CTRLT, vcpu->arch.ctrl | 1);
+
+ vcpu->arch.iamr = mfspr(SPRN_IAMR);
+ vcpu->arch.pspb = mfspr(SPRN_PSPB);
+--
+2.30.2
+
--- /dev/null
+From dc1eb4449d5d42d324086e4c31f50a28a7245b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:12:48 +0100
+Subject: liquidio: Fix unintented sign extension of a left shift of a u16
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ]
+
+The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port
+(a u16) left 24 places. There are two subtle issues here, first the
+shift gets promoted to an signed int and then sign extended to a u64.
+If oct->pcie_port is 0x80 or more then the upper bits get sign extended
+to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it
+needs to be cast to a u64 for all the bits to not overflow.
+
+It is entirely possible that the u16 port value is never large enough
+for this to fail, but it is useful to fix unintended overflows such
+as this.
+
+Fix this by casting the port parameter to the macro to a u64 before
+the shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 5bc67f587ba7 ("liquidio: CN23XX register definitions")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+index e6d4ad99cc38..3f1c189646f4 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+@@ -521,7 +521,7 @@
+ #define CN23XX_BAR1_INDEX_OFFSET 3
+
+ #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \
+- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \
++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \
+ ((idx) << CN23XX_BAR1_INDEX_OFFSET))
+
+ /*############################ DPI #########################*/
+--
+2.30.2
+
--- /dev/null
+From 232701b1735049815e9b562e9b1de8aafc7074c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 18:37:51 +1100
+Subject: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 43262178c043032e7c42d00de44c818ba05f9967 ]
+
+Don't clear the timer 1 configuration bits when clearing the interrupt flag
+and counter overflow. As Michael reported, "This results in no timer
+interrupts being delivered after the first. Initialization then hangs
+in calibrate_delay as the jiffies counter is not updated."
+
+On mvme16x, enable the timer after requesting the irq, consistent with
+mvme147.
+
+Cc: Michael Pavone <pavone@retrodev.com>
+Fixes: 7529b90d051e ("m68k: mvme147: Handle timer counter overflow")
+Fixes: 19999a8b8782 ("m68k: mvme16x: Handle timer counter overflow")
+Reported-and-tested-by: Michael Pavone <pavone@retrodev.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Link: https://lore.kernel.org/r/4fdaa113db089b8fb607f7dd818479f8cdcc4547.1617089871.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/include/asm/mvme147hw.h | 3 +++
+ arch/m68k/mvme147/config.c | 14 ++++++++------
+ arch/m68k/mvme16x/config.c | 14 ++++++++------
+ 3 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/arch/m68k/include/asm/mvme147hw.h b/arch/m68k/include/asm/mvme147hw.h
+index 257b29184af9..e28eb1c0e0bf 100644
+--- a/arch/m68k/include/asm/mvme147hw.h
++++ b/arch/m68k/include/asm/mvme147hw.h
+@@ -66,6 +66,9 @@ struct pcc_regs {
+ #define PCC_INT_ENAB 0x08
+
+ #define PCC_TIMER_INT_CLR 0x80
++
++#define PCC_TIMER_TIC_EN 0x01
++#define PCC_TIMER_COC_EN 0x02
+ #define PCC_TIMER_CLR_OVF 0x04
+
+ #define PCC_LEVEL_ABORT 0x07
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index 545a1fe0e119..245376630c3d 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -117,8 +117,10 @@ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ unsigned long flags;
+
+ local_irq_save(flags);
+- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+- m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF;
++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN |
++ PCC_TIMER_TIC_EN;
++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR |
++ PCC_LEVEL_TIMER1;
+ clk_total += PCC_TIMER_CYCLES;
+ timer_routine(0, NULL);
+ local_irq_restore(flags);
+@@ -136,10 +138,10 @@ void mvme147_sched_init (irq_handler_t timer_routine)
+ /* Init the clock with a value */
+ /* The clock counter increments until 0xFFFF then reloads */
+ m147_pcc->t1_preload = PCC_TIMER_PRELOAD;
+- m147_pcc->t1_cntrl = 0x0; /* clear timer */
+- m147_pcc->t1_cntrl = 0x3; /* start timer */
+- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR; /* clear pending ints */
+- m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN |
++ PCC_TIMER_TIC_EN;
++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR |
++ PCC_LEVEL_TIMER1;
+
+ clocksource_register_hz(&mvme147_clk, PCC_TIMER_CLOCK_FREQ);
+ }
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 9bc2da69f80c..2f2c2d172b24 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -368,6 +368,7 @@ static u32 clk_total;
+ #define PCCTOVR1_COC_EN 0x02
+ #define PCCTOVR1_OVR_CLR 0x04
+
++#define PCCTIC1_INT_LEVEL 6
+ #define PCCTIC1_INT_CLR 0x08
+ #define PCCTIC1_INT_EN 0x10
+
+@@ -377,8 +378,8 @@ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ unsigned long flags;
+
+ local_irq_save(flags);
+- out_8(PCCTIC1, in_8(PCCTIC1) | PCCTIC1_INT_CLR);
+- out_8(PCCTOVR1, PCCTOVR1_OVR_CLR);
++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL);
+ clk_total += PCC_TIMER_CYCLES;
+ timer_routine(0, NULL);
+ local_irq_restore(flags);
+@@ -392,14 +393,15 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+ int irq;
+
+ /* Using PCCchip2 or MC2 chip tick timer 1 */
+- out_be32(PCCTCNT1, 0);
+- out_be32(PCCTCMP1, PCC_TIMER_CYCLES);
+- out_8(PCCTOVR1, in_8(PCCTOVR1) | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
+- out_8(PCCTIC1, PCCTIC1_INT_EN | 6);
+ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, IRQF_TIMER, "timer",
+ timer_routine))
+ panic ("Couldn't register timer int");
+
++ out_be32(PCCTCNT1, 0);
++ out_be32(PCCTCMP1, PCC_TIMER_CYCLES);
++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN);
++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL);
++
+ clocksource_register_hz(&mvme16x_clk, PCC_TIMER_CLOCK_FREQ);
+
+ if (brdno == 0x0162 || brdno == 0x172)
+--
+2.30.2
+
--- /dev/null
+From 6365d741c31dfa6571979ee887b86f9e2e76111d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 14:31:50 +0200
+Subject: mac80211: bail out if cipher schemes are invalid
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ]
+
+If any of the cipher schemes specified by the driver are invalid, bail
+out and fail the registration rather than just warning. Otherwise, we
+might later crash when we try to use the invalid cipher scheme, e.g.
+if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd
+have an out-of-bounds access in RX validation.
+
+Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support")
+Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 5b3189a37680..f215218a88c9 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1113,8 +1113,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ if (local->hw.wiphy->max_scan_ie_len)
+ local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+
+- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
+- local->hw.n_cipher_schemes));
++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
++ local->hw.n_cipher_schemes))) {
++ result = -EINVAL;
++ goto fail_workqueue;
++ }
+
+ result = ieee80211_init_cipher_suites(local);
+ if (result < 0)
+--
+2.30.2
+
--- /dev/null
+From 5e828c15d7930b76474ddbfb1d9716dfa9ce08a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 23:32:25 +0100
+Subject: media: aspeed: fix clock handling logic
+
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+
+[ Upstream commit 3536169f8531c2c5b153921dc7d1ac9fd570cda7 ]
+
+Video engine uses eclk and vclk for its clock sources and its reset
+control is coupled with eclk so the current clock enabling sequence works
+like below.
+
+ Enable eclk
+ De-assert Video Engine reset
+ 10ms delay
+ Enable vclk
+
+It introduces improper reset on the Video Engine hardware and eventually
+the hardware generates unexpected DMA memory transfers that can corrupt
+memory region in random and sporadic patterns. This issue is observed
+very rarely on some specific AST2500 SoCs but it causes a critical
+kernel panic with making a various shape of signature so it's extremely
+hard to debug. Moreover, the issue is observed even when the video
+engine is not actively used because udevd turns on the video engine
+hardware for a short time to make a query in every boot.
+
+To fix this issue, this commit changes the clock handling logic to make
+the reset de-assertion triggered after enabling both eclk and vclk. Also,
+it adds clk_unprepare call for a case when probe fails.
+
+clk: ast2600: fix reset settings for eclk and vclk
+Video engine reset setting should be coupled with eclk to match it
+with the setting for previous Aspeed SoCs which is defined in
+clk-aspeed.c since all Aspeed SoCs are sharing a single video engine
+driver. Also, reset bit 6 is defined as 'Video Engine' reset in
+datasheet so it should be de-asserted when eclk is enabled. This
+commit fixes the setting.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-ast2600.c | 4 ++--
+ drivers/media/platform/aspeed-video.c | 9 ++++++---
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
+index 84ca38450d02..af957179b135 100644
+--- a/drivers/clk/clk-ast2600.c
++++ b/drivers/clk/clk-ast2600.c
+@@ -58,10 +58,10 @@ static void __iomem *scu_g6_base;
+ static const struct aspeed_gate_data aspeed_g6_gates[] = {
+ /* clk rst name parent flags */
+ [ASPEED_CLK_GATE_MCLK] = { 0, -1, "mclk-gate", "mpll", CLK_IS_CRITICAL }, /* SDRAM */
+- [ASPEED_CLK_GATE_ECLK] = { 1, -1, "eclk-gate", "eclk", 0 }, /* Video Engine */
++ [ASPEED_CLK_GATE_ECLK] = { 1, 6, "eclk-gate", "eclk", 0 }, /* Video Engine */
+ [ASPEED_CLK_GATE_GCLK] = { 2, 7, "gclk-gate", NULL, 0 }, /* 2D engine */
+ /* vclk parent - dclk/d1clk/hclk/mclk */
+- [ASPEED_CLK_GATE_VCLK] = { 3, 6, "vclk-gate", NULL, 0 }, /* Video Capture */
++ [ASPEED_CLK_GATE_VCLK] = { 3, -1, "vclk-gate", NULL, 0 }, /* Video Capture */
+ [ASPEED_CLK_GATE_BCLK] = { 4, 8, "bclk-gate", "bclk", 0 }, /* PCIe/PCI */
+ /* From dpll */
+ [ASPEED_CLK_GATE_DCLK] = { 5, -1, "dclk-gate", NULL, CLK_IS_CRITICAL }, /* DAC */
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index e0299a789923..6dde49d9aa4c 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -491,8 +491,8 @@ static void aspeed_video_off(struct aspeed_video *video)
+ aspeed_video_write(video, VE_INTERRUPT_STATUS, 0xffffffff);
+
+ /* Turn off the relevant clocks */
+- clk_disable(video->vclk);
+ clk_disable(video->eclk);
++ clk_disable(video->vclk);
+
+ clear_bit(VIDEO_CLOCKS_ON, &video->flags);
+ }
+@@ -503,8 +503,8 @@ static void aspeed_video_on(struct aspeed_video *video)
+ return;
+
+ /* Turn on the relevant clocks */
+- clk_enable(video->eclk);
+ clk_enable(video->vclk);
++ clk_enable(video->eclk);
+
+ set_bit(VIDEO_CLOCKS_ON, &video->flags);
+ }
+@@ -1684,8 +1684,11 @@ static int aspeed_video_probe(struct platform_device *pdev)
+ return rc;
+
+ rc = aspeed_video_setup_video(video);
+- if (rc)
++ if (rc) {
++ clk_unprepare(video->vclk);
++ clk_unprepare(video->eclk);
+ return rc;
++ }
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 70194b4a22992029917125c220821bc3de685846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Oct 2020 14:16:28 +0200
+Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ]
+
+There a 3 array for-loops that don't check the upper bounds of the
+index into arrays and this may lead to potential out-of-bounds
+reads. Fix this by adding array size upper bounds checks to be
+full safe.
+
+Addresses-Coverity: ("Out-of-bounds read")
+
+Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com
+Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/tuners/m88rs6000t.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c
+index b3505f402476..8647c50b66e5 100644
+--- a/drivers/media/tuners/m88rs6000t.c
++++ b/drivers/media/tuners/m88rs6000t.c
+@@ -525,7 +525,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ PGA2_cri = PGA2_GC >> 2;
+ PGA2_crf = PGA2_GC & 0x03;
+
+- for (i = 0; i <= RF_GC; i++)
++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++)
+ RFG += RFGS[i];
+
+ if (RF_GC == 0)
+@@ -537,12 +537,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ if (RF_GC == 3)
+ RFG += 100;
+
+- for (i = 0; i <= IF_GC; i++)
++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++)
+ IFG += IFGS[i];
+
+ TIAG = TIA_GC * TIA_GS;
+
+- for (i = 0; i <= BB_GC; i++)
++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++)
+ BBG += BBGS[i];
+
+ PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;
+--
+2.30.2
+
--- /dev/null
+From db1002c5bbf3226498a8aa2baf62ae81160f97d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 03:50:41 +0100
+Subject: media: omap4iss: return error code when omap4iss_get() failed
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ]
+
+If omap4iss_get() failed, it need return error code in iss_probe().
+
+Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/omap4iss/iss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c
+index 1a966cb2f3a6..eed495f7665d 100644
+--- a/drivers/staging/media/omap4iss/iss.c
++++ b/drivers/staging/media/omap4iss/iss.c
+@@ -1240,8 +1240,10 @@ static int iss_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto error;
+
+- if (!omap4iss_get(iss))
++ if (!omap4iss_get(iss)) {
++ ret = -EINVAL;
+ goto error;
++ }
+
+ ret = iss_reset(iss);
+ if (ret < 0)
+--
+2.30.2
+
--- /dev/null
+From 934fc98fe99dfb0c7084f8b5cef5429755bc20d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Mar 2021 15:15:28 +0100
+Subject: media: platform: sunxi: sun6i-csi: fix error return code of
+ sun6i_video_start_streaming()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit f3d384e36630e2a552d874e422835606d9cf230a ]
+
+When sun6i_video_remote_subdev() returns NULL to subdev, no error return
+code of sun6i_video_start_streaming() is assigned.
+To fix this bug, ret is assigned with -EINVAL in this case.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Fixes: 5cc7522d8965 ("media: sun6i: Add support for Allwinner CSI V3s")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
+index f0dfe68486d1..c43a35df25de 100644
+--- a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
++++ b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c
+@@ -151,8 +151,10 @@ static int sun6i_video_start_streaming(struct vb2_queue *vq, unsigned int count)
+ }
+
+ subdev = sun6i_video_remote_subdev(video, NULL);
+- if (!subdev)
++ if (!subdev) {
++ ret = -EINVAL;
+ goto stop_media_pipeline;
++ }
+
+ config.pixelformat = video->fmt.fmt.pix.pixelformat;
+ config.code = video->mbus_code;
+--
+2.30.2
+
--- /dev/null
+From ce1843ff63ec5accd07d2900c136ddf9c264f7b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 12:27:40 +0100
+Subject: media: v4l2-ctrls.c: fix race condition in hdl->requests list
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit be7e8af98f3af729aa9f08b1053f9533a5cceb91 ]
+
+When a request is re-inited it will release all control handler
+objects that are still in the request. It does that by unbinding
+and putting all those objects. When the object is unbound the
+obj->req pointer is set to NULL, and the object's unbind op is
+called. When the object it put the object's release op is called
+to free the memory.
+
+For a request object that contains a control handler that means
+that v4l2_ctrl_handler_free() is called in the release op.
+
+A control handler used in a request has a pointer to the main
+control handler that is created by the driver and contains the
+current state of all controls. If the device is unbound (due to
+rmmod or a forced unbind), then that main handler is freed, again
+by calling v4l2_ctrl_handler_free(), and any outstanding request
+objects that refer to that main handler have to be unbound and put
+as well.
+
+It does that by this test:
+
+ if (!hdl->req_obj.req && !list_empty(&hdl->requests)) {
+
+I.e. the handler has no pointer to a request, so is the main
+handler, and one or more request objects refer to this main
+handler.
+
+However, this test is wrong since hdl->req_obj.req is actually
+NULL when re-initing a request (the object unbind will set req to
+NULL), and the only reason this seemingly worked is that the
+requests list is typically empty since the request's unbind op
+will remove the handler from the requests list.
+
+But if another thread is at the same time adding a new control
+to a request, then there is a race condition where one thread
+is removing a control handler object from the requests list and
+another thread is adding one. The result is that hdl->requests
+is no longer empty and the code thinks that a main handler is
+being freed instead of a control handler that is part of a request.
+
+There are two bugs here: first the test for hdl->req_obj.req: this
+should be hdl->req_obj.ops since only the main control handler will
+have a NULL pointer there.
+
+The second is that adding or deleting request objects from the
+requests list of the main handler isn't protected by taking the
+main handler's lock.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: John Cox <jc@kynesim.co.uk>
+Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support")
+Tested-by: John Cox <jc@kynesim.co.uk>
+Reported-by: John Cox <jc@kynesim.co.uk>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 3fe99519fedf..7ac7a5063fb2 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2155,7 +2155,15 @@ void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl)
+ if (hdl == NULL || hdl->buckets == NULL)
+ return;
+
+- if (!hdl->req_obj.req && !list_empty(&hdl->requests)) {
++ /*
++ * If the main handler is freed and it is used by handler objects in
++ * outstanding requests, then unbind and put those objects before
++ * freeing the main handler.
++ *
++ * The main handler can be identified by having a NULL ops pointer in
++ * the request object.
++ */
++ if (!hdl->req_obj.ops && !list_empty(&hdl->requests)) {
+ struct v4l2_ctrl_handler *req, *next_req;
+
+ list_for_each_entry_safe(req, next_req, &hdl->requests, requests) {
+@@ -3186,8 +3194,8 @@ static void v4l2_ctrl_request_unbind(struct media_request_object *obj)
+ container_of(obj, struct v4l2_ctrl_handler, req_obj);
+ struct v4l2_ctrl_handler *main_hdl = obj->priv;
+
+- list_del_init(&hdl->requests);
+ mutex_lock(main_hdl->lock);
++ list_del_init(&hdl->requests);
+ if (hdl->request_is_queued) {
+ list_del_init(&hdl->requests_queued);
+ hdl->request_is_queued = false;
+@@ -3246,8 +3254,11 @@ static int v4l2_ctrl_request_bind(struct media_request *req,
+ if (!ret) {
+ ret = media_request_object_bind(req, &req_ops,
+ from, false, &hdl->req_obj);
+- if (!ret)
++ if (!ret) {
++ mutex_lock(from->lock);
+ list_add_tail(&hdl->requests, &from->requests);
++ mutex_unlock(from->lock);
++ }
+ }
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From bd18159041e05baebf25f62bac58ae1cadb5f453 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 16:43:27 +0100
+Subject: media: vivid: fix assignment of dev->fbuf_out_flags
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ]
+
+Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise
+mask and the following statement should be bit-wise or'ing in the new flag
+bits but instead is making a direct assignment. Fix this by using the |=
+operator rather than an assignment.
+
+Addresses-Coverity: ("Unused value")
+
+Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-vid-out.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index a0364ac497f9..54bb3a59bf17 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -1025,7 +1025,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh,
+ return -EINVAL;
+ }
+ dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags);
+- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags);
++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 27ffd957460e4be38b06cf743b22343f4c19a076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 19:38:21 +0000
+Subject: memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ]
+
+Currently the array gpmc_cs is indexed by cs before it cs is range checked
+and the pointer read from this out-of-index read is dereferenced. Fix this
+by performing the range check on cs before the read and the following
+pointer dereference.
+
+Addresses-Coverity: ("Negative array index read")
+Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/omap-gpmc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index 27bc417029e1..332ffd7cf8b0 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -1026,8 +1026,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
+
+ void gpmc_cs_free(int cs)
+ {
+- struct gpmc_cs_data *gpmc = &gpmc_cs[cs];
+- struct resource *res = &gpmc->mem;
++ struct gpmc_cs_data *gpmc;
++ struct resource *res;
+
+ spin_lock(&gpmc_mem_lock);
+ if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
+@@ -1036,6 +1036,9 @@ void gpmc_cs_free(int cs)
+ spin_unlock(&gpmc_mem_lock);
+ return;
+ }
++ gpmc = &gpmc_cs[cs];
++ res = &gpmc->mem;
++
+ gpmc_cs_disable_mem(cs);
+ if (res->flags)
+ release_resource(res);
+--
+2.30.2
+
--- /dev/null
+From fdd7b71fca739f28fae32fc7e043a50e1931d561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 11:10:56 +0800
+Subject: memory: pl353: fix mask of ECC page_size config register
+
+From: gexueyuan <gexueyuan@gmail.com>
+
+[ Upstream commit 25dcca7fedcd4e31cb368ad846bfd738c0c6307c ]
+
+The mask for page size of ECC Configuration Register should be 0x3,
+according to the datasheet of PL353 smc.
+
+Fixes: fee10bd22678 ("memory: pl353: Add driver for arm pl353 static memory controller")
+Signed-off-by: gexueyuan <gexueyuan@gmail.com>
+Link: https://lore.kernel.org/r/20210331031056.5326-1-gexueyuan@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/pl353-smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c
+index 73bd3023202f..b42804b1801e 100644
+--- a/drivers/memory/pl353-smc.c
++++ b/drivers/memory/pl353-smc.c
+@@ -63,7 +63,7 @@
+ /* ECC memory config register specific constants */
+ #define PL353_SMC_ECC_MEMCFG_MODE_MASK 0xC
+ #define PL353_SMC_ECC_MEMCFG_MODE_SHIFT 2
+-#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0xC
++#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0x3
+
+ #define PL353_SMC_DC_UPT_NAND_REGS ((4 << 23) | /* CS: NAND chip */ \
+ (2 << 21)) /* UpdateRegs operation */
+--
+2.30.2
+
--- /dev/null
+From 7fc8cd1c9de7b80e3f834ce544c4b35138a65098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:51:35 +0100
+Subject: mfd: stm32-timers: Avoid clearing auto reload register
+
+From: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+
+[ Upstream commit 4917e498c6894ba077867aff78f82cffd5ffbb5c ]
+
+The ARR register is cleared unconditionally upon probing, after the maximum
+value has been read. This initial condition is rather not intuitive, when
+considering the counter child driver. It rather expects the maximum value
+by default:
+- The counter interface shows a zero value by default for 'ceiling'
+ attribute.
+- Enabling the counter without any prior configuration makes it doesn't
+ count.
+
+The reset value of ARR register is the maximum. So Choice here
+is to backup it, and restore it then, instead of clearing its value.
+It also fixes the initial condition seen by the counter driver.
+
+Fixes: d0f949e220fd ("mfd: Add STM32 Timers driver")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stm32-timers.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/stm32-timers.c b/drivers/mfd/stm32-timers.c
+index efcd4b980c94..1adba6a46dcb 100644
+--- a/drivers/mfd/stm32-timers.c
++++ b/drivers/mfd/stm32-timers.c
+@@ -158,13 +158,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = {
+
+ static void stm32_timers_get_arr_size(struct stm32_timers *ddata)
+ {
++ u32 arr;
++
++ /* Backup ARR to restore it after getting the maximum value */
++ regmap_read(ddata->regmap, TIM_ARR, &arr);
++
+ /*
+ * Only the available bits will be written so when readback
+ * we get the maximum value of auto reload register
+ */
+ regmap_write(ddata->regmap, TIM_ARR, ~0L);
+ regmap_read(ddata->regmap, TIM_ARR, &ddata->max_arr);
+- regmap_write(ddata->regmap, TIM_ARR, 0x0);
++ regmap_write(ddata->regmap, TIM_ARR, arr);
+ }
+
+ static void stm32_timers_dma_probe(struct device *dev,
+--
+2.30.2
+
--- /dev/null
+From 2126264f671c9156c7f362f5bf4dab94f484f479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Mar 2021 17:43:46 +0100
+Subject: mips: bmips: fix syscon-reboot nodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit cde58b861a1d365568588adda59d42351c0c4ad3 ]
+
+Commit a23c4134955e added the clock controller nodes, incorrectly changing the
+syscon-reboot nodes addresses.
+
+Fixes: a23c4134955e ("MIPS: BMIPS: add clock controller nodes")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/brcm/bcm3368.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6358.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6362.dtsi | 2 +-
+ arch/mips/boot/dts/brcm/bcm6368.dtsi | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/mips/boot/dts/brcm/bcm3368.dtsi b/arch/mips/boot/dts/brcm/bcm3368.dtsi
+index 69cbef472377..d4b2b430dad0 100644
+--- a/arch/mips/boot/dts/brcm/bcm3368.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm3368.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@fff8c008 {
+ compatible = "syscon";
+- reg = <0xfff8c000 0x4>;
++ reg = <0xfff8c008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm63268.dtsi b/arch/mips/boot/dts/brcm/bcm63268.dtsi
+index beec24145af7..30fdd38aef6d 100644
+--- a/arch/mips/boot/dts/brcm/bcm63268.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm63268.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@10000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6358.dtsi b/arch/mips/boot/dts/brcm/bcm6358.dtsi
+index f21176cac038..89a3107cad28 100644
+--- a/arch/mips/boot/dts/brcm/bcm6358.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6358.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@fffe0008 {
+ compatible = "syscon";
+- reg = <0xfffe0000 0x4>;
++ reg = <0xfffe0008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6362.dtsi b/arch/mips/boot/dts/brcm/bcm6362.dtsi
+index 8ae6981735b8..e48946a51242 100644
+--- a/arch/mips/boot/dts/brcm/bcm6362.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6362.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@10000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+diff --git a/arch/mips/boot/dts/brcm/bcm6368.dtsi b/arch/mips/boot/dts/brcm/bcm6368.dtsi
+index 449c167dd892..b84a3bfe8c51 100644
+--- a/arch/mips/boot/dts/brcm/bcm6368.dtsi
++++ b/arch/mips/boot/dts/brcm/bcm6368.dtsi
+@@ -59,7 +59,7 @@
+
+ periph_cntl: syscon@100000008 {
+ compatible = "syscon";
+- reg = <0x10000000 0xc>;
++ reg = <0x10000008 0x4>;
+ native-endian;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From b8ac4f8813710b092b32db3ec0a13a2a9afda1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Apr 2021 20:12:37 -0700
+Subject: MIPS: pci-legacy: stop using of_pci_range_to_resource
+
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+
+[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ]
+
+Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after
+of_pci_range_to_resource() change").
+
+Most MIPS platforms do not define PCI_IOBASE, nor implement
+pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS
+platforms. of_pci_range_to_resource passes the _start address_ of the IO
+range into pci_address_to_pio, which then checks it against
+IO_SPACE_LIMIT and fails, because for MIPS platforms that use
+pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much
+higher than 0xffff.
+
+In fact, pci-mt7621 in staging already works around this problem, see
+commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set
+resource limits")
+
+So just stop using of_pci_range_to_resource, which does not work for
+MIPS.
+
+Fixes PCI errors like:
+ pci_bus 0000:00: root bus resource [io 0xffffffff]
+
+Fixes: 0b0b0893d49b ("of/pci: Fix the conversion of IO ranges into IO resources")
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Cc: Liviu Dudau <Liviu.Dudau@arm.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/pci/pci-legacy.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c
+index 39052de915f3..3a909194284a 100644
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -166,8 +166,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node)
+ res = hose->mem_resource;
+ break;
+ }
+- if (res != NULL)
+- of_pci_range_to_resource(&range, node, res);
++ if (res != NULL) {
++ res->name = node->full_name;
++ res->flags = range.flags;
++ res->start = range.cpu_addr;
++ res->end = range.cpu_addr + range.size - 1;
++ res->parent = res->child = res->sibling = NULL;
++ }
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 876253994894857f5d099a55147612e4f036d1c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 23:02:19 -0700
+Subject: mm/memory-failure: unnecessary amount of unmapping
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ]
+
+It appears that unmap_mapping_range() actually takes a 'size' as its third
+argument rather than a location, the current calling fashion causes
+unnecessary amount of unmapping to occur.
+
+Link: https://lkml.kernel.org/r/20210420002821.2749748-1-jane.chu@oracle.com
+Fixes: 6100e34b2526e ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages")
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory-failure.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 3151c87dff73..d823ec74f3fc 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1215,7 +1215,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
+ * communicated in siginfo, see kill_proc()
+ */
+ start = (page->index << PAGE_SHIFT) & ~(size - 1);
+- unmap_mapping_range(page->mapping, start, start + size, 0);
++ unmap_mapping_range(page->mapping, start, size, 0);
+ }
+ kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags);
+ rc = 0;
+--
+2.30.2
+
--- /dev/null
+From 7d943f132e8502887def65cc6bf9be7c7ce4bc28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 22:57:58 -0700
+Subject: mm/sparse: add the missing sparse_buffer_fini() in error branch
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ]
+
+sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a
+WARN issue would be through the next time sparse_buffer_init() runs.
+
+Add the missing sparse_buffer_fini() in error branch.
+
+Link: https://lkml.kernel.org/r/20210325113155.118574-1-wangwensheng4@huawei.com
+Fixes: 85c77f791390 ("mm/sparse: add new sparse_init_nid() and sparse_init()")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/sparse.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 78bbecd904c3..191e29cca3fb 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -551,6 +551,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin,
+ pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.",
+ __func__, nid);
+ pnum_begin = pnum;
++ sparse_buffer_fini();
+ goto failed;
+ }
+ check_usemap_section_nr(nid, usage);
+--
+2.30.2
+
--- /dev/null
+From 9f313d0f8f4c73ee584e0f7e8e14d209b9bfa3c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 18:32:41 +0000
+Subject: mt7601u: fix always true expression
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ]
+
+Currently the expression ~nic_conf1 is always true because nic_conf1
+is a u16 and according to 6.5.3.3 of the C standard the ~ operator
+promotes the u16 to an integer before flipping all the bits. Thus
+the top 16 bits of the integer result are all set so the expression
+is always true. If the intention was to flip all the bits of nic_conf1
+then casting the integer result back to a u16 is a suitabel fix.
+
+Interestingly static analyzers seem to thing a bitwise ! should be
+used instead of ~ for this scenario, so I think the original intent
+of the expression may need some extra consideration.
+
+Addresses-Coverity: ("Logical vs. bitwise operator")
+Fixes: c869f77d6abb ("add mt7601u driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Jakub Kicinski <kubakici@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+index c868582c5d22..aa3b64902cf9 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+@@ -99,7 +99,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom)
+ {
+ u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1);
+
+- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
+ }
+
+ static void
+--
+2.30.2
+
--- /dev/null
+From 098d2ba47a015d6d64be2bdc7d0f07829cba97ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 18:57:56 +0530
+Subject: mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 08608adb520e51403be7592c2214846fa440a23a ]
+
+There are chances that the parse_mtd_partitions() function will return
+-EPROBE_DEFER in mtd_device_parse_register(). This might happen when
+the dependency is not available for the parser. For instance, on SDX55
+the MTD_QCOMSMEM_PARTS parser depends on the QCOM_SMEM driver to parse
+the partitions defined in the shared memory region. With the current
+flow, the error returned from parse_mtd_partitions() will be discarded
+in favor of trying to add the fallback partition.
+
+This will prevent the driver to end up in probe deferred pool and the
+partitions won't be parsed even after the QCOM_SMEM driver is available.
+
+Fix this issue by bailing out of mtd_device_parse_register() when
+-EPROBE_DEFER error is returned from parse_mtd_partitions() function and
+propagate the error code to the driver core for probing later.
+
+Fixes: 5ac67ce36cfe ("mtd: move code adding (registering) partitions to the parse_mtd_partitions()")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
+index 036b9452b19f..32a76b8feaa5 100644
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -825,6 +825,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types,
+
+ /* Prefer parsed partitions over driver-provided fallback */
+ ret = parse_mtd_partitions(mtd, types, parser_data);
++ if (ret == -EPROBE_DEFER)
++ goto out;
++
+ if (ret > 0)
+ ret = 0;
+ else if (nr_parts)
+--
+2.30.2
+
--- /dev/null
+From 284c6eb2066a2f1a0a4602fd1cf2bdc57bbf25cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 09:02:10 +0100
+Subject: mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit f5200c14242fb8fa4a9b93f7fd4064d237e58785 ]
+
+Hamming ECC doesn't cover the OOB data, so reading or writing OOB shall
+always be done without ECC enabled.
+This is a problem when adding JFFS2 cleanmarkers to erased blocks. If JFFS2
+clenmarkers are added to the OOB with ECC enabled, OOB bytes will be changed
+from ff ff ff to 00 00 00, reporting incorrect ECC errors.
+
+Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Acked-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210224080210.23686-1-noltari@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index e9ad8bb82f44..0f3c09fb9c34 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2364,6 +2364,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip)
+
+ ret = brcmstb_choose_ecc_layout(host);
+
++ /* If OOB is written with ECC enabled it will cause ECC errors */
++ if (is_hamming_ecc(host->ctrl, &host->hwcfg)) {
++ chip->ecc.write_oob = brcmnand_write_oob_raw;
++ chip->ecc.read_oob = brcmnand_read_oob_raw;
++ }
++
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c96fb5373609ea7645b0ba867deed7f550b735c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 18:58:49 +0300
+Subject: mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e7a97528e3c787802d8c643d6ab2f428511bb047 ]
+
+If dma_request_channel() fails then the probe fails and it should
+return a negative error code, but currently it returns success.
+
+fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/YCqaOZ83OvPOzLwh@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsmc_nand.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
+index a6964feeec77..81e4b0f46662 100644
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -1066,11 +1066,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
+ host->read_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->read_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get read dma channel\n");
++ ret = -ENODEV;
+ goto disable_clk;
+ }
+ host->write_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->write_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get write dma channel\n");
++ ret = -ENODEV;
+ goto release_dma_read_chan;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 7fb0ddfc0d7861cdc349c091f08f8fed9c7d74c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 23:09:05 -0700
+Subject: mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ]
+
+If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
+this->raw_buffer, gpmi_free_dma_buffer() will be called to free
+this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
+and valid ptr.
+
+Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
+is called again to free this->auxiliary_virt in err_out. This causes
+a double free.
+
+As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
+error path, so it should return err directly instead of releasing the dma
+buffer again.
+
+Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index 2390ed077a2f..60f146920b9f 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -2598,7 +2598,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
+ this->bch_geometry.auxiliary_size = 128;
+ ret = gpmi_alloc_dma_buffer(this);
+ if (ret)
+- goto err_out;
++ return ret;
+
+ nand_controller_init(&this->base);
+ this->base.ops = &gpmi_nand_controller_ops;
+--
+2.30.2
+
--- /dev/null
+From df5524f1cd4e4c030be6fce1b137e63c69944325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 18:57:57 +0530
+Subject: mtd: rawnand: qcom: Return actual error code instead of -ENODEV
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 55fbb9ba4f06cb6aff32daca1e1910173c13ec51 ]
+
+In qcom_probe_nand_devices() function, the error code returned by
+qcom_nand_host_init_and_register() is converted to -ENODEV in the case
+of failure. This poses issue if -EPROBE_DEFER is returned when the
+dependency is not available for a component like parser.
+
+So let's restructure the error handling logic a bit and return the
+actual error code in case of qcom_nand_host_init_and_register() failure.
+
+Fixes: c76b78d8ec05 ("mtd: nand: Qualcomm NAND controller driver")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 963ebcdfcbce..c10995ca624a 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2850,7 +2850,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ struct device *dev = nandc->dev;
+ struct device_node *dn = dev->of_node, *child;
+ struct qcom_nand_host *host;
+- int ret;
++ int ret = -ENODEV;
+
+ for_each_available_child_of_node(dn, child) {
+ host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+@@ -2868,10 +2868,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ list_add_tail(&host->node, &nandc->host_list);
+ }
+
+- if (list_empty(&nandc->host_list))
+- return -ENODEV;
+-
+- return 0;
++ return ret;
+ }
+
+ /* parse custom DT properties here */
+--
+2.30.2
+
--- /dev/null
+From 807c539ad7b3073541d9780f1e5027f8b4091187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 16:57:35 +0100
+Subject: mtd: require write permissions for locking and badblock ioctls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ]
+
+MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require
+write permission. Depending on the hardware MEMLOCK might even be
+write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK
+is always write-once.
+
+MEMSETBADBLOCK modifies the bad block table.
+
+Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdchar.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 48832f9b215c..ee437af41f11 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -649,16 +649,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ case MEMGETINFO:
+ case MEMREADOOB:
+ case MEMREADOOB64:
+- case MEMLOCK:
+- case MEMUNLOCK:
+ case MEMISLOCKED:
+ case MEMGETOOBSEL:
+ case MEMGETBADBLOCK:
+- case MEMSETBADBLOCK:
+ case OTPSELECT:
+ case OTPGETREGIONCOUNT:
+ case OTPGETREGIONINFO:
+- case OTPLOCK:
+ case ECCGETLAYOUT:
+ case ECCGETSTATS:
+ case MTDFILEMODE:
+@@ -669,9 +665,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ /* "dangerous" commands */
+ case MEMERASE:
+ case MEMERASE64:
++ case MEMLOCK:
++ case MEMUNLOCK:
++ case MEMSETBADBLOCK:
+ case MEMWRITEOOB:
+ case MEMWRITEOOB64:
+ case MEMWRITE:
++ case OTPLOCK:
+ if (!(file->f_mode & FMODE_WRITE))
+ return -EPERM;
+ break;
+--
+2.30.2
+
--- /dev/null
+From cba004eb3b1bf8c7717e0aa572281843eaf4a7e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 11:26:27 -0700
+Subject: mwl8k: Fix a double Free in mwl8k_probe_hw
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]
+
+In mwl8k_probe_hw, hw->priv->txq is freed at the first time by
+dma_free_coherent() in the call chain:
+if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).
+
+Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed
+at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().
+
+My patch set txq->txd to NULL after the first free to avoid the
+double free.
+
+Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwl8k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index c4db6417748f..1b76b2419186 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -1469,6 +1469,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
+ txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
+ if (txq->skb == NULL) {
+ pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
++ txq->txd = NULL;
+ return -ENOMEM;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a0eb67d07110ed56e5736a2dcc4e24c08997c39d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Apr 2021 17:27:35 +0200
+Subject: net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Lüssing <linus.luessing@c0d3.blue>
+
+[ Upstream commit 99014088156cd78867d19514a0bc771c4b86b93b ]
+
+The IPv6 Multicast Router Advertisements parsing has the following two
+issues:
+
+For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD
+messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes,
+assuming MLDv2 Reports with at least one multicast address entry).
+When ipv6_mc_check_mld_msg() tries to parse an Multicast Router
+Advertisement its MLD length check will fail - and it will wrongly
+return -EINVAL, even if we have a valid MRD Advertisement. With the
+returned -EINVAL the bridge code will assume a broken packet and will
+wrongly discard it, potentially leading to multicast packet loss towards
+multicast routers.
+
+The second issue is the MRD header parsing in
+br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header
+immediately after the IPv6 header (IPv6 next header type). However
+according to RFC4286, section 2 all MRD messages contain a Router Alert
+option (just like MLD). So instead there is an IPv6 Hop-by-Hop option
+for the Router Alert between the IPv6 and ICMPv6 header, again leading
+to the bridge wrongly discarding Multicast Router Advertisements.
+
+To fix these two issues, introduce a new return value -ENODATA to
+ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop
+option which is not an MLD but potentially an MRD packet. This also
+simplifies further parsing in the bridge code, as ipv6_mc_check_mld()
+already fully checks the ICMPv6 header and hop-by-hop option.
+
+These issues were found and fixed with the help of the mrdisc tool
+(https://github.com/troglobit/mrdisc).
+
+Fixes: 4b3087c7e37f ("bridge: Snoop Multicast Router Advertisements")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/addrconf.h | 1 -
+ net/bridge/br_multicast.c | 33 ++++++++-------------------------
+ net/ipv6/mcast_snoop.c | 12 +++++++-----
+ 3 files changed, 15 insertions(+), 31 deletions(-)
+
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index ab8b3eb53d4b..8d90fb9184e8 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -229,7 +229,6 @@ void ipv6_mc_unmap(struct inet6_dev *idev);
+ void ipv6_mc_remap(struct inet6_dev *idev);
+ void ipv6_mc_init_dev(struct inet6_dev *idev);
+ void ipv6_mc_destroy_dev(struct inet6_dev *idev);
+-int ipv6_mc_check_icmpv6(struct sk_buff *skb);
+ int ipv6_mc_check_mld(struct sk_buff *skb);
+ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp);
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 066cd3c59cfd..6276030f5854 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1647,25 +1647,14 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
+ }
+
+ #if IS_ENABLED(CONFIG_IPV6)
+-static int br_ip6_multicast_mrd_rcv(struct net_bridge *br,
+- struct net_bridge_port *port,
+- struct sk_buff *skb)
++static void br_ip6_multicast_mrd_rcv(struct net_bridge *br,
++ struct net_bridge_port *port,
++ struct sk_buff *skb)
+ {
+- int ret;
+-
+- if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
+- return -ENOMSG;
+-
+- ret = ipv6_mc_check_icmpv6(skb);
+- if (ret < 0)
+- return ret;
+-
+ if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
+- return -ENOMSG;
++ return;
+
+ br_multicast_mark_router(br, port);
+-
+- return 0;
+ }
+
+ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -1679,18 +1668,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+
+ err = ipv6_mc_check_mld(skb);
+
+- if (err == -ENOMSG) {
++ if (err == -ENOMSG || err == -ENODATA) {
+ if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
+ BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
+-
+- if (ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) {
+- err = br_ip6_multicast_mrd_rcv(br, port, skb);
+-
+- if (err < 0 && err != -ENOMSG) {
+- br_multicast_err_count(br, port, skb->protocol);
+- return err;
+- }
+- }
++ if (err == -ENODATA &&
++ ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
++ br_ip6_multicast_mrd_rcv(br, port, skb);
+
+ return 0;
+ } else if (err < 0) {
+diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c
+index d3d6b6a66e5f..04d5fcdfa6e0 100644
+--- a/net/ipv6/mcast_snoop.c
++++ b/net/ipv6/mcast_snoop.c
+@@ -109,7 +109,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
+ struct mld_msg *mld;
+
+ if (!ipv6_mc_may_pull(skb, len))
+- return -EINVAL;
++ return -ENODATA;
+
+ mld = (struct mld_msg *)skb_transport_header(skb);
+
+@@ -122,7 +122,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
+ case ICMPV6_MGM_QUERY:
+ return ipv6_mc_check_mld_query(skb);
+ default:
+- return -ENOMSG;
++ return -ENODATA;
+ }
+ }
+
+@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
+ return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
+ }
+
+-int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+ {
+ unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
+ unsigned int transport_len = ipv6_transport_len(skb);
+@@ -150,7 +150,6 @@ int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+
+ return 0;
+ }
+-EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
+
+ /**
+ * ipv6_mc_check_mld - checks whether this is a sane MLD packet
+@@ -161,7 +160,10 @@ EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
+ *
+ * -EINVAL: A broken packet was detected, i.e. it violates some internet
+ * standard
+- * -ENOMSG: IP header validation succeeded but it is not an MLD packet.
++ * -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet
++ * with a hop-by-hop option.
++ * -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded
++ * but it is not an MLD packet.
+ * -ENOMEM: A memory allocation failure happened.
+ *
+ * Caller needs to set the skb network header and free any returned skb if it
+--
+2.30.2
+
--- /dev/null
+From a895e8073a4b6cf3ca4c0d328d82e2d9feaa68b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 18:16:14 +0100
+Subject: net: davinci_emac: Fix incorrect masking of tx and rx error channel
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]
+
+The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels)
+are incorrect and always lead to a zero result. The mask values are
+currently the incorrect post-right shifted values, fix this by setting
+them to the currect values.
+
+(I double checked these against the TMS320TCI6482 data sheet, section
+5.30, page 127 to ensure I had the correct mask values for the TXERRCH
+and RXERRCH fields in the MACSTATUS register).
+
+Addresses-Coverity: ("Operands don't affect result")
+Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index ae27be85e363..7cc09a6f9f9a 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -169,11 +169,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";
+ /* EMAC mac_status register */
+ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)
+ #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20)
+-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)
+ #define EMAC_MACSTATUS_TXERRCH_SHIFT (16)
+ #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)
+ #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12)
+-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)
+ #define EMAC_MACSTATUS_RXERRCH_SHIFT (8)
+
+ /* EMAC RX register masks */
+--
+2.30.2
+
--- /dev/null
+From 7e893f7e5fae6e9734fa5e7a991e6d2748eb71e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 09:06:25 -0700
+Subject: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ]
+
+In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
+If some error happens in emac_tx_fill_tpd(), the skb will be freed via
+dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
+But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
+
+As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len,
+thus my patch assigns skb->len to 'len' before the possible free and
+use 'len' instead of skb->len later.
+
+Fixes: b9b17debc69d2 ("net: emac: emac gigabit ethernet controller driver")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+index bebe38d74d66..ab1b4da5d5be 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+@@ -1439,6 +1439,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q,
+ {
+ struct emac_tpd tpd;
+ u32 prod_idx;
++ int len;
+
+ memset(&tpd, 0, sizeof(tpd));
+
+@@ -1458,9 +1459,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q,
+ if (skb_network_offset(skb) != ETH_HLEN)
+ TPD_TYP_SET(&tpd, 1);
+
++ len = skb->len;
+ emac_tx_fill_tpd(adpt, tx_q, skb, &tpd);
+
+- netdev_sent_queue(adpt->netdev, skb->len);
++ netdev_sent_queue(adpt->netdev, len);
+
+ /* Make sure the are enough free descriptors to hold one
+ * maximum-sized SKB. We need one desc for each fragment,
+--
+2.30.2
+
--- /dev/null
+From 985cb74dd33756fad4d9b22513651454cd1303b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 00:49:45 +0100
+Subject: net: geneve: modify IP header check in geneve6_xmit_skb and
+ geneve_xmit_skb
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ]
+
+Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb
+to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes
+two kernel selftest failures introduced by the commit introducing the
+checks:
+IPv4 over geneve6: PMTU exceptions
+IPv4 over geneve6: PMTU exceptions - nexthop objects
+
+It does this by correctly accounting for the fact that IPv4 packets may
+transit over geneve IPv6 tunnels (and vice versa), and still fixes the
+uninit-value bug fixed by the original commit.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: 6628ddfec758 ("net: geneve: check skb is large enough for IPv4/IPv6 header")
+Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Acked-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index c33a08d65208..84f5717c01e2 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -891,7 +891,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+@@ -957,7 +957,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+--
+2.30.2
+
--- /dev/null
+From 9d917b7b41abf9c0705e883ea69a127783c326c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Apr 2021 18:28:25 +0100
+Subject: net: hns3: Limiting the scope of vector_ring_chain variable
+
+From: Salil Mehta <salil.mehta@huawei.com>
+
+[ Upstream commit d392ecd1bc29ae15b0e284d5f732c2d36f244271 ]
+
+Limiting the scope of the variable vector_ring_chain to the block where it
+is used.
+
+Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 92af7204711c..696f21543aa7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3322,7 +3322,6 @@ static void hns3_nic_set_cpumask(struct hns3_nic_priv *priv)
+
+ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ {
+- struct hnae3_ring_chain_node vector_ring_chain;
+ struct hnae3_handle *h = priv->ae_handle;
+ struct hns3_enet_tqp_vector *tqp_vector;
+ int ret = 0;
+@@ -3354,6 +3353,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ }
+
+ for (i = 0; i < priv->vector_num; i++) {
++ struct hnae3_ring_chain_node vector_ring_chain;
++
+ tqp_vector = &priv->tqp_vector[i];
+
+ tqp_vector->rx_group.total_bytes = 0;
+--
+2.30.2
+
--- /dev/null
+From ba70b22f51f571aa377656490c671384c6ca485c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 23:23:09 -0800
+Subject: net: lapbether: Prevent racing when checking whether the netif is
+ running
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ]
+
+There are two "netif_running" checks in this driver. One is in
+"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make
+sure that the LAPB APIs called in these functions are called before
+"lapb_unregister" is called by the "ndo_stop" function.
+
+However, these "netif_running" checks are unreliable, because it's
+possible that immediately after "netif_running" returns true, "ndo_stop"
+is called (which causes "lapb_unregister" to be called).
+
+This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can
+reliably check and ensure the netif is running while doing their work.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 60f357d2f79f..4e42954d8cbf 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -51,6 +51,8 @@ struct lapbethdev {
+ struct list_head node;
+ struct net_device *ethdev; /* link to ethernet device */
+ struct net_device *axdev; /* lapbeth device (lapb#) */
++ bool up;
++ spinlock_t up_lock; /* Protects "up" */
+ };
+
+ static LIST_HEAD(lapbeth_devices);
+@@ -98,8 +100,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ rcu_read_lock();
+ lapbeth = lapbeth_get_x25_dev(dev);
+ if (!lapbeth)
+- goto drop_unlock;
+- if (!netif_running(lapbeth->axdev))
++ goto drop_unlock_rcu;
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop_unlock;
+
+ len = skb->data[0] + skb->data[1] * 256;
+@@ -114,11 +117,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ goto drop_unlock;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ rcu_read_unlock();
+ return 0;
+ drop_unlock:
+ kfree_skb(skb);
+ goto out;
++drop_unlock_rcu:
++ rcu_read_unlock();
+ drop:
+ kfree_skb(skb);
+ return 0;
+@@ -148,13 +154,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
+ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+- /*
+- * Just to be *really* sure not to send anything if the interface
+- * is down, the ethernet device may have gone.
+- */
+- if (!netif_running(dev))
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop;
+
+ /* There should be a pseudo header of 1 byte added by upper layers.
+@@ -185,6 +189,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ goto drop;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ return NETDEV_TX_OK;
+ drop:
+ kfree_skb(skb);
+@@ -276,6 +281,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {
+ */
+ static int lapbeth_open(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+ if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) {
+@@ -283,13 +289,22 @@ static int lapbeth_open(struct net_device *dev)
+ return -ENODEV;
+ }
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = true;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ return 0;
+ }
+
+ static int lapbeth_close(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = false;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ if ((err = lapb_unregister(dev)) != LAPB_OK)
+ pr_err("lapb_unregister error: %d\n", err);
+
+@@ -347,6 +362,9 @@ static int lapbeth_new_device(struct net_device *dev)
+ dev_hold(dev);
+ lapbeth->ethdev = dev;
+
++ lapbeth->up = false;
++ spin_lock_init(&lapbeth->up_lock);
++
+ rc = -EIO;
+ if (register_netdevice(ndev))
+ goto fail;
+--
+2.30.2
+
--- /dev/null
+From 8e2b8eb3a6335c1484ac376de74f88df37c95f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Apr 2021 09:22:58 -0700
+Subject: net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]
+
+In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp).
+If nfc_tm_data_received() failed, the callee will free the resp via
+kfree_skb() and return error. But in the exit branch, the resp
+will be freed again.
+
+My patch sets resp to NULL if nfc_tm_data_received() failed, to
+avoid the double free.
+
+Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/digital_dep.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
+index 65aaa9d7c813..bcd4d74e8a82 100644
+--- a/net/nfc/digital_dep.c
++++ b/net/nfc/digital_dep.c
+@@ -1276,6 +1276,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
+ }
+
+ rc = nfc_tm_data_received(ddev->nfc_dev, resp);
++ if (rc)
++ resp = NULL;
+
+ exit:
+ kfree_skb(ddev->chaining_skb);
+--
+2.30.2
+
--- /dev/null
+From 4a93a72980c433206fdc4b616e6add13d01c75f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 07:50:47 +0200
+Subject: net: phy: intel-xway: enable integrated led functions
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 357a07c26697a770d39d28b6b111f978deb4017d ]
+
+The Intel xway phys offer the possibility to deactivate the integrated
+LED function and to control the LEDs manually.
+If this was set by the bootloader, it must be ensured that the
+integrated LED function is enabled for all LEDs when loading the driver.
+
+Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+the LEDs were enabled by a soft-reset of the PHY (using
+genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default
+value (which is applied during a soft reset) instead of adding back
+the soft reset. This brings back the default LED configuration while
+still preventing an excessive amount of soft resets.
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/net/phy/intel-xway.c b/drivers/net/phy/intel-xway.c
+index b7875b36097f..574a8bca1ec4 100644
+--- a/drivers/net/phy/intel-xway.c
++++ b/drivers/net/phy/intel-xway.c
+@@ -11,6 +11,18 @@
+
+ #define XWAY_MDIO_IMASK 0x19 /* interrupt mask */
+ #define XWAY_MDIO_ISTAT 0x1A /* interrupt status */
++#define XWAY_MDIO_LED 0x1B /* led control */
++
++/* bit 15:12 are reserved */
++#define XWAY_MDIO_LED_LED3_EN BIT(11) /* Enable the integrated function of LED3 */
++#define XWAY_MDIO_LED_LED2_EN BIT(10) /* Enable the integrated function of LED2 */
++#define XWAY_MDIO_LED_LED1_EN BIT(9) /* Enable the integrated function of LED1 */
++#define XWAY_MDIO_LED_LED0_EN BIT(8) /* Enable the integrated function of LED0 */
++/* bit 7:4 are reserved */
++#define XWAY_MDIO_LED_LED3_DA BIT(3) /* Direct Access to LED3 */
++#define XWAY_MDIO_LED_LED2_DA BIT(2) /* Direct Access to LED2 */
++#define XWAY_MDIO_LED_LED1_DA BIT(1) /* Direct Access to LED1 */
++#define XWAY_MDIO_LED_LED0_DA BIT(0) /* Direct Access to LED0 */
+
+ #define XWAY_MDIO_INIT_WOL BIT(15) /* Wake-On-LAN */
+ #define XWAY_MDIO_INIT_MSRE BIT(14)
+@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev)
+ /* Clear all pending interrupts */
+ phy_read(phydev, XWAY_MDIO_ISTAT);
+
++ /* Ensure that integrated led function is enabled for all leds */
++ err = phy_write(phydev, XWAY_MDIO_LED,
++ XWAY_MDIO_LED_LED0_EN |
++ XWAY_MDIO_LED_LED1_EN |
++ XWAY_MDIO_LED_LED2_EN |
++ XWAY_MDIO_LED_LED3_EN);
++ if (err)
++ return err;
++
+ phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH,
+ XWAY_MMD_LEDCH_NACS_NONE |
+ XWAY_MMD_LEDCH_SBF_F02HZ |
+--
+2.30.2
+
--- /dev/null
+From 3d2c3edfa947d2daa70229c9f5ff3d3ce1eb46c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 13:52:46 +0900
+Subject: net: renesas: ravb: Fix a stuck issue when a lot of frames are
+ received
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 5718458b092bf6bf4482c5df32affba3c3259517 ]
+
+When a lot of frames were received in the short term, the driver
+caused a stuck of receiving until a new frame was received. For example,
+the following command from other device could cause this issue.
+
+ $ sudo ping -f -l 1000 -c 1000 <this driver's ipaddress>
+
+The previous code always cleared the interrupt flag of RX but checks
+the interrupt flags in ravb_poll(). So, ravb_poll() could not call
+ravb_rx() in the next time until a new RX frame was received if
+ravb_rx() returned true. To fix the issue, always calls ravb_rx()
+regardless the interrupt flags condition.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 35 ++++++++----------------
+ 1 file changed, 12 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 551799fb3842..9208a72fe17e 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -911,31 +911,20 @@ static int ravb_poll(struct napi_struct *napi, int budget)
+ int q = napi - priv->napi;
+ int mask = BIT(q);
+ int quota = budget;
+- u32 ris0, tis;
+
+- for (;;) {
+- tis = ravb_read(ndev, TIS);
+- ris0 = ravb_read(ndev, RIS0);
+- if (!((ris0 & mask) || (tis & mask)))
+- break;
++ /* Processing RX Descriptor Ring */
++ /* Clear RX interrupt */
++ ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
++ if (ravb_rx(ndev, "a, q))
++ goto out;
+
+- /* Processing RX Descriptor Ring */
+- if (ris0 & mask) {
+- /* Clear RX interrupt */
+- ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
+- if (ravb_rx(ndev, "a, q))
+- goto out;
+- }
+- /* Processing TX Descriptor Ring */
+- if (tis & mask) {
+- spin_lock_irqsave(&priv->lock, flags);
+- /* Clear TX interrupt */
+- ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
+- ravb_tx_free(ndev, q, true);
+- netif_wake_subqueue(ndev, q);
+- spin_unlock_irqrestore(&priv->lock, flags);
+- }
+- }
++ /* Processing RX Descriptor Ring */
++ spin_lock_irqsave(&priv->lock, flags);
++ /* Clear TX interrupt */
++ ravb_write(ndev, ~(mask | TIS_RESERVED), TIS);
++ ravb_tx_free(ndev, q, true);
++ netif_wake_subqueue(ndev, q);
++ spin_unlock_irqrestore(&priv->lock, flags);
+
+ napi_complete(napi);
+
+--
+2.30.2
+
--- /dev/null
+From 6e40b6c0a42535f352cacf201819dac8fa454b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:07:26 +0100
+Subject: net: thunderx: Fix unintentional sign extension issue
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]
+
+The shifting of the u8 integers rq->caching by 26 bits to
+the left will be promoted to a 32 bit signed int and then
+sign-extended to a u64. In the event that rq->caching is
+greater than 0x1f then all then all the upper 32 bits of
+the u64 end up as also being set because of the int
+sign-extension. Fix this by casting the u8 values to a
+u64 before the 26 bit left shift.
+
+Addresses-Coverity: ("Unintended sign extension")
+Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+index 4ab57d33a87e..6bd6fb5a3613 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
+ mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG;
+ mbx.rq.qs_num = qs->vnic_id;
+ mbx.rq.rq_num = qidx;
+- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) |
++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) |
+ (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) |
+ (rq->cont_qs_rbdr_idx << 8) |
+ (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx);
+--
+2.30.2
+
--- /dev/null
+From b676f52883e9538a98a17395c435d57cc19f16ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 14:44:42 +0300
+Subject: nfc: pn533: prevent potential memory corruption
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ]
+
+If the "type_a->nfcid_len" is too large then it would lead to memory
+corruption in pn533_target_found_type_a() when we do:
+
+ memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
+
+Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/pn533/pn533.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
+index a172a32aa9d9..3ea38ce86cc9 100644
+--- a/drivers/nfc/pn533/pn533.c
++++ b/drivers/nfc/pn533/pn533.c
+@@ -680,6 +680,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
+ if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
+ return false;
+
++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE)
++ return false;
++
+ return true;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 45c8e2e4a1a843401bbdca685a8863cecf5fe39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 14:01:57 +0300
+Subject: node: fix device cleanups in error handling code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4ce535ec0084f0d712317cb99d383cad3288e713 ]
+
+We can't use kfree() to free device managed resources so the kfree(dev)
+is against the rules.
+
+It's easier to write this code if we open code the device_register() as
+a device_initialize() and device_add(). That way if dev_set_name() set
+name fails we can call put_device() and it will clean up correctly.
+
+Fixes: acc02a109b04 ("node: Add memory-side caching attributes")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YHA0JUra+F64+NpB@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 9c6e6a7b9354..c9976dc4aa65 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -262,21 +262,20 @@ static void node_init_cache_dev(struct node *node)
+ if (!dev)
+ return;
+
++ device_initialize(dev);
+ dev->parent = &node->dev;
+ dev->release = node_cache_release;
+ if (dev_set_name(dev, "memory_side_cache"))
+- goto free_dev;
++ goto put_device;
+
+- if (device_register(dev))
+- goto free_name;
++ if (device_add(dev))
++ goto put_device;
+
+ pm_runtime_no_callbacks(dev);
+ node->cache_dev = dev;
+ return;
+-free_name:
+- kfree_const(dev->kobj.name);
+-free_dev:
+- kfree(dev);
++put_device:
++ put_device(dev);
+ }
+
+ /**
+@@ -313,25 +312,24 @@ void node_add_cache(unsigned int nid, struct node_cache_attrs *cache_attrs)
+ return;
+
+ dev = &info->dev;
++ device_initialize(dev);
+ dev->parent = node->cache_dev;
+ dev->release = node_cacheinfo_release;
+ dev->groups = cache_groups;
+ if (dev_set_name(dev, "index%d", cache_attrs->level))
+- goto free_cache;
++ goto put_device;
+
+ info->cache_attrs = *cache_attrs;
+- if (device_register(dev)) {
++ if (device_add(dev)) {
+ dev_warn(&node->dev, "failed to add cache level:%d\n",
+ cache_attrs->level);
+- goto free_name;
++ goto put_device;
+ }
+ pm_runtime_no_callbacks(dev);
+ list_add_tail(&info->node, &node->cache_attrs);
+ return;
+-free_name:
+- kfree_const(dev->kobj.name);
+-free_cache:
+- kfree(info);
++put_device:
++ put_device(dev);
+ }
+
+ static void node_remove_caches(struct node *node)
+--
+2.30.2
+
--- /dev/null
+From 6134ed594a18061fe8b8042de566b6a36f7f2ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 20:12:55 +0200
+Subject: nvme-pci: don't simple map sgl when sgls are disabled
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit e51183be1fa96dc6d3cd11b3c25a0f595807315e ]
+
+According to the module parameter description for sgl_threshold,
+a value of 0 means that SGLs are disabled.
+
+If SGLs are disabled, we should respect that, even for the case
+where the request is made up of a single physical segment.
+
+Fixes: 297910571f08 ("nvme-pci: optimize mapping single segment requests using SGLs")
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3bee3724e9fa..2cb2ead7615b 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -838,7 +838,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
+ return nvme_setup_prp_simple(dev, req,
+ &cmnd->rw, &bv);
+
+- if (iod->nvmeq->qid &&
++ if (iod->nvmeq->qid && sgl_threshold &&
+ dev->ctrl.sgls & ((1 << 0) | (1 << 1)))
+ return nvme_setup_sgl_simple(dev, req,
+ &cmnd->rw, &bv);
+--
+2.30.2
+
--- /dev/null
+From becff362468d52ff46b15fc0b77794ca2ee3f784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 16:29:01 +0100
+Subject: nvme: retrigger ANA log update if group descriptor isn't found
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit dd8f7fa908f66dd44abcd83cbb50410524b9f8ef ]
+
+If ANA is enabled but no ANA group descriptor is found when creating
+a new namespace the ANA log is most likely out of date, so trigger
+a re-read. The namespace will be tagged with the NS_ANA_PENDING flag
+to exclude it from path selection until the ANA log has been re-read.
+
+Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems")
+Reported-by: Martin George <marting@netapp.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 207a88ea10f3..855edc4e1244 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -677,6 +677,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ if (desc.state) {
+ /* found the group desc: update */
+ nvme_update_ns_ana_state(&desc, ns);
++ } else {
++ /* group desc not found: trigger a re-read */
++ set_bit(NVME_NS_ANA_PENDING, &ns->flags);
++ queue_work(nvme_wq, &ns->ctrl->ana_work);
+ }
+ } else {
+ ns->ana_state = NVME_ANA_OPTIMIZED;
+--
+2.30.2
+
--- /dev/null
+From d261116ad27913af2a864d2066b9dd23ddcd77bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 00:08:48 -0700
+Subject: nvme-tcp: block BH in sk state_change sk callback
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 8b73b45d54a14588f86792869bfb23098ea254cb ]
+
+The TCP stack can run from process context for a long time
+so we should disable BH here.
+
+Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index ac3503ea54c4..718152adc625 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -816,7 +816,7 @@ static void nvme_tcp_state_change(struct sock *sk)
+ {
+ struct nvme_tcp_queue *queue;
+
+- read_lock(&sk->sk_callback_lock);
++ read_lock_bh(&sk->sk_callback_lock);
+ queue = sk->sk_user_data;
+ if (!queue)
+ goto done;
+@@ -838,7 +838,7 @@ static void nvme_tcp_state_change(struct sock *sk)
+
+ queue->state_change(sk);
+ done:
+- read_unlock(&sk->sk_callback_lock);
++ read_unlock_bh(&sk->sk_callback_lock);
+ }
+
+ static inline void nvme_tcp_done_send_req(struct nvme_tcp_queue *queue)
+--
+2.30.2
+
--- /dev/null
+From 14d7d2a0007b901ac78b528c4081f6c496c1fbd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Mar 2021 00:08:49 -0700
+Subject: nvmet-tcp: fix incorrect locking in state_change sk callback
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit b5332a9f3f3d884a1b646ce155e664cc558c1722 ]
+
+We are not changing anything in the TCP connection state so
+we should not take a write_lock but rather a read lock.
+
+This caused a deadlock when running nvmet-tcp and nvme-tcp
+on the same system, where state_change callbacks on the
+host and on the controller side have causal relationship
+and made lockdep report on this with blktests:
+
+================================
+WARNING: inconsistent lock state
+5.12.0-rc3 #1 Tainted: G I
+--------------------------------
+inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-R} usage.
+nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+{IN-SOFTIRQ-W} state was registered at:
+ __lock_acquire+0x79b/0x18d0
+ lock_acquire+0x1ca/0x480
+ _raw_write_lock_bh+0x39/0x80
+ nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp]
+ tcp_fin+0x2a8/0x780
+ tcp_data_queue+0xf94/0x1f20
+ tcp_rcv_established+0x6ba/0x1f00
+ tcp_v4_do_rcv+0x502/0x760
+ tcp_v4_rcv+0x257e/0x3430
+ ip_protocol_deliver_rcu+0x69/0x6a0
+ ip_local_deliver_finish+0x1e2/0x2f0
+ ip_local_deliver+0x1a2/0x420
+ ip_rcv+0x4fb/0x6b0
+ __netif_receive_skb_one_core+0x162/0x1b0
+ process_backlog+0x1ff/0x770
+ __napi_poll.constprop.0+0xa9/0x5c0
+ net_rx_action+0x7b3/0xb30
+ __do_softirq+0x1f0/0x940
+ do_softirq+0xa1/0xd0
+ __local_bh_enable_ip+0xd8/0x100
+ ip_finish_output2+0x6b7/0x18a0
+ __ip_queue_xmit+0x706/0x1aa0
+ __tcp_transmit_skb+0x2068/0x2e20
+ tcp_write_xmit+0xc9e/0x2bb0
+ __tcp_push_pending_frames+0x92/0x310
+ inet_shutdown+0x158/0x300
+ __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
+ nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
+ nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
+ nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
+ nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
+ kernfs_fop_write_iter+0x2c7/0x460
+ new_sync_write+0x36c/0x610
+ vfs_write+0x5c0/0x870
+ ksys_write+0xf9/0x1d0
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+irq event stamp: 10687
+hardirqs last enabled at (10687): [<ffffffff9ec376bd>] _raw_spin_unlock_irqrestore+0x2d/0x40
+hardirqs last disabled at (10686): [<ffffffff9ec374d8>] _raw_spin_lock_irqsave+0x68/0x90
+softirqs last enabled at (10684): [<ffffffff9f000608>] __do_softirq+0x608/0x940
+softirqs last disabled at (10649): [<ffffffff9cdedd31>] do_softirq+0xa1/0xd0
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(clock-AF_INET);
+ <Interrupt>
+ lock(clock-AF_INET);
+
+ *** DEADLOCK ***
+
+5 locks held by nvme/1324:
+ #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0
+ #1: ffff8886e435c090 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460
+ #2: ffff888104d90c38 (kn->active#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330
+ #3: ffff8884634538d0 (&queue->queue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp]
+ #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300
+
+stack backtrace:
+CPU: 26 PID: 1324 Comm: nvme Tainted: G I 5.12.0-rc3 #1
+Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020
+Call Trace:
+ dump_stack+0x93/0xc2
+ mark_lock_irq.cold+0x2c/0xb3
+ ? verify_lock_unused+0x390/0x390
+ ? stack_trace_consume_entry+0x160/0x160
+ ? lock_downgrade+0x100/0x100
+ ? save_trace+0x88/0x5e0
+ ? _raw_spin_unlock_irqrestore+0x2d/0x40
+ mark_lock+0x530/0x1470
+ ? mark_lock_irq+0x1d10/0x1d10
+ ? enqueue_timer+0x660/0x660
+ mark_usage+0x215/0x2a0
+ __lock_acquire+0x79b/0x18d0
+ ? tcp_schedule_loss_probe.part.0+0x38c/0x520
+ lock_acquire+0x1ca/0x480
+ ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ ? rcu_read_unlock+0x40/0x40
+ ? tcp_mtu_probe+0x1ae0/0x1ae0
+ ? kmalloc_reserve+0xa0/0xa0
+ ? sysfs_file_ops+0x170/0x170
+ _raw_read_lock+0x3d/0xa0
+ ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
+ ? sysfs_file_ops+0x170/0x170
+ inet_shutdown+0x189/0x300
+ __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
+ nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
+ nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
+ nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
+ nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
+ kernfs_fop_write_iter+0x2c7/0x460
+ new_sync_write+0x36c/0x610
+ ? new_sync_read+0x600/0x600
+ ? lock_acquire+0x1ca/0x480
+ ? rcu_read_unlock+0x40/0x40
+ ? lock_is_held_type+0x9a/0x110
+ vfs_write+0x5c0/0x870
+ ksys_write+0xf9/0x1d0
+ ? __ia32_sys_read+0xa0/0xa0
+ ? lockdep_hardirqs_on_prepare.part.0+0x198/0x340
+ ? syscall_enter_from_user_mode+0x27/0x70
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 9242224156f5..9bfd92b6677b 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1402,7 +1402,7 @@ static void nvmet_tcp_state_change(struct sock *sk)
+ {
+ struct nvmet_tcp_queue *queue;
+
+- write_lock_bh(&sk->sk_callback_lock);
++ read_lock_bh(&sk->sk_callback_lock);
+ queue = sk->sk_user_data;
+ if (!queue)
+ goto done;
+@@ -1420,7 +1420,7 @@ static void nvmet_tcp_state_change(struct sock *sk)
+ queue->idx, sk->sk_state);
+ }
+ done:
+- write_unlock_bh(&sk->sk_callback_lock);
++ read_unlock_bh(&sk->sk_callback_lock);
+ }
+
+ static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
+--
+2.30.2
+
--- /dev/null
+From 133c2afa4be42ac0b41a110ebb2f1a5f95b10a39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 23:50:24 +0300
+Subject: pata_arasan_cf: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ]
+
+The driver's probe() method is written as if platform_get_irq() returns 0
+on error, while actually it returns a negative error code (with all the
+other values considered valid IRQs). Rewrite the driver's IRQ checking code
+to pass the positive IRQ #s to ata_host_activate(), propagate upstream
+-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors
+and IRQ0 (libata treats IRQ #0 as a polling mode anyway)...
+
+Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_arasan_cf.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
+index ebecab8c3f36..7c1c399450f3 100644
+--- a/drivers/ata/pata_arasan_cf.c
++++ b/drivers/ata/pata_arasan_cf.c
+@@ -817,12 +817,19 @@ static int arasan_cf_probe(struct platform_device *pdev)
+ else
+ quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */
+
+- /* if irq is 0, support only PIO */
+- acdev->irq = platform_get_irq(pdev, 0);
+- if (acdev->irq)
++ /*
++ * If there's an error getting IRQ (or we do get IRQ0),
++ * support only PIO
++ */
++ ret = platform_get_irq(pdev, 0);
++ if (ret > 0) {
++ acdev->irq = ret;
+ irq_handler = arasan_cf_interrupt;
+- else
++ } else if (ret == -EPROBE_DEFER) {
++ return ret;
++ } else {
+ quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA;
++ }
+
+ acdev->pbase = res->start;
+ acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start,
+--
+2.30.2
+
--- /dev/null
+From 1d100848b895b92a70d5f6fa19ab572b164add3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 23:51:10 +0300
+Subject: pata_ipx4xx_cf: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ]
+
+The driver's probe() method is written as if platform_get_irq() returns 0
+on error, while actually it returns a negative error code (with all the
+other values considered valid IRQs). Rewrite the driver's IRQ checking
+code to pass the positive IRQ #s to ata_host_activate(), propagate errors
+upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code
+treats 0 as an indication that polling should be used anyway...
+
+Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_ixp4xx_cf.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
+index d1644a8ef9fa..abc0e87ca1a8 100644
+--- a/drivers/ata/pata_ixp4xx_cf.c
++++ b/drivers/ata/pata_ixp4xx_cf.c
+@@ -165,8 +165,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq)
++ if (irq > 0)
+ irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING);
++ else if (irq < 0)
++ return irq;
++ else
++ return -EINVAL;
+
+ /* Setup expansion bus chip selects */
+ *data->cs0_cfg = data->cs0_bits;
+--
+2.30.2
+
--- /dev/null
+From e2b08824958a5d664a57be648270b54e76481d5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 21:27:23 +0300
+Subject: perf beauty: Fix fsconfig generator
+
+From: Vitaly Chikunov <vt@altlinux.org>
+
+[ Upstream commit 2e1daee14e67fbf9b27280b974e2c680a22cabea ]
+
+After gnulib update sed stopped matching `[[:space:]]*+' as before,
+causing the following compilation error:
+
+ In file included from builtin-trace.c:719:
+ trace/beauty/generated/fsconfig_arrays.c:2:3: error: expected expression before ']' token
+ 2 | [] = "",
+ | ^
+ trace/beauty/generated/fsconfig_arrays.c:2:3: error: array index in initializer not of integer type
+ trace/beauty/generated/fsconfig_arrays.c:2:3: note: (near initialization for 'fsconfig_cmds')
+
+Fix this by correcting the regular expression used in the generator.
+Also, clean up the script by removing redundant egrep, xargs, and printf
+invocations.
+
+Committer testing:
+
+Continues to work:
+
+ $ cat tools/perf/trace/beauty/fsconfig.sh
+ #!/bin/sh
+ # SPDX-License-Identifier: LGPL-2.1
+
+ if [ $# -ne 1 ] ; then
+ linux_header_dir=tools/include/uapi/linux
+ else
+ linux_header_dir=$1
+ fi
+
+ linux_mount=${linux_header_dir}/mount.h
+
+ printf "static const char *fsconfig_cmds[] = {\n"
+ ms='[[:space:]]*'
+ sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
+ ${linux_mount}
+ printf "};\n"
+ $ tools/perf/trace/beauty/fsconfig.sh
+ static const char *fsconfig_cmds[] = {
+ [0] = "SET_FLAG",
+ [1] = "SET_STRING",
+ [2] = "SET_BINARY",
+ [3] = "SET_PATH",
+ [4] = "SET_PATH_EMPTY",
+ [5] = "SET_FD",
+ [6] = "CMD_CREATE",
+ [7] = "CMD_RECONFIGURE",
+ };
+ $
+
+Fixes: d35293004a5e4 ("perf beauty: Add generator for fsconfig's 'cmd' arg values")
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: http://lore.kernel.org/lkml/20210414182723.1670663-1-vt@altlinux.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/trace/beauty/fsconfig.sh | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/trace/beauty/fsconfig.sh b/tools/perf/trace/beauty/fsconfig.sh
+index 83fb24df05c9..bc6ef7bb7a5f 100755
+--- a/tools/perf/trace/beauty/fsconfig.sh
++++ b/tools/perf/trace/beauty/fsconfig.sh
+@@ -10,8 +10,7 @@ fi
+ linux_mount=${linux_header_dir}/mount.h
+
+ printf "static const char *fsconfig_cmds[] = {\n"
+-regex='^[[:space:]]*+FSCONFIG_([[:alnum:]_]+)[[:space:]]*=[[:space:]]*([[:digit:]]+)[[:space:]]*,[[:space:]]*.*'
+-egrep $regex ${linux_mount} | \
+- sed -r "s/$regex/\2 \1/g" | \
+- xargs printf "\t[%s] = \"%s\",\n"
++ms='[[:space:]]*'
++sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
++ ${linux_mount}
+ printf "};\n"
+--
+2.30.2
+
--- /dev/null
+From 00e509e7630a5363c353b23adbbde4fa029cfc64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 11:17:51 -0300
+Subject: perf symbols: Fix dso__fprintf_symbols_by_name() to return the number
+ of printed chars
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 210e4c89ef61432040c6cd828fefa441f4887186 ]
+
+The 'ret' variable was initialized to zero but then it was not updated
+from the fprintf() return, fix it.
+
+Reported-by: Yang Li <yang.lee@linux.alibaba.com>
+cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+cc: Ingo Molnar <mingo@redhat.com>
+cc: Jiri Olsa <jolsa@redhat.com>
+cc: Mark Rutland <mark.rutland@arm.com>
+cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Fixes: 90f18e63fbd00513 ("perf symbols: List symbols in a dso in ascending name order")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol_fprintf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c
+index 35c936ce33ef..2664fb65e47a 100644
+--- a/tools/perf/util/symbol_fprintf.c
++++ b/tools/perf/util/symbol_fprintf.c
+@@ -68,7 +68,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso,
+
+ for (nd = rb_first_cached(&dso->symbol_names); nd; nd = rb_next(nd)) {
+ pos = rb_entry(nd, struct symbol_name_rb_node, rb_node);
+- fprintf(fp, "%s\n", pos->sym.name);
++ ret += fprintf(fp, "%s\n", pos->sym.name);
+ }
+
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From 64a16362d0a98662bf6744afe7f1a33c5f4d4777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 16:02:52 +0100
+Subject: phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y,
+ unconditionally
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6cb17707aad869de163d7bf42c253caf501be4e2 ]
+
+Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
+To fix this, restrict the automatic enabling of ARMADA375_USBCLUSTER_PHY
+to MACH_ARMADA_375, and ask the user in case of compile-testing.
+
+Fixes: eee47538ec1f2619 ("phy: add support for USB cluster on the Armada 375 SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210208150252.424706-1-geert+renesas@glider.be
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/marvell/Kconfig b/drivers/phy/marvell/Kconfig
+index 4053ba6cd0fb..6e3e5d67e816 100644
+--- a/drivers/phy/marvell/Kconfig
++++ b/drivers/phy/marvell/Kconfig
+@@ -3,8 +3,8 @@
+ # Phy drivers for Marvell platforms
+ #
+ config ARMADA375_USBCLUSTER_PHY
+- def_bool y
+- depends on MACH_ARMADA_375 || COMPILE_TEST
++ bool "Armada 375 USB cluster PHY support" if COMPILE_TEST
++ default y if MACH_ARMADA_375
+ depends on OF && HAS_IOMEM
+ select GENERIC_PHY
+
+--
+2.30.2
+
--- /dev/null
+From fe8d72c49fe4d86cffa7f7ad5e8c92430c6338ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 15:30:06 +0200
+Subject: platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards
+ with critclk_systems DMI table
+
+From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+
+[ Upstream commit d21e5abd3a005253eb033090aab2e43bce090d89 ]
+
+pmc_plt_clk* clocks are used for ethernet controllers, so need to stay
+turned on. This adds the affected board family to critclk_systems DMI
+table, so the clocks are marked as CLK_CRITICAL and not turned off.
+
+This replaces the previously listed boards with a match for the whole
+device family CBxx63. CBxx63 matches only baytrail devices.
+There are new affected boards that would otherwise need to be listed.
+There are unaffected boards in the family, but having the clocks
+turned on is not an issue.
+
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Link: https://lore.kernel.org/r/20210412133006.397679-1-linux-kernel-dev@beckhoff.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/pmc_atom.c | 28 ++--------------------------
+ 1 file changed, 2 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 2b1a3a6ee8db..597cfabc0967 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -393,34 +393,10 @@ static const struct dmi_system_id critclk_systems[] = {
+ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB3163",
++ .ident = "Beckhoff Baytrail",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB4063",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB4063"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6263",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6263"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6363",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6363"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"),
+ },
+ },
+ {
+--
+2.30.2
+
--- /dev/null
+From 56b8d05cfb1771c7a1d94f95f29e0306dc5d9fc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 15:20:08 +0800
+Subject: PM / devfreq: Use more accurate returned new_freq as resume_freq
+
+From: Dong Aisheng <aisheng.dong@nxp.com>
+
+[ Upstream commit 62453f1ba5d5def9d58e140a50f3f168f028da38 ]
+
+Use the more accurate returned new_freq as resume_freq.
+It's the same as how devfreq->previous_freq was updated.
+
+Fixes: 83f8ca45afbf0 ("PM / devfreq: add support for suspend/resume of a devfreq device")
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index dce45f7a497d..c79652ee94be 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -319,7 +319,7 @@ static int devfreq_set_target(struct devfreq *devfreq, unsigned long new_freq,
+ devfreq->previous_freq = new_freq;
+
+ if (devfreq->suspend_freq)
+- devfreq->resume_freq = cur_freq;
++ devfreq->resume_freq = new_freq;
+
+ return err;
+ }
+--
+2.30.2
+
--- /dev/null
+From a136f98a4d68d4ef10291366a0406e7ed96e5dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Apr 2021 17:24:03 +0000
+Subject: powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of
+ 'add')
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]
+
+ AS arch/powerpc/platforms/52xx/lite5200_sleep.o
+arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:
+arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression
+
+In the following code, 'addi' is wrong, has to be 'add'
+
+ /* local udelay in sram is needed */
+ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
+ mullw r12, r12, r11
+ mftb r13 /* start */
+ addi r12, r13, r12 /* end */
+
+Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+index 3a9969c429b3..054f927bfef9 100644
+--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S
++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+@@ -181,7 +181,7 @@ sram_code:
+ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
+ mullw r12, r12, r11
+ mftb r13 /* start */
+- addi r12, r13, r12 /* end */
++ add r12, r13, r12 /* end */
+ 1:
+ mftb r13 /* current */
+ cmp cr0, r13, r12
+--
+2.30.2
+
--- /dev/null
+From 8b58e9bbea17b37964fb04020172787592da9c45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 14:29:56 +1100
+Subject: powerpc/64s: Fix pte update for kernel memory on radix
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+[ Upstream commit b8b2f37cf632434456182e9002d63cbc4cccc50c ]
+
+When adding a PTE a ptesync is needed to order the update of the PTE
+with subsequent accesses otherwise a spurious fault may be raised.
+
+radix__set_pte_at() does not do this for performance gains. For
+non-kernel memory this is not an issue as any faults of this kind are
+corrected by the page fault handler. For kernel memory these faults
+are not handled. The current solution is that there is a ptesync in
+flush_cache_vmap() which should be called when mapping from the
+vmalloc region.
+
+However, map_kernel_page() does not call flush_cache_vmap(). This is
+troublesome in particular for code patching with Strict RWX on radix.
+In do_patch_instruction() the page frame that contains the instruction
+to be patched is mapped and then immediately patched. With no ordering
+or synchronization between setting up the PTE and writing to the page
+it is possible for faults.
+
+As the code patching is done using __put_user_asm_goto() the resulting
+fault is obscured - but using a normal store instead it can be seen:
+
+ BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c
+ Faulting instruction address: 0xc00000000008bd74
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
+ Modules linked in: nop_module(PO+) [last unloaded: nop_module]
+ CPU: 4 PID: 757 Comm: sh Tainted: P O 5.10.0-rc5-01361-ge3c1b78c8440-dirty #43
+ NIP: c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810
+ REGS: c000000016f634a0 TRAP: 0300 Tainted: P O (5.10.0-rc5-01361-ge3c1b78c8440-dirty)
+ MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44002884 XER: 00000000
+ CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1
+
+This results in the kind of issue reported here:
+ https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/
+
+Chris Riedl suggested a reliable way to reproduce the issue:
+ $ mount -t debugfs none /sys/kernel/debug
+ $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) &
+
+Turning ftrace on and off does a large amount of code patching which
+in usually less then 5min will crash giving a trace like:
+
+ ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000)
+ ------------[ ftrace bug ]------------
+ ftrace failed to modify
+ [<c000000000bf8e5c>] napi_busy_loop+0xc/0x390
+ actual: 11:3b:47:4b
+ Setting ftrace call site to call ftrace function
+ ftrace record flags: 80000001
+ (1)
+ expected tramp: c00000000006c96c
+ ------------[ cut here ]------------
+ WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8
+ Modules linked in: nop_module(PO-) [last unloaded: nop_module]
+ CPU: 4 PID: 809 Comm: sh Tainted: P O 5.10.0-rc5-01360-gf878ccaf250a #1
+ NIP: c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0
+ REGS: c000000004c8b760 TRAP: 0700 Tainted: P O (5.10.0-rc5-01360-gf878ccaf250a)
+ MSR: 900000000282b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28008848 XER: 20040000
+ CFAR: c0000000001a9c98 IRQMASK: 0
+ GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022
+ GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8
+ GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118
+ GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000
+ GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008
+ GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8
+ GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020
+ GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0
+ NIP ftrace_bug+0x28c/0x2e8
+ LR ftrace_bug+0x288/0x2e8
+ Call Trace:
+ ftrace_bug+0x288/0x2e8 (unreliable)
+ ftrace_modify_all_code+0x168/0x210
+ arch_ftrace_update_code+0x18/0x30
+ ftrace_run_update_code+0x44/0xc0
+ ftrace_startup+0xf8/0x1c0
+ register_ftrace_function+0x4c/0xc0
+ function_trace_init+0x80/0xb0
+ tracing_set_tracer+0x2a4/0x4f0
+ tracing_set_trace_write+0xd4/0x130
+ vfs_write+0xf0/0x330
+ ksys_write+0x84/0x140
+ system_call_exception+0x14c/0x230
+ system_call_common+0xf0/0x27c
+
+To fix this when updating kernel memory PTEs using ptesync.
+
+Fixes: f1cb8f9beba8 ("powerpc/64s/radix: avoid ptesync after set_pte and ptep_set_access_flags")
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Tidy up change log slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210208032957.1232102-1-jniethe5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++--
+ arch/powerpc/mm/book3s64/radix_pgtable.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
+index a1c60d5b50af..5131ed787409 100644
+--- a/arch/powerpc/include/asm/book3s/64/radix.h
++++ b/arch/powerpc/include/asm/book3s/64/radix.h
+@@ -206,8 +206,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr,
+ * from ptesync, it should probably go into update_mmu_cache, rather
+ * than set_pte_at (which is used to set ptes unrelated to faults).
+ *
+- * Spurious faults to vmalloc region are not tolerated, so there is
+- * a ptesync in flush_cache_vmap.
++ * Spurious faults from the kernel memory are not tolerated, so there
++ * is a ptesync in flush_cache_vmap, and __map_kernel_page() follows
++ * the pte update sequence from ISA Book III 6.10 Translation Table
++ * Update Synchronization Requirements.
+ */
+ }
+
+diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
+index 770542ccdb46..bdcb07a98cd3 100644
+--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
+@@ -97,7 +97,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+@@ -155,7 +155,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f50caa71e439f0ccf928ee852e74b70eb30be36c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 12:50:14 -0700
+Subject: powerpc/fadump: Mark fadump_calculate_reserve_size as __init
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit fbced1546eaaab57a32e56c974ea8acf10c6abd8 ]
+
+If fadump_calculate_reserve_size() is not inlined, there is a modpost
+warning:
+
+WARNING: modpost: vmlinux.o(.text+0x5196c): Section mismatch in
+reference from the function fadump_calculate_reserve_size() to the
+function .init.text:parse_crashkernel()
+The function fadump_calculate_reserve_size() references
+the function __init parse_crashkernel().
+This is often because fadump_calculate_reserve_size lacks a __init
+annotation or the annotation of parse_crashkernel is wrong.
+
+fadump_calculate_reserve_size() calls parse_crashkernel(), which is
+marked as __init and fadump_calculate_reserve_size() is called from
+within fadump_reserve_mem(), which is also marked as __init.
+
+Mark fadump_calculate_reserve_size() as __init to fix the section
+mismatch. Additionally, remove the inline keyword as it is not necessary
+to inline this function; the compiler is still free to do so if it feels
+it is worthwhile since commit 889b3c1245de ("compiler: remove
+CONFIG_OPTIMIZE_INLINING entirely").
+
+Fixes: 11550dc0a00b ("powerpc/fadump: reuse crashkernel parameter for fadump memory reservation")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1300
+Link: https://lore.kernel.org/r/20210302195013.2626335-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/fadump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 9b522152d8f0..0455dc1b2797 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -279,7 +279,7 @@ static void fadump_show_config(void)
+ * that is required for a kernel to boot successfully.
+ *
+ */
+-static inline u64 fadump_calculate_reserve_size(void)
++static __init u64 fadump_calculate_reserve_size(void)
+ {
+ u64 base, size, bootmem_min;
+ int ret;
+--
+2.30.2
+
--- /dev/null
+From b0330b91cdbaa101c6a768919764d044ed89eba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 09:49:00 +0000
+Subject: powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Huang <chenhuang5@huawei.com>
+
+[ Upstream commit 4fe529449d85e78972fa327999961ecc83a0b6db ]
+
+When compiling the powerpc with the SMP disabled, it shows the issue:
+
+arch/powerpc/kernel/watchdog.c: In function ‘watchdog_smp_panic’:
+arch/powerpc/kernel/watchdog.c:177:4: error: implicit declaration of function ‘smp_send_nmi_ipi’; did you mean ‘smp_send_stop’? [-Werror=implicit-function-declaration]
+ 177 | smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000);
+ | ^~~~~~~~~~~~~~~~
+ | smp_send_stop
+cc1: all warnings being treated as errors
+make[2]: *** [scripts/Makefile.build:273: arch/powerpc/kernel/watchdog.o] Error 1
+make[1]: *** [scripts/Makefile.build:534: arch/powerpc/kernel] Error 2
+make: *** [Makefile:1980: arch/powerpc] Error 2
+make: *** Waiting for unfinished jobs....
+
+We found that powerpc used ipi to implement hardlockup watchdog, so the
+HAVE_HARDLOCKUP_DETECTOR_ARCH should depend on the SMP.
+
+Fixes: 2104180a5369 ("powerpc/64s: implement arch-specific hardlockup watchdog")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Huang <chenhuang5@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210327094900.938555-1-chenhuang5@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index c4cbb65e742f..757175ccf53c 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -214,7 +214,7 @@ config PPC
+ select HAVE_MEMBLOCK_NODE_MAP
+ select HAVE_MOD_ARCH_SPECIFIC
+ select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S)
+- select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S)
++ select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP
+ select HAVE_OPROFILE
+ select HAVE_OPTPROBES if PPC64
+ select HAVE_PERF_EVENTS
+--
+2.30.2
+
--- /dev/null
+From 017acecd13b539949990572152540e32f706fdb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 12:26:23 -0700
+Subject: powerpc: iommu: fix build when neither PCI or IBMVIO is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ]
+
+When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a
+build error. The fault injection code is not useful in that kernel config,
+so make the FAIL_IOMMU option depend on PCI || IBMVIO.
+
+Prevents this build error (warning escalated to error):
+../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable]
+ 178 | static struct notifier_block fail_iommu_bus_notifier = {
+
+Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection")
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index b915fe658979..2ca9114fcf00 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -352,6 +352,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR
+ config FAIL_IOMMU
+ bool "Fault-injection capability for IOMMU"
+ depends on FAULT_INJECTION
++ depends on PCI || IBMVIO
+ help
+ Provide fault-injection capability for IOMMU. Each device can
+ be selectively enabled via the fail_iommu property.
+--
+2.30.2
+
--- /dev/null
+From 523d5819a871658d8c4d4409799f372905c30c8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 12:16:01 -0400
+Subject: powerpc/perf: Fix PMU constraint check for EBB events
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ]
+
+The power PMU group constraints includes check for EBB events to make
+sure all events in a group must agree on EBB. This will prevent
+scheduling EBB and non-EBB events together. But in the existing check,
+settings for constraint mask and value is interchanged. Patch fixes the
+same.
+
+Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with
+below in dmesg logs. This happens because EBB event gets enabled along
+with a non-EBB cpu event.
+
+ [35600.453346] cpu_event_pinne[41326]: illegal instruction (4)
+ at 10004a18 nip 10004a18 lr 100049f8 code 1 in
+ cpu_event_pinned_vs_ebb_test[10000000+10000]
+
+Test results after the patch:
+
+ $ ./pmu/ebb/cpu_event_pinned_vs_ebb_test
+ test: cpu_event_pinned_vs_ebb
+ tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty
+ Binding to cpu 8
+ EBB Handler is at 0x100050c8
+ read error on event 0x7fffe6bd4040!
+ PM_RUN_INST_CMPL: result 9872 running/enabled 37930432
+ success: cpu_event_pinned_vs_ebb
+
+This bug was hidden by other logic until commit 1908dc911792 (perf:
+Tweak perf_event_attr::exclusive semantics).
+
+Fixes: 4df489991182 ("powerpc/perf: Add power8 EBB support")
+Reported-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+[mpe: Mention commit 1908dc911792]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1617725761-1464-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 0b5c8f4fbdbf..944180f55a3c 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -363,8 +363,8 @@ ebb_bhrb:
+ * EBB events are pinned & exclusive, so this should never actually
+ * hit, but we leave it as a fallback in case.
+ */
+- mask |= CNST_EBB_VAL(ebb);
+- value |= CNST_EBB_MASK;
++ mask |= CNST_EBB_MASK;
++ value |= CNST_EBB_VAL(ebb);
+
+ *maskp = mask;
+ *valp = value;
+--
+2.30.2
+
--- /dev/null
+From 2ad90d1ec66213e561ad96ed13588dbc5bb1575e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 13:08:29 -0700
+Subject: powerpc/prom: Mark identical_pvr_fixup as __init
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ]
+
+If identical_pvr_fixup() is not inlined, there are two modpost warnings:
+
+WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference
+from the function identical_pvr_fixup() to the function
+.init.text:of_get_flat_dt_prop()
+The function identical_pvr_fixup() references
+the function __init of_get_flat_dt_prop().
+This is often because identical_pvr_fixup lacks a __init
+annotation or the annotation of of_get_flat_dt_prop is wrong.
+
+WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference
+from the function identical_pvr_fixup() to the function
+.init.text:identify_cpu()
+The function identical_pvr_fixup() references
+the function __init identify_cpu().
+This is often because identical_pvr_fixup lacks a __init
+annotation or the annotation of identify_cpu is wrong.
+
+identical_pvr_fixup() calls two functions marked as __init and is only
+called by a function marked as __init so it should be marked as __init
+as well. At the same time, remove the inline keywork as it is not
+necessary to inline this function. The compiler is still free to do so
+if it feels it is worthwhile since commit 889b3c1245de ("compiler:
+remove CONFIG_OPTIMIZE_INLINING entirely").
+
+Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1316
+Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index e13e96e665e0..537142b877b8 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -266,7 +266,7 @@ static struct feature_property {
+ };
+
+ #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU)
+-static inline void identical_pvr_fixup(unsigned long node)
++static __init void identical_pvr_fixup(unsigned long node)
+ {
+ unsigned int pvr;
+ const char *model = of_get_flat_dt_prop(node, "model", NULL);
+--
+2.30.2
+
--- /dev/null
+From ef1aa8e764cb78ebb4c867466a2836d8449d7aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 12:24:35 -0600
+Subject: powerpc/pseries: extract host bridge from pci_bus prior to bus
+ removal
+
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+
+[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]
+
+The pci_bus->bridge reference may no longer be valid after
+pci_bus_remove() resulting in passing a bad value to device_unregister()
+for the associated bridge device.
+
+Store the host_bridge reference in a separate variable prior to
+pci_bus_remove().
+
+Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index 561917fa54a8..afca4b737e80 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -66,6 +66,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);
+ int remove_phb_dynamic(struct pci_controller *phb)
+ {
+ struct pci_bus *b = phb->bus;
++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge);
+ struct resource *res;
+ int rc, i;
+
+@@ -92,7 +93,8 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ /* Remove the PCI bus and unregister the bridge device from sysfs */
+ phb->bus = NULL;
+ pci_remove_bus(b);
+- device_unregister(b->bridge);
++ host_bridge->bus = NULL;
++ device_unregister(&host_bridge->dev);
+
+ /* Now release the IO resource */
+ if (res->flags & IORESOURCE_IO)
+--
+2.30.2
+
--- /dev/null
+From a171d5c951ad615e81181d39d639d867f0819ca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 16:45:12 +0200
+Subject: powerpc/xive: Fix xmon command "dxi"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit 33e4bc5946432a4ac173fd08e8e30a13ab94d06d ]
+
+When under xmon, the "dxi" command dumps the state of the XIVE
+interrupts. If an interrupt number is specified, only the state of
+the associated XIVE interrupt is dumped. This form of the command
+lacks an irq_data parameter which is nevertheless used by
+xmon_xive_get_irq_config(), leading to an xmon crash.
+
+Fix that by doing a lookup in the system IRQ mapping to query the IRQ
+descriptor data. Invalid interrupt numbers, or not belonging to the
+XIVE IRQ domain, OPAL event interrupt number for instance, should be
+caught by the previous query done at the firmware level.
+
+Fixes: 97ef27507793 ("powerpc/xive: Fix xmon support on the PowerNV platform")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Greg Kurz <groug@kaod.org>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210331144514.892250-8-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/xive/common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 16df9cc8f360..2d4c09a77910 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -257,17 +257,20 @@ notrace void xmon_xive_do_dump(int cpu)
+ xmon_printf("\n");
+ }
+
++static struct irq_data *xive_get_irq_data(u32 hw_irq)
++{
++ unsigned int irq = irq_find_mapping(xive_irq_domain, hw_irq);
++
++ return irq ? irq_get_irq_data(irq) : NULL;
++}
++
+ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)
+ {
+- struct irq_chip *chip = irq_data_get_irq_chip(d);
+ int rc;
+ u32 target;
+ u8 prio;
+ u32 lirq;
+
+- if (!is_xive_irq(chip))
+- return -EINVAL;
+-
+ rc = xive_ops->get_irq_config(hw_irq, &target, &prio, &lirq);
+ if (rc) {
+ xmon_printf("IRQ 0x%08x : no config rc=%d\n", hw_irq, rc);
+@@ -277,6 +280,9 @@ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)
+ xmon_printf("IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x ",
+ hw_irq, target, prio, lirq);
+
++ if (!d)
++ d = xive_get_irq_data(hw_irq);
++
+ if (d) {
+ struct xive_irq_data *xd = irq_data_get_irq_handler_data(d);
+ u64 val = xive_esb_read(xd, XIVE_ESB_GET);
+--
+2.30.2
+
--- /dev/null
+From a7fa3ea135e784efda1d0367b3f1395d4855433c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 07:06:14 -0700
+Subject: RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ]
+
+In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside
+bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via
+pci_iounmap() in unmap_io error branch. After the callee returns err code,
+bnxt_qplib_alloc_res calls
+bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then
+dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap().
+
+My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by
+pci_iounmap() in the first time, to avoid the double free.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Acked-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+index bdbde8e22420..4041b35ea3da 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+@@ -736,6 +736,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res,
+
+ unmap_io:
+ pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem);
++ dpit->dbr_bar_reg_iomem = NULL;
+ return -ENOMEM;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c01aabbb1c5b26ef95c2bf50dfeef54543fd8941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 20:44:22 +0530
+Subject: RDMA/cxgb4: add missing qpid increment
+
+From: Potnuri Bharat Teja <bharat@chelsio.com>
+
+[ Upstream commit 3a6684385928d00b29acac7658a5ae1f2a44494c ]
+
+missing qpid increment leads to skipping few qpids while allocating QP.
+This eventually leads to adapter running out of qpids after establishing
+fewer connections than it actually supports.
+Current patch increments the qpid correctly.
+
+Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
+Link: https://lore.kernel.org/r/20210415151422.9139-1-bharat@chelsio.com
+Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
+index 5c95c789f302..e800e8e8bed5 100644
+--- a/drivers/infiniband/hw/cxgb4/resource.c
++++ b/drivers/infiniband/hw/cxgb4/resource.c
+@@ -216,7 +216,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+ goto out;
+ entry->qid = qid;
+ list_add_tail(&entry->entry, &uctx->cqids);
+- for (i = qid; i & rdev->qpmask; i++) {
++ for (i = qid + 1; i & rdev->qpmask; i++) {
+ entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From 3d83e9178330a49102aa0ea0c810ed8efaa4caa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 19:21:04 -0500
+Subject: RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
+
+From: Sindhu Devale <sindhu.devale@intel.com>
+
+[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ]
+
+When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk
+entry in the PBLE info list.
+
+Fix it by adding the chunk entry to the PBLE info list only after
+successful addition of SD in i40iw_hmc_sd_one.
+
+This fixes a static checker warning reported here:
+ https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/
+
+Fixes: 9715830157be ("i40iw: add pble resource files")
+Link: https://lore.kernel.org/r/20210416002104.323-1-shiraz.saleem@intel.com
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+index 540aab5e502d..3fafc5424e76 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n",
+ pble_rsrc->next_fpm_addr, chunk->size, chunk->size);
+ pble_rsrc->unallocated_pble -= (chunk->size >> 3);
+- list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ?
+ sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa;
+- if (sd_entry->valid)
+- return 0;
+- if (dev->is_pf) {
++ if (dev->is_pf && !sd_entry->valid) {
+ ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id,
+ sd_reg_val, idx->sd_idx,
+ sd_entry->entry_type, true);
+@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ }
+
+ sd_entry->valid = true;
++ list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ return 0;
+ error:
+ kfree(chunk);
+--
+2.30.2
+
--- /dev/null
+From f7d3dde9ff97bcd9645b7898fc9cf5dd883e5569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:35 +0000
+Subject: RDMA/qedr: Fix error return code in qedr_iw_connect()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 82af6d19d8d9 ("RDMA/qedr: Fix synchronization methods and memory leaks in qedr")
+Link: https://lore.kernel.org/r/20210408113135.92165-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 653ddf30973e..b9b46a0c4803 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ memcpy(in_params.local_mac_addr, dev->ndev->dev_addr, ETH_ALEN);
+
+ if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT,
+- &qp->iwarp_cm_flags))
++ &qp->iwarp_cm_flags)) {
++ rc = -ENODEV;
+ goto err; /* QP already being destroyed */
++ }
+
+ rc = dev->ops->iwarp_connect(dev->rdma_ctx, &in_params, &out_params);
+ if (rc) {
+--
+2.30.2
+
--- /dev/null
+From dff9848acbe65fe65dd266cb91331acda64ad8d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Apr 2021 18:16:47 -0700
+Subject: RDMA/siw: Fix a use after free in siw_alloc_mr
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 3093ee182f01689b89e9f8797b321603e5de4f63 ]
+
+Our code analyzer reported a UAF.
+
+In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
+siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
+kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
+freed object. After, the execution continue up to the err_out branch of
+siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
+
+My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
+section, to avoid the uaf.
+
+Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
+Link: https://lore.kernel.org/r/20210426011647.3561-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Bernard Metzler <bmt@zurich.ihm.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_mem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
+index e99983f07663..8bffa6e013fc 100644
+--- a/drivers/infiniband/sw/siw/siw_mem.c
++++ b/drivers/infiniband/sw/siw/siw_mem.c
+@@ -106,8 +106,6 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,
+ mem->perms = rights & IWARP_ACCESS_MASK;
+ kref_init(&mem->ref);
+
+- mr->mem = mem;
+-
+ get_random_bytes(&next, 4);
+ next &= 0x00ffffff;
+
+@@ -116,6 +114,8 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,
+ kfree(mem);
+ return -ENOMEM;
+ }
++
++ mr->mem = mem;
+ /* Set the STag index part */
+ mem->stag = id << 8;
+ mr->base_mr.lkey = mr->base_mr.rkey = mem->stag;
+--
+2.30.2
+
--- /dev/null
+From 5495dacc8e8016784ff984d382606b0912d9f6b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 11:31:32 +0000
+Subject: RDMA/srpt: Fix error return code in srpt_cm_req_recv()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: db7683d7deb2 ("IB/srpt: Fix login-related race conditions")
+Link: https://lore.kernel.org/r/20210408113132.87250-1-wangwensheng4@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 02b92e3cd9a8..2822ca5e8277 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2373,6 +2373,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n",
+ dev_name(&sdev->device->dev), port_num);
+ mutex_unlock(&sport->mutex);
++ ret = -EINVAL;
+ goto reject;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 237e33abd0874966acdcdc1827de4aa0551575a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 10:17:37 +0800
+Subject: regmap: set debugfs_name to NULL after it is freed
+
+From: Meng Li <Meng.Li@windriver.com>
+
+[ Upstream commit e41a962f82e7afb5b1ee644f48ad0b3aee656268 ]
+
+There is a upstream commit cffa4b2122f5("regmap:debugfs:
+Fix a memory leak when calling regmap_attach_dev") that
+adds a if condition when create name for debugfs_name.
+With below function invoking logical, debugfs_name is
+freed in regmap_debugfs_exit(), but it is not created again
+because of the if condition introduced by above commit.
+regmap_reinit_cache()
+ regmap_debugfs_exit()
+ ...
+ regmap_debugfs_init()
+So, set debugfs_name to NULL after it is freed.
+
+Fixes: cffa4b2122f5 ("regmap: debugfs: Fix a memory leak when calling regmap_attach_dev")
+Signed-off-by: Meng Li <Meng.Li@windriver.com>
+Link: https://lore.kernel.org/r/20210226021737.7690-1-Meng.Li@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 398991381e9a..4f2ff1b2b450 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -661,6 +661,7 @@ void regmap_debugfs_exit(struct regmap *map)
+ regmap_debugfs_free_dump_cache(map);
+ mutex_unlock(&map->cache_lock);
+ kfree(map->debugfs_name);
++ map->debugfs_name = NULL;
+ } else {
+ struct regmap_debugfs_node *node, *tmp;
+
+--
+2.30.2
+
--- /dev/null
+From 24aa8d5079e87ccdeb87e38d485cc3fdc6861e81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 13:26:07 +0800
+Subject: rtlwifi: 8821ae: upgrade PHY and RF parameters
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ]
+
+The signal strength of 5G is quite low, so user can't connect to an AP far
+away. New parameters with new format and its parser are updated by the commit
+84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but
+some parameters are missing. Use this commit to update to the novel parameters
+that use new format.
+
+Fixes: 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210219052607.7323-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++-----
+ 1 file changed, 370 insertions(+), 130 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+index 85093b3e5373..ed72a2aeb6c8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+@@ -249,7 +249,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x824, 0x00030FE0,
+ 0x828, 0x00000000,
+ 0x82C, 0x002081DD,
+- 0x830, 0x2AAA8E24,
++ 0x830, 0x2AAAEEC8,
+ 0x834, 0x0037A706,
+ 0x838, 0x06489B44,
+ 0x83C, 0x0000095B,
+@@ -324,10 +324,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x9D8, 0x00000000,
+ 0x9DC, 0x00000000,
+ 0x9E0, 0x00005D00,
+- 0x9E4, 0x00000002,
++ 0x9E4, 0x00000003,
+ 0x9E8, 0x00000001,
+ 0xA00, 0x00D047C8,
+- 0xA04, 0x01FF000C,
++ 0xA04, 0x01FF800C,
+ 0xA08, 0x8C8A8300,
+ 0xA0C, 0x2E68000F,
+ 0xA10, 0x9500BB78,
+@@ -1320,7 +1320,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x083, 0x00021800,
+ 0x084, 0x00028000,
+ 0x085, 0x00048000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x086, 0x0009483A,
++ 0xA0000000, 0x00000000,
+ 0x086, 0x00094838,
++ 0xB0000000, 0x00000000,
+ 0x087, 0x00044980,
+ 0x088, 0x00048000,
+ 0x089, 0x0000D480,
+@@ -1409,36 +1413,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x03C, 0x000CA000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00001100,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0404, 0xCDEF,
+- 0x034, 0x0004ADF3,
+- 0x034, 0x00049DF0,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF5,
+ 0x034, 0x00049DF2,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004A0F3,
++ 0x034, 0x000490B1,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004A0F3,
+ 0x034, 0x000490B1,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF5,
++ 0x034, 0x00049DF2,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF3,
++ 0x034, 0x00049DF0,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0004ADF7,
+ 0x034, 0x00049DF3,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00048DED,
+- 0x034, 0x00047DEA,
+- 0x034, 0x00046DE7,
+- 0x034, 0x00045CE9,
+- 0x034, 0x00044CE6,
+- 0x034, 0x000438C6,
+- 0x034, 0x00042886,
+- 0x034, 0x00041486,
+- 0x034, 0x00040447,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1448,7 +1448,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1458,7 +1458,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000480AE,
++ 0x034, 0x000470AB,
++ 0x034, 0x0004608B,
++ 0x034, 0x00045069,
++ 0x034, 0x00044048,
++ 0x034, 0x00043045,
++ 0x034, 0x00042026,
++ 0x034, 0x00041023,
++ 0x034, 0x00040002,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000480AE,
+ 0x034, 0x000470AB,
+ 0x034, 0x0004608B,
+@@ -1468,7 +1478,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042026,
+ 0x034, 0x00041023,
+ 0x034, 0x00040002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00048DED,
++ 0x034, 0x00047DEA,
++ 0x034, 0x00046DE7,
++ 0x034, 0x00045CE9,
++ 0x034, 0x00044CE6,
++ 0x034, 0x000438C6,
++ 0x034, 0x00042886,
++ 0x034, 0x00041486,
++ 0x034, 0x00040447,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00048DEF,
+ 0x034, 0x00047DEC,
+ 0x034, 0x00046DE9,
+@@ -1478,38 +1498,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x0004248A,
+ 0x034, 0x0004108D,
+ 0x034, 0x0004008A,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002ADF4,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002A0F3,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002A0F3,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002ADF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0002ADF7,
+- 0xFF0F0200, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00029DF4,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF1,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000290F0,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000290F0,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF1,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00029DF2,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00028DF1,
+- 0x034, 0x00027DEE,
+- 0x034, 0x00026DEB,
+- 0x034, 0x00025CEC,
+- 0x034, 0x00024CE9,
+- 0x034, 0x000238CA,
+- 0x034, 0x00022889,
+- 0x034, 0x00021489,
+- 0x034, 0x0002044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1519,7 +1537,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1529,7 +1547,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000280AF,
+ 0x034, 0x000270AC,
+ 0x034, 0x0002608B,
+@@ -1539,7 +1557,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022026,
+ 0x034, 0x00021023,
+ 0x034, 0x00020002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000280AF,
++ 0x034, 0x000270AC,
++ 0x034, 0x0002608B,
++ 0x034, 0x00025069,
++ 0x034, 0x00024048,
++ 0x034, 0x00023045,
++ 0x034, 0x00022026,
++ 0x034, 0x00021023,
++ 0x034, 0x00020002,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00028DF1,
++ 0x034, 0x00027DEE,
++ 0x034, 0x00026DEB,
++ 0x034, 0x00025CEC,
++ 0x034, 0x00024CE9,
++ 0x034, 0x000238CA,
++ 0x034, 0x00022889,
++ 0x034, 0x00021489,
++ 0x034, 0x0002044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00028DEE,
+ 0x034, 0x00027DEB,
+ 0x034, 0x00026CCD,
+@@ -1549,27 +1587,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022849,
+ 0x034, 0x00021449,
+ 0x034, 0x0002004D,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F02C0, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000A0D7,
++ 0x034, 0x000090D3,
++ 0x034, 0x000080B1,
++ 0x034, 0x000070AE,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000A0D7,
+ 0x034, 0x000090D3,
+ 0x034, 0x000080B1,
+ 0x034, 0x000070AE,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0000ADF7,
+ 0x034, 0x00009DF4,
+ 0x034, 0x00008DF1,
+ 0x034, 0x00007DEE,
+- 0xFF0F02C0, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00006DEB,
+- 0x034, 0x00005CEC,
+- 0x034, 0x00004CE9,
+- 0x034, 0x000038CA,
+- 0x034, 0x00002889,
+- 0x034, 0x00001489,
+- 0x034, 0x0000044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1577,7 +1612,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1585,7 +1620,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000608D,
+ 0x034, 0x0000506B,
+ 0x034, 0x0000404A,
+@@ -1593,7 +1628,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002044,
+ 0x034, 0x00001025,
+ 0x034, 0x00000004,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000608D,
++ 0x034, 0x0000506B,
++ 0x034, 0x0000404A,
++ 0x034, 0x00003047,
++ 0x034, 0x00002044,
++ 0x034, 0x00001025,
++ 0x034, 0x00000004,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00006DEB,
++ 0x034, 0x00005CEC,
++ 0x034, 0x00004CE9,
++ 0x034, 0x000038CA,
++ 0x034, 0x00002889,
++ 0x034, 0x00001489,
++ 0x034, 0x0000044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00006DCD,
+ 0x034, 0x00005CCD,
+ 0x034, 0x00004CCA,
+@@ -1601,11 +1652,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002888,
+ 0x034, 0x00001488,
+ 0x034, 0x00000486,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000040,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1615,7 +1666,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1625,7 +1676,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000145,
++ 0x035, 0x00008145,
++ 0x035, 0x00010145,
++ 0x035, 0x00020196,
++ 0x035, 0x00028196,
++ 0x035, 0x00030196,
++ 0x035, 0x000401C7,
++ 0x035, 0x000481C7,
++ 0x035, 0x000501C7,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1635,7 +1716,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x035, 0x00000145,
+ 0x035, 0x00008145,
+ 0x035, 0x00010145,
+@@ -1645,11 +1726,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x000401C7,
+ 0x035, 0x000481C7,
+ 0x035, 0x000501C7,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000010,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1675,7 +1756,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000056B3,
++ 0x036, 0x0000D6B3,
++ 0x036, 0x000156B3,
++ 0x036, 0x0001D6B3,
++ 0x036, 0x00026634,
++ 0x036, 0x0002E634,
++ 0x036, 0x00036634,
++ 0x036, 0x0003E634,
++ 0x036, 0x000467B4,
++ 0x036, 0x0004E7B4,
++ 0x036, 0x000567B4,
++ 0x036, 0x0005E7B4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1688,7 +1808,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x036, 0x000056B3,
+ 0x036, 0x0000D6B3,
+ 0x036, 0x000156B3,
+@@ -1701,103 +1821,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x0004E7B4,
+ 0x036, 0x000567B4,
+ 0x036, 0x0005E7B4,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00000008,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x0000022A,
++ 0x03C, 0x00000594,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x0000022A,
+ 0x03C, 0x00000594,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000820,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000820,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x00000900,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000002,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x008, 0x00002000,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0DF, 0x000000C0,
+- 0x01F, 0x00040064,
+- 0xFF0F0104, 0xABCD,
++ 0x01F, 0x00000064,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0404, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x058, 0x00081184,
+ 0x059, 0x0006016C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EAD53,
++ 0x062, 0x00093BC4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x061, 0x000EAD53,
+ 0x062, 0x00093BC4,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0200, 0xCDEF,
+- 0x063, 0x000710E9,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110E9,
++ 0xA0000000, 0x00000000,
+ 0x063, 0x000714E9,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0204, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C67C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x064, 0x0001C67C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093016,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093015,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093015,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093016,
++ 0xA0000000, 0x00000000,
+ 0x065, 0x00091016,
+- 0xFF0F0200, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x018, 0x00000006,
+ 0x0EF, 0x00002000,
+ 0x03B, 0x0003824B,
+@@ -1895,9 +2074,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x0B4, 0x0001214C,
+ 0x0B7, 0x0003000C,
+ 0x01C, 0x000539D2,
++ 0x0C4, 0x000AFE00,
+ 0x018, 0x0001F12A,
+- 0x0FE, 0x00000000,
+- 0x0FE, 0x00000000,
++ 0xFFE, 0x00000000,
++ 0xFFE, 0x00000000,
+ 0x018, 0x0001712A,
+
+ };
+@@ -2017,6 +2197,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {
+ u32 RTL8812AE_MAC_1T_ARRAYLEN = ARRAY_SIZE(RTL8812AE_MAC_REG_ARRAY);
+
+ u32 RTL8821AE_MAC_REG_ARRAY[] = {
++ 0x421, 0x0000000F,
+ 0x428, 0x0000000A,
+ 0x429, 0x00000010,
+ 0x430, 0x00000000,
+@@ -2485,7 +2666,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0xA6360001,
+ 0x81C, 0xA5380001,
+ 0x81C, 0xA43A0001,
+- 0x81C, 0xA33C0001,
++ 0x81C, 0x683C0001,
+ 0x81C, 0x673E0001,
+ 0x81C, 0x66400001,
+ 0x81C, 0x65420001,
+@@ -2519,7 +2700,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x017A0001,
+ 0x81C, 0x017C0001,
+ 0x81C, 0x017E0001,
+- 0xFF0F02C0, 0xABCD,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x81C, 0xFB000101,
++ 0x81C, 0xFA020101,
++ 0x81C, 0xF9040101,
++ 0x81C, 0xF8060101,
++ 0x81C, 0xF7080101,
++ 0x81C, 0xF60A0101,
++ 0x81C, 0xF50C0101,
++ 0x81C, 0xF40E0101,
++ 0x81C, 0xF3100101,
++ 0x81C, 0xF2120101,
++ 0x81C, 0xF1140101,
++ 0x81C, 0xF0160101,
++ 0x81C, 0xEF180101,
++ 0x81C, 0xEE1A0101,
++ 0x81C, 0xED1C0101,
++ 0x81C, 0xEC1E0101,
++ 0x81C, 0xEB200101,
++ 0x81C, 0xEA220101,
++ 0x81C, 0xE9240101,
++ 0x81C, 0xE8260101,
++ 0x81C, 0xE7280101,
++ 0x81C, 0xE62A0101,
++ 0x81C, 0xE52C0101,
++ 0x81C, 0xE42E0101,
++ 0x81C, 0xE3300101,
++ 0x81C, 0xA5320101,
++ 0x81C, 0xA4340101,
++ 0x81C, 0xA3360101,
++ 0x81C, 0x87380101,
++ 0x81C, 0x863A0101,
++ 0x81C, 0x853C0101,
++ 0x81C, 0x843E0101,
++ 0x81C, 0x69400101,
++ 0x81C, 0x68420101,
++ 0x81C, 0x67440101,
++ 0x81C, 0x66460101,
++ 0x81C, 0x49480101,
++ 0x81C, 0x484A0101,
++ 0x81C, 0x474C0101,
++ 0x81C, 0x2A4E0101,
++ 0x81C, 0x29500101,
++ 0x81C, 0x28520101,
++ 0x81C, 0x27540101,
++ 0x81C, 0x26560101,
++ 0x81C, 0x25580101,
++ 0x81C, 0x245A0101,
++ 0x81C, 0x235C0101,
++ 0x81C, 0x055E0101,
++ 0x81C, 0x04600101,
++ 0x81C, 0x03620101,
++ 0x81C, 0x02640101,
++ 0x81C, 0x01660101,
++ 0x81C, 0x01680101,
++ 0x81C, 0x016A0101,
++ 0x81C, 0x016C0101,
++ 0x81C, 0x016E0101,
++ 0x81C, 0x01700101,
++ 0x81C, 0x01720101,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x81C, 0xFB000101,
+ 0x81C, 0xFA020101,
+ 0x81C, 0xF9040101,
+@@ -2578,7 +2818,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x016E0101,
+ 0x81C, 0x01700101,
+ 0x81C, 0x01720101,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x81C, 0xFF000101,
+ 0x81C, 0xFF020101,
+ 0x81C, 0xFE040101,
+@@ -2637,7 +2877,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x046E0101,
+ 0x81C, 0x03700101,
+ 0x81C, 0x02720101,
+- 0xFF0F02C0, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x81C, 0x01740101,
+ 0x81C, 0x01760101,
+ 0x81C, 0x01780101,
+--
+2.30.2
+
--- /dev/null
+From 0723a47cb9495cb40943b9c8ab34fabad303a1d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Mar 2021 00:13:49 +0300
+Subject: sata_mv: add IRQ checks
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ]
+
+The function mv_platform_probe() neglects to check the results of the
+calls to platform_get_irq() and irq_of_parse_and_map() and blithely
+passes them to ata_host_activate() -- while the latter only checks
+for IRQ0 (treating it as a polling mode indicattion) and passes the
+negative values to devm_request_irq() causing it to fail as it takes
+unsigned values for the IRQ #...
+
+Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ
+#s to ata_host_activate(), propagate upstream the negative error codes,
+and override the IRQ0 with -EINVAL (as we don't want the polling mode).
+
+Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/sata_mv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index d7228f8e9297..d1ed9679c717 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -4097,6 +4097,10 @@ static int mv_platform_probe(struct platform_device *pdev)
+ n_ports = mv_platform_data->n_ports;
+ irq = platform_get_irq(pdev, 0);
+ }
++ if (irq < 0)
++ return irq;
++ if (!irq)
++ return -EINVAL;
+
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+--
+2.30.2
+
--- /dev/null
+From fe825f6aa33fb4faa0d4333840da21f6161f83d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 15:54:26 -0400
+Subject: sched/debug: Fix cgroup_path[] serialization
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit ad789f84c9a145f8a18744c0387cec22ec51651e ]
+
+The handling of sysrq key can be activated by echoing the key to
+/proc/sysrq-trigger or via the magic key sequence typed into a terminal
+that is connected to the system in some way (serial, USB or other mean).
+In the former case, the handling is done in a user context. In the
+latter case, it is likely to be in an interrupt context.
+
+Currently in print_cpu() of kernel/sched/debug.c, sched_debug_lock is
+taken with interrupt disabled for the whole duration of the calls to
+print_*_stats() and print_rq() which could last for the quite some time
+if the information dump happens on the serial console.
+
+If the system has many cpus and the sched_debug_lock is somehow busy
+(e.g. parallel sysrq-t), the system may hit a hard lockup panic
+depending on the actually serial console implementation of the
+system.
+
+The purpose of sched_debug_lock is to serialize the use of the global
+cgroup_path[] buffer in print_cpu(). The rests of the printk calls don't
+need serialization from sched_debug_lock.
+
+Calling printk() with interrupt disabled can still be problematic if
+multiple instances are running. Allocating a stack buffer of PATH_MAX
+bytes is not feasible because of the limited size of the kernel stack.
+
+The solution implemented in this patch is to allow only one caller at a
+time to use the full size group_path[], while other simultaneous callers
+will have to use shorter stack buffers with the possibility of path
+name truncation. A "..." suffix will be printed if truncation may have
+happened. The cgroup path name is provided for informational purpose
+only, so occasional path name truncation should not be a big problem.
+
+Fixes: efe25c2c7b3a ("sched: Reinstate group names in /proc/sched_debug")
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210415195426.6677-1-longman@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index c4b702fe1d73..faada713cfae 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -8,8 +8,6 @@
+ */
+ #include "sched.h"
+
+-static DEFINE_SPINLOCK(sched_debug_lock);
+-
+ /*
+ * This allows printing both to /proc/sched_debug and
+ * to the console
+@@ -417,16 +415,37 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group
+ #endif
+
+ #ifdef CONFIG_CGROUP_SCHED
++static DEFINE_SPINLOCK(sched_debug_lock);
+ static char group_path[PATH_MAX];
+
+-static char *task_group_path(struct task_group *tg)
++static void task_group_path(struct task_group *tg, char *path, int plen)
+ {
+- if (autogroup_path(tg, group_path, PATH_MAX))
+- return group_path;
++ if (autogroup_path(tg, path, plen))
++ return;
+
+- cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
++ cgroup_path(tg->css.cgroup, path, plen);
++}
+
+- return group_path;
++/*
++ * Only 1 SEQ_printf_task_group_path() caller can use the full length
++ * group_path[] for cgroup path. Other simultaneous callers will have
++ * to use a shorter stack buffer. A "..." suffix is appended at the end
++ * of the stack buffer so that it will show up in case the output length
++ * matches the given buffer size to indicate possible path name truncation.
++ */
++#define SEQ_printf_task_group_path(m, tg, fmt...) \
++{ \
++ if (spin_trylock(&sched_debug_lock)) { \
++ task_group_path(tg, group_path, sizeof(group_path)); \
++ SEQ_printf(m, fmt, group_path); \
++ spin_unlock(&sched_debug_lock); \
++ } else { \
++ char buf[128]; \
++ char *bufend = buf + sizeof(buf) - 3; \
++ task_group_path(tg, buf, bufend - buf); \
++ strcpy(bufend - 1, "..."); \
++ SEQ_printf(m, fmt, buf); \
++ } \
+ }
+ #endif
+
+@@ -453,7 +472,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
+ SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p));
+ #endif
+ #ifdef CONFIG_CGROUP_SCHED
+- SEQ_printf(m, " %s", task_group_path(task_group(p)));
++ SEQ_printf_task_group_path(m, task_group(p), " %s")
+ #endif
+
+ SEQ_printf(m, "\n");
+@@ -490,7 +509,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
++ SEQ_printf_task_group_path(m, cfs_rq->tg, "cfs_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "cfs_rq[%d]:\n", cpu);
+@@ -562,7 +581,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
+ {
+ #ifdef CONFIG_RT_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
++ SEQ_printf_task_group_path(m, rt_rq->tg, "rt_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "rt_rq[%d]:\n", cpu);
+@@ -614,7 +633,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
+ static void print_cpu(struct seq_file *m, int cpu)
+ {
+ struct rq *rq = cpu_rq(cpu);
+- unsigned long flags;
+
+ #ifdef CONFIG_X86
+ {
+@@ -666,13 +684,11 @@ do { \
+ }
+ #undef P
+
+- spin_lock_irqsave(&sched_debug_lock, flags);
+ print_cfs_stats(m, cpu);
+ print_rt_stats(m, cpu);
+ print_dl_stats(m, cpu);
+
+ print_rq(m, rq, cpu);
+- spin_unlock_irqrestore(&sched_debug_lock, flags);
+ SEQ_printf(m, "\n");
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 77d015663bfc561c5512abfe98605730c5863f18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Apr 2021 23:43:55 +0300
+Subject: scsi: hisi_sas: Fix IRQ checks
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 6c11dc060427e07ca144eacaccd696106b361b06 ]
+
+Commit df2d8213d9e3 ("hisi_sas: use platform_get_irq()") failed to take
+into account that irq_of_parse_and_map() and platform_get_irq() have a
+different way of indicating an error: the former returns 0 and the latter
+returns a negative error code. Fix up the IRQ checks!
+
+Link: https://lore.kernel.org/r/810f26d3-908b-1d6b-dc5c-40019726baca@omprussia.ru
+Fixes: df2d8213d9e3 ("hisi_sas: use platform_get_irq()")
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index b861a0f14c9d..3364ae0b9bfe 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -1645,7 +1645,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = i * HISI_SAS_PHY_INT_NR;
+ for (j = 0; j < HISI_SAS_PHY_INT_NR; j++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: fail map phy interrupt %d\n",
+ idx);
+ return -ENOENT;
+@@ -1664,7 +1664,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = hisi_hba->n_phy * HISI_SAS_PHY_INT_NR;
+ for (i = 0; i < hisi_hba->queue_count; i++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: could not map cq interrupt %d\n",
+ idx);
+ return -ENOENT;
+@@ -1682,7 +1682,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba)
+ idx = (hisi_hba->n_phy * HISI_SAS_PHY_INT_NR) + hisi_hba->queue_count;
+ for (i = 0; i < HISI_SAS_FATAL_INT_NR; i++, idx++) {
+ irq = platform_get_irq(pdev, idx);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(dev, "irq init: could not map fatal interrupt %d\n",
+ idx);
+ return -ENOENT;
+--
+2.30.2
+
--- /dev/null
+From a1efbe810f4f35b2a265d3902c4e87598f3b2847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 18:10:09 -0600
+Subject: scsi: ibmvfc: Fix invalid state machine BUG_ON()
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+[ Upstream commit 15cfef8623a449d40d16541687afd58e78033be3 ]
+
+This fixes an issue hitting the BUG_ON() in ibmvfc_do_work(). When going
+through a host action of IBMVFC_HOST_ACTION_RESET, we change the action to
+IBMVFC_HOST_ACTION_TGT_DEL, then drop the host lock, and reset the CRQ,
+which changes the host state to IBMVFC_NO_CRQ. If, prior to setting the
+host state to IBMVFC_NO_CRQ, ibmvfc_init_host() is called, it can then end
+up changing the host action to IBMVFC_HOST_ACTION_INIT. If we then change
+the host state to IBMVFC_NO_CRQ, we will then hit the BUG_ON().
+
+Make a couple of changes to avoid this. Leave the host action to be
+IBMVFC_HOST_ACTION_RESET or IBMVFC_HOST_ACTION_REENABLE until after we drop
+the host lock and reset or reenable the CRQ. Also harden the host state
+machine to ensure we cannot leave the reset / reenable state until we've
+finished processing the reset or reenable.
+
+Link: https://lore.kernel.org/r/20210413001009.902400-1-tyreld@linux.ibm.com
+Fixes: 73ee5d867287 ("[SCSI] ibmvfc: Fix soft lockup on resume")
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+[tyreld: added fixes tag]
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+[mkp: fix comment checkpatch warnings]
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ibmvscsi/ibmvfc.c | 57 ++++++++++++++++++++++------------
+ 1 file changed, 38 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 523809a8a232..5f8bdc5bde4b 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -493,8 +493,17 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ if (vhost->action == IBMVFC_HOST_ACTION_ALLOC_TGTS)
+ vhost->action = action;
+ break;
++ case IBMVFC_HOST_ACTION_REENABLE:
++ case IBMVFC_HOST_ACTION_RESET:
++ vhost->action = action;
++ break;
+ case IBMVFC_HOST_ACTION_INIT:
+ case IBMVFC_HOST_ACTION_TGT_DEL:
++ case IBMVFC_HOST_ACTION_LOGO:
++ case IBMVFC_HOST_ACTION_QUERY_TGTS:
++ case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
++ case IBMVFC_HOST_ACTION_NONE:
++ default:
+ switch (vhost->action) {
+ case IBMVFC_HOST_ACTION_RESET:
+ case IBMVFC_HOST_ACTION_REENABLE:
+@@ -504,15 +513,6 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ break;
+ }
+ break;
+- case IBMVFC_HOST_ACTION_LOGO:
+- case IBMVFC_HOST_ACTION_QUERY_TGTS:
+- case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
+- case IBMVFC_HOST_ACTION_NONE:
+- case IBMVFC_HOST_ACTION_RESET:
+- case IBMVFC_HOST_ACTION_REENABLE:
+- default:
+- vhost->action = action;
+- break;
+ }
+ }
+
+@@ -4339,26 +4339,45 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost)
+ case IBMVFC_HOST_ACTION_INIT_WAIT:
+ break;
+ case IBMVFC_HOST_ACTION_RESET:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ rc = ibmvfc_reset_crq(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc == H_CLOSED)
++ if (!rc || rc == H_CLOSED)
+ vio_enable_interrupts(to_vio_dev(vhost->dev));
+- if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
+- (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_RESET) {
++ /*
++ * The only action we could have changed to would have
++ * been reenable, in which case, we skip the rest of
++ * this path and wait until we've done the re-enable
++ * before sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++
++ if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
++ (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_REENABLE:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ rc = ibmvfc_reenable_crq_queue(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_REENABLE) {
++ /*
++ * The only action we could have changed to would have
++ * been reset, in which case, we skip the rest of this
++ * path and wait until we've done the reset before
++ * sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++ if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_LOGO:
+--
+2.30.2
+
--- /dev/null
+From d7d00302623bc8880355c18d0ca53dde197ef3ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:43:23 +0300
+Subject: scsi: jazz_esp: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru
+Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/jazz_esp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
+index 7f683e42c798..f55b07aa1cca 100644
+--- a/drivers/scsi/jazz_esp.c
++++ b/drivers/scsi/jazz_esp.c
+@@ -143,7 +143,9 @@ static int esp_jazz_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
+ if (err < 0)
+ goto fail_unmap_command_block;
+--
+2.30.2
+
--- /dev/null
+From 7ab344525980275c9eabac55c255ed9d605fecbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:45:12 +0300
+Subject: scsi: sni_53c710: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV
+further below). Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru
+Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sni_53c710.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
+index a85d52b5dc32..0521575c6773 100644
+--- a/drivers/scsi/sni_53c710.c
++++ b/drivers/scsi/sni_53c710.c
+@@ -59,6 +59,7 @@ static int snirm710_probe(struct platform_device *dev)
+ struct NCR_700_Host_Parameters *hostdata;
+ struct Scsi_Host *host;
+ struct resource *res;
++ int rc;
+
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (!res)
+@@ -84,7 +85,9 @@ static int snirm710_probe(struct platform_device *dev)
+ goto out_kfree;
+ host->this_id = 7;
+ host->base = base;
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = rc = platform_get_irq(dev, 0);
++ if (rc < 0)
++ goto out_put_host;
+ if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) {
+ printk(KERN_ERR "snirm710: request_irq failed!\n");
+ goto out_put_host;
+--
+2.30.2
+
--- /dev/null
+From 61517c29773ea022b8328bf23443fd061bad50ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 20:44:08 +0300
+Subject: scsi: sun3x_esp: Add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+
+[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru
+Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sun3x_esp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
+index 440a73eae647..f8b1e5748440 100644
+--- a/drivers/scsi/sun3x_esp.c
++++ b/drivers/scsi/sun3x_esp.c
+@@ -206,7 +206,9 @@ static int esp_sun3x_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs_dma;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED,
+ "SUN3X ESP", esp);
+ if (err < 0)
+--
+2.30.2
+
--- /dev/null
+From be43b02cd0445f30592a5be8a45037dc4dc64c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 14:19:43 +0200
+Subject: selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit c8d0260cdd96fdccdef0509c4160e28a1012a5d7 ]
+
+The FDB roaming test installs a destination MAC address on the wrong
+interface of an FDB database and tests whether the mirroring fails, because
+packets are sent to the wrong port. The test by mistake installs the FDB
+entry as local. This worked previously, because drivers were notified of
+local FDB entries in the same way as of static entries. However that has
+been fixed in the commit 6ab4c3117aec ("net: bridge: don't notify switchdev
+for local FDB addresses"), and local entries are not notified anymore. As a
+result, the HW is not reconfigured for the FDB roam, and mirroring keeps
+working, failing the test.
+
+To fix the issue, mark the FDB entry as static.
+
+Fixes: 9c7c8a82442c ("selftests: forwarding: mirror_gre_vlan_bridge_1q: Add more tests")
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+index c02291e9841e..880e3ab9d088 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+@@ -271,7 +271,7 @@ test_span_gre_fdb_roaming()
+
+ while ((RET == 0)); do
+ bridge fdb del dev $swp3 $h3mac vlan 555 master 2>/dev/null
+- bridge fdb add dev $swp2 $h3mac vlan 555 master
++ bridge fdb add dev $swp2 $h3mac vlan 555 master static
+ sleep 1
+ fail_test_span_gre_dir $tundev ingress
+
+--
+2.30.2
+
--- /dev/null
+From bc7b6c4f2f7cbc3f27b3213c50895c7de8d7c7cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:08 +0200
+Subject: serial: core: return early on unsupported ioctls
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 79c5966cec7b148199386ef9933c31b999379065 ]
+
+Drivers can return -ENOIOCTLCMD when an ioctl is not recognised to tell
+the upper layers to continue looking for a handler.
+
+This is not the case for the RS485 and ISO7816 ioctls whose handlers
+should return -ENOTTY directly in case a serial driver does not
+implement the corresponding methods.
+
+Fixes: a5f276f10ff7 ("serial_core: Handle TIOC[GS]RS485 ioctls.")
+Fixes: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-9-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index ad262349703b..e2ab6524119a 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1304,7 +1304,7 @@ static int uart_set_rs485_config(struct uart_port *port,
+ unsigned long flags;
+
+ if (!port->rs485_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user)))
+ return -EFAULT;
+@@ -1328,7 +1328,7 @@ static int uart_get_iso7816_config(struct uart_port *port,
+ struct serial_iso7816 aux;
+
+ if (!port->iso7816_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ spin_lock_irqsave(&port->lock, flags);
+ aux = port->iso7816;
+@@ -1348,7 +1348,7 @@ static int uart_set_iso7816_config(struct uart_port *port,
+ unsigned long flags;
+
+ if (!port->iso7816_config)
+- return -ENOIOCTLCMD;
++ return -ENOTTY;
+
+ if (copy_from_user(&iso7816, iso7816_user, sizeof(*iso7816_user)))
+ return -EFAULT;
+--
+2.30.2
+
--- /dev/null
+From b04e716fc6ffe78c36c91fbc7d9c02d3de60bdba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:22:58 +0100
+Subject: serial: stm32: fix incorrect characters on console
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ]
+
+Incorrect characters are observed on console during boot. This issue occurs
+when init/main.c is modifying termios settings to open /dev/console on the
+rootfs.
+
+This patch adds a waiting loop in set_termios to wait for TX shift register
+empty (and TX FIFO if any) before stopping serial port.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index bf83e6c212f5..6756f73fb220 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -688,8 +688,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ unsigned int baud, bits;
+ u32 usartdiv, mantissa, fraction, oversampling;
+ tcflag_t cflag = termios->c_cflag;
+- u32 cr1, cr2, cr3;
++ u32 cr1, cr2, cr3, isr;
+ unsigned long flags;
++ int ret;
+
+ if (!stm32_port->hw_flow_control)
+ cflag &= ~CRTSCTS;
+@@ -698,6 +699,15 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+
+ spin_lock_irqsave(&port->lock, flags);
+
++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
++ isr,
++ (isr & USART_SR_TC),
++ 10, 100000);
++
++ /* Send the TC error message only when ISR_TC is not set. */
++ if (ret)
++ dev_err(port->dev, "Transmission is not complete\n");
++
+ /* Stop serial port and reset value */
+ writel_relaxed(0, port->membase + ofs->cr1);
+
+--
+2.30.2
+
--- /dev/null
+From b9989dd5856f23d80039643ef8c2389244c7f9a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:23:07 +0100
+Subject: serial: stm32: fix tx_empty condition
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ]
+
+In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of
+TXE) to check transmission data register has been transmitted independently
+of the FIFO mode. TC indicates that both transmit register and shift
+register are empty. When shift register is empty, tx_empty should return
+TIOCSER_TEMT instead of TC value.
+
+Cleans the USART_CR_TC TCCF register define (transmission complete clear
+flag) as it is duplicate of USART_ICR_TCCF.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 5 ++++-
+ drivers/tty/serial/stm32-usart.h | 3 ---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 6756f73fb220..23b7bdae173c 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -502,7 +502,10 @@ static unsigned int stm32_tx_empty(struct uart_port *port)
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+
+- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE;
++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC)
++ return TIOCSER_TEMT;
++
++ return 0;
+ }
+
+ static void stm32_set_mctrl(struct uart_port *port, unsigned int mctrl)
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index a175c1094dc8..a0b816e0e89b 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -127,9 +127,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX BIT(16)
+
+-/* USART_ICR (F7) */
+-#define USART_CR_TC BIT(6)
+-
+ /* USART_DR */
+ #define USART_DR_MASK GENMASK(8, 0)
+
+--
+2.30.2
+
revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch
ovl-fix-missing-revert_creds-on-error-path.patch
usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch
+memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch
+arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch
+arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-14128
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-10654
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-13437
+serial-stm32-fix-incorrect-characters-on-console.patch
+serial-stm32-fix-tx_empty-condition.patch
+usb-typec-tcpci-check-role_control-while-interpretin.patch
+regmap-set-debugfs_name-to-null-after-it-is-freed.patch
+mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch
+mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch
+mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch
+mtd-rawnand-qcom-return-actual-error-code-instead-of.patch
+arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch
+spi-stm32-drop-devres-version-of-spi_register_master.patch
+arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch
+x86-microcode-check-for-offline-cpus-before-requesti.patch
+usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch
+usb-gadget-pch_udc-check-if-driver-is-present-before.patch
+usb-gadget-pch_udc-check-for-dma-mapping-error.patch
+crypto-qat-don-t-release-uninitialized-resources.patch
+crypto-qat-adf_status_pf_running-should-be-set-after.patch
+fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch
+fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch
+fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch
+fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch
+fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch
+fotg210-udc-complete-out-requests-on-short-packets.patch
+mtd-require-write-permissions-for-locking-and-badblo.patch
+bus-qcom-put-child-node-before-return.patch
+soundwire-bus-fix-device-found-flag-correctly.patch
+phy-marvell-armada375_usbcluster_phy-should-not-defa.patch
+crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch
+usb-gadget-aspeed-fix-dma-map-failure.patch
+usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch
+memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch
+soundwire-stream-fix-memory-leak-in-stream-config-er.patch
+m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch
+mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch
+irqchip-gic-v3-fix-of_bad_addr-error-handling.patch
+staging-rtl8192u-fix-potential-infinite-loop.patch
+staging-greybus-uart-fix-unprivileged-tioccserial.patch
+pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch
+spi-fix-use-after-free-with-devm_spi_alloc_.patch
+soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch
+soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch
+acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch
+crypto-qat-fix-a-double-free-in-adf_create_ring.patch
+cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch
+clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch
+cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch
+clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch
+clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch
+cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch
+cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch
+spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch
+usb-gadget-r8a66597-add-missing-null-check-on-return.patch
+usb-cdc-acm-fix-unprivileged-tioccserial.patch
+usb-cdc-acm-fix-tiocgserial-implementation.patch
+tty-actually-undefine-superseded-async-flags.patch
+tty-fix-return-value-for-unsupported-ioctls.patch
+serial-core-return-early-on-unsupported-ioctls.patch
+firmware-qcom-scm-fix-qcom_scm-configuration.patch
+node-fix-device-cleanups-in-error-handling-code.patch
+usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch
+platform-x86-pmc_atom-match-all-beckhoff-automation-.patch
+x86-platform-uv-fix-kexec-build-failure.patch
+drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch
+usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch
+usb-dwc2-fix-hibernation-between-host-and-device-mod.patch
+ttyprintk-add-tty-hangup-callback.patch
+xen-blkback-fix-compatibility-bug-with-single-page-r.patch
+soc-aspeed-fix-a-ternary-sign-expansion-bug.patch
+media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch
+media-omap4iss-return-error-code-when-omap4iss_get-f.patch
+media-aspeed-fix-clock-handling-logic.patch
+media-platform-sunxi-sun6i-csi-fix-error-return-code.patch
+media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch
+drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch
+x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch
+pata_arasan_cf-fix-irq-check.patch
+pata_ipx4xx_cf-fix-irq-check.patch
+sata_mv-add-irq-checks.patch
+ata-libahci_platform-fix-irq-check.patch
+nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch
+nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch
+nvme-retrigger-ana-log-update-if-group-descriptor-is.patch
+media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch
+vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch
+clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch
+clk-qcom-a53-pll-add-missing-module_device_table.patch
+clk-uniphier-fix-potential-infinite-loop.patch
+scsi-hisi_sas-fix-irq-checks.patch
+scsi-jazz_esp-add-irq-check.patch
+scsi-sun3x_esp-add-irq-check.patch
+scsi-sni_53c710-add-irq-check.patch
+scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch
+mfd-stm32-timers-avoid-clearing-auto-reload-register.patch
+nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch
+hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch
+x86-events-amd-iommu-fix-sysfs-type-mismatch.patch
+sched-debug-fix-cgroup_path-serialization.patch
+drivers-block-null_blk-main-fix-a-double-free-in-nul.patch
+hid-plantronics-workaround-for-double-volume-key-pre.patch
+perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch
+net-lapbether-prevent-racing-when-checking-whether-t.patch
+powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch
+powerpc-prom-mark-identical_pvr_fixup-as-__init.patch
+inet-use-bigger-hash-table-for-ip-id-generation.patch
+powerpc-fix-have_hardlockup_detector_arch-build-conf.patch
+alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch
+bug-remove-redundant-condition-check-in-report_bug.patch
+nfc-pn533-prevent-potential-memory-corruption.patch
+net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch
+mips-bmips-fix-syscon-reboot-nodes.patch
+alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch
+kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch
+asoc-simple-card-fix-possible-uninitialized-single_c.patch
+liquidio-fix-unintented-sign-extension-of-a-left-shi.patch
+powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch
+powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch
+powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch
+mac80211-bail-out-if-cipher-schemes-are-invalid.patch
+mt7601u-fix-always-true-expression.patch
+kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch
+rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch
+ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch
+cxgb4-fix-unintentional-sign-extension-issues.patch
+net-thunderx-fix-unintentional-sign-extension-issue.patch
+rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch
+i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch
+i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch
+i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch
+i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch
+i2c-cadence-add-irq-check.patch
+i2c-emev2-add-irq-check.patch
+i2c-jz4780-add-irq-check.patch
+i2c-sh7760-add-irq-check.patch
+powerpc-xive-fix-xmon-command-dxi.patch
+asoc-ak5558-correct-reset-polarity.patch
+drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch
+perf-beauty-fix-fsconfig-generator.patch
+mips-pci-legacy-stop-using-of_pci_range_to_resource.patch
+powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch
+rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch
+i2c-sh7760-fix-irq-error-path.patch
+mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch
+vsock-vmci-log-once-the-failed-queue-pair-allocation.patch
+gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch
+rdma-cxgb4-add-missing-qpid-increment.patch
+rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch
+alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch
+net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch
+net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch
+net-phy-intel-xway-enable-integrated-led-functions.patch
+ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch
+ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch
+powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch
+bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch
+arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch
+arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch
+net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch
+selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch
+bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch
+net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch
+rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch
+rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch
+net-bridge-mcast-fix-broken-length-header-check-for-.patch
+net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch
+kfifo-fix-ternary-sign-extension-bugs.patch
+mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch
+mm-memory-failure-unnecessary-amount-of-unmapping.patch
--- /dev/null
+From 80ebec641837c9ad79f736e0fe04cd167db167f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 09:39:19 +0930
+Subject: soc: aspeed: fix a ternary sign expansion bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ffa828534036348fa90fb3079ccc0972d202c4a ]
+
+The intent here was to return negative error codes but it actually
+returns positive values. The problem is that type promotion with
+ternary operations is quite complicated.
+
+"ret" is an int. "copied" is a u32. And the snoop_file_read() function
+returns long. What happens is that "ret" is cast to u32 and becomes
+positive then it's cast to long and it's still positive.
+
+Fix this by removing the ternary so that "ret" is type promoted directly
+to long.
+
+Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Patrick Venture <venture@google.com>
+Link: https://lore.kernel.org/r/YIE90PSXsMTa2Y8n@mwanda
+Link: https://lore.kernel.org/r/20210423000919.1249474-1-joel@jms.id.au'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-lpc-snoop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+index dbe5325a324d..538d7aab8db5 100644
+--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
++++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+@@ -95,8 +95,10 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer,
+ return -EINTR;
+ }
+ ret = kfifo_to_user(&chan->fifo, buffer, count, &copied);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static __poll_t snoop_file_poll(struct file *file,
+--
+2.30.2
+
--- /dev/null
+From 9fc2ea5a90dfc446adf8cf68a69b80c3644e57f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 15:25:26 -0800
+Subject: soc: qcom: mdt_loader: Detect truncated read of segments
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ]
+
+Given that no validation of how much data the firmware loader read in
+for a given segment truncated segment files would best case result in a
+hash verification failure, without any indication of what went wrong.
+
+Improve this by validating that the firmware loader did return the
+amount of data requested.
+
+Fixes: 445c2410a449 ("soc: qcom: mdt_loader: Use request_firmware_into_buf()")
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210107232526.716989-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index 2ddaee5ef9cc..eba7f76f9d61 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -261,6 +261,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (seg_fw->size != phdr->p_filesz) {
++ dev_err(dev,
++ "failed to load segment %d from truncated file %s\n",
++ i, fw_name);
++ release_firmware(seg_fw);
++ ret = -EINVAL;
++ break;
++ }
++
+ release_firmware(seg_fw);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 140869ae7c254f65118b5e14cd30dc75764e14f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 15:31:19 -0800
+Subject: soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ]
+
+The code validates that segments of p_memsz bytes of a segment will fit
+in the provided memory region, but does not validate that p_filesz bytes
+will, which means that an incorrectly crafted ELF header might write
+beyond the provided memory region.
+
+Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5")
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index 24cd193dec55..2ddaee5ef9cc 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (phdr->p_filesz > phdr->p_memsz) {
++ dev_err(dev,
++ "refusing to load segment %d with p_filesz > p_memsz\n",
++ i);
++ ret = -EINVAL;
++ break;
++ }
++
+ ptr = mem_region + offset;
+
+ if (phdr->p_filesz && phdr->p_offset < fw->size) {
+--
+2.30.2
+
--- /dev/null
+From 23c551eb95e0a85039cec35eff25fc64079236f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 10:48:16 +0000
+Subject: soundwire: bus: Fix device found flag correctly
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit f03690f4f6992225d05dbd1171212e5be5a370dd ]
+
+found flag is used to indicate SoundWire devices that are
+both enumerated on the bus and available in the device list.
+However this flag is not reset correctly after one iteration,
+This could miss some of the devices that are enumerated on the
+bus but not in device list. So reset this correctly to fix this issue!
+
+Fixes: d52d7a1be02c ("soundwire: Add Slave status handling helpers")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210309104816.20350-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index a90963812357..d90f00d09257 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -525,7 +525,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+ struct sdw_slave *slave, *_s;
+ struct sdw_slave_id id;
+ struct sdw_msg msg;
+- bool found = false;
++ bool found;
+ int count = 0, ret;
+ u64 addr;
+
+@@ -557,6 +557,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+
+ sdw_extract_slave_id(bus, addr, &id);
+
++ found = false;
+ /* Now compare with entries */
+ list_for_each_entry_safe(slave, _s, &bus->slaves, node) {
+ if (sdw_compare_devid(slave, id) == 0) {
+--
+2.30.2
+
--- /dev/null
+From ee348b732c3eb6c083b170b63d70c0b3af73e9cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 08:46:10 +0800
+Subject: soundwire: stream: fix memory leak in stream config error path
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 48f17f96a81763c7c8bf5500460a359b9939359f ]
+
+When stream config is failed, master runtime will release all
+slave runtime in the slave_rt_list, but slave runtime is not
+added to the list at this time. This patch frees slave runtime
+in the config error path to fix the memory leak.
+
+Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management")
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Keyon Jie <yang.jie@intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/stream.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index de7c57e17710..23accfedbf4d 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -1357,8 +1357,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
+ }
+
+ ret = sdw_config_stream(&slave->dev, stream, stream_config, true);
+- if (ret)
++ if (ret) {
++ /*
++ * sdw_release_master_stream will release s_rt in slave_rt_list in
++ * stream_error case, but s_rt is only added to slave_rt_list
++ * when sdw_config_stream is successful, so free s_rt explicitly
++ * when sdw_config_stream is failed.
++ */
++ kfree(s_rt);
+ goto stream_error;
++ }
+
+ list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list);
+
+--
+2.30.2
+
--- /dev/null
+From 891b5295b38254ac60debeb9b3e1495024515ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 02:55:27 -0700
+Subject: spi: Fix use-after-free with devm_spi_alloc_*
+
+From: William A. Kennington III <wak@google.com>
+
+[ Upstream commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 ]
+
+We can't rely on the contents of the devres list during
+spi_unregister_controller(), as the list is already torn down at the
+time we perform devres_find() for devm_spi_release_controller. This
+causes devices registered with devm_spi_alloc_{master,slave}() to be
+mistakenly identified as legacy, non-devm managed devices and have their
+reference counters decremented below 0.
+
+------------[ cut here ]------------
+WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
+[<b0396f04>] (refcount_warn_saturate) from [<b03c56a4>] (kobject_put+0x90/0x98)
+[<b03c5614>] (kobject_put) from [<b0447b4c>] (put_device+0x20/0x24)
+ r4:b6700140
+[<b0447b2c>] (put_device) from [<b07515e8>] (devm_spi_release_controller+0x3c/0x40)
+[<b07515ac>] (devm_spi_release_controller) from [<b045343c>] (release_nodes+0x84/0xc4)
+ r5:b6700180 r4:b6700100
+[<b04533b8>] (release_nodes) from [<b0454160>] (devres_release_all+0x5c/0x60)
+ r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10
+[<b0454104>] (devres_release_all) from [<b044e41c>] (__device_release_driver+0x144/0x1ec)
+ r5:b117ad94 r4:b163dc10
+[<b044e2d8>] (__device_release_driver) from [<b044f70c>] (device_driver_detach+0x84/0xa0)
+ r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10
+[<b044f688>] (device_driver_detach) from [<b044d274>] (unbind_store+0xe4/0xf8)
+
+Instead, determine the devm allocation state as a flag on the
+controller which is guaranteed to be stable during cleanup.
+
+Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation")
+Signed-off-by: William A. Kennington III <wak@google.com>
+Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 9 ++-------
+ include/linux/spi/spi.h | 3 +++
+ 2 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index e1205d72be52..7592d4de20c9 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2291,6 +2291,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
+
+ ctlr = __spi_alloc_controller(dev, size, slave);
+ if (ctlr) {
++ ctlr->devm_allocated = true;
+ *ptr = ctlr;
+ devres_add(dev, ptr);
+ } else {
+@@ -2620,11 +2621,6 @@ int devm_spi_register_controller(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
+-static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
+-{
+- return *(struct spi_controller **)res == ctlr;
+-}
+-
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2671,8 +2667,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ /* Release the last reference on the controller if its driver
+ * has not yet been converted to devm_spi_alloc_master/slave().
+ */
+- if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
+- devm_spi_match_controller, ctlr))
++ if (!ctlr->devm_allocated)
+ put_device(&ctlr->dev);
+
+ /* free bus id */
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index acd91300a4ab..7067f85cef0b 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -466,6 +466,9 @@ struct spi_controller {
+
+ #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */
+
++ /* flag indicating this is a non-devres managed controller */
++ bool devm_allocated;
++
+ /* flag indicating this is an SPI slave controller */
+ bool slave;
+
+--
+2.30.2
+
--- /dev/null
+From 5e1dee01afb61b62dd5b249be3180715bf4368f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 09:54:30 +0000
+Subject: spi: fsl-lpspi: Fix PM reference leak in
+ lpspi_prepare_xfer_hardware()
+
+From: Wang Li <wangli74@huawei.com>
+
+[ Upstream commit a03675497970a93fcf25d81d9d92a59c2d7377a7 ]
+
+pm_runtime_get_sync will increment pm usage counter even it failed.
+Forgetting to putting operation will result in reference leak here.
+Fix it by replacing it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Li <wangli74@huawei.com>
+Link: https://lore.kernel.org/r/20210409095430.29868-1-wangli74@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index ecb4396707cf..58b2da91be1c 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -207,7 +207,7 @@ static int lpspi_prepare_xfer_hardware(struct spi_controller *controller)
+ spi_controller_get_devdata(controller);
+ int ret;
+
+- ret = pm_runtime_get_sync(fsl_lpspi->dev);
++ ret = pm_runtime_resume_and_get(fsl_lpspi->dev);
+ if (ret < 0) {
+ dev_err(fsl_lpspi->dev, "failed to enable clock\n");
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From 72392145ba2747a21cfca8d89de22b2a51e79cf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 11:34:46 +0100
+Subject: spi: stm32: drop devres version of spi_register_master
+
+From: Antonio Borneo <antonio.borneo@foss.st.com>
+
+[ Upstream commit 8d559a64f00b59af9cc02b803ff52f6e6880a651 ]
+
+A call to spi_unregister_master() triggers calling remove()
+for all the spi devices binded to the spi master.
+
+Some spi device driver requires to "talk" with the spi device
+during the remove(), e.g.:
+- a LCD panel like drivers/gpu/drm/panel/panel-lg-lg4573.c
+ will turn off the backlighting sending a command over spi.
+This implies that the spi master must be fully functional when
+spi_unregister_master() is called, either if it is called
+explicitly in the master's remove() code or implicitly by the
+devres framework.
+
+Devres calls devres_release_all() to release all the resources
+"after" the remove() of the spi master driver (check code of
+__device_release_driver() in drivers/base/dd.c).
+If the spi master driver has an empty remove() then there would
+be no issue; the devres_release_all() will release everything
+in reverse order w.r.t. probe().
+But if code in spi master driver remove() disables the spi or
+makes it not functional (like in this spi-stm32), then devres
+cannot be used safely for unregistering the spi master and the
+binded spi devices.
+
+Replace devm_spi_register_master() with spi_register_master()
+and add spi_unregister_master() as first action in remove().
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+
+Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1615545286-5395-1-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 9e7a6de3c43d..3af6a5a3a4b2 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1926,7 +1926,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- ret = devm_spi_register_master(&pdev->dev, master);
++ ret = spi_register_master(master);
+ if (ret) {
+ dev_err(&pdev->dev, "spi master registration failed: %d\n",
+ ret);
+@@ -1980,6 +1980,7 @@ static int stm32_spi_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct stm32_spi *spi = spi_master_get_devdata(master);
+
++ spi_unregister_master(master);
+ spi->cfg->disable(spi);
+
+ if (master->dma_tx)
+--
+2.30.2
+
--- /dev/null
+From dec28f6bdff7843291156db5ffaeaf1542f86b94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 12:23:24 +0200
+Subject: staging: greybus: uart: fix unprivileged TIOCCSERIAL
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 60c6b305c11b5fd167ce5e2ce42f3a9098c388f0 ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+A non-privileged user has only ever been able to set the since long
+deprecated ASYNC_SPD flags and trying to change any other *supported*
+feature should result in -EPERM being returned. Setting the current
+values for any supported features should return success.
+
+Fix the greybus implementation which instead indicated that the
+TIOCSSERIAL ioctl was not even implemented when a non-privileged user
+set the current values.
+
+Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407102334.32361-7-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/uart.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index ee56ffa46501..fc1bd68889c9 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -652,8 +652,6 @@ static int set_serial_info(struct tty_struct *tty,
+ if ((close_delay != gb_tty->port.close_delay) ||
+ (closing_wait != gb_tty->port.closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ gb_tty->port.close_delay = close_delay;
+ gb_tty->port.closing_wait = closing_wait;
+--
+2.30.2
+
--- /dev/null
+From 2a7f0d0795cc0af42020fe35babe723d8f3a19c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 16:03:08 +0100
+Subject: staging: rtl8192u: Fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ]
+
+The for-loop iterates with a u8 loop counter i and compares this
+with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum
+that is a u16 type. There is a potential infinite loop if SlotNum
+is larger than the u8 loop counter. Fix this by making the loop
+counter the same type as SlotNum.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192u/r8192U_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index ddc09616248a..66cd43f963c9 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -3248,7 +3248,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum,
+ u32 *TotalRxDataNum)
+ {
+ u16 SlotIndex;
+- u8 i;
++ u16 i;
+
+ *TotalRxBcnNum = 0;
+ *TotalRxDataNum = 0;
+--
+2.30.2
+
--- /dev/null
+From e994f9ec89a9882cbf6b7aa5344653c163978d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:01 +0200
+Subject: tty: actually undefine superseded ASYNC flags
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit d09845e98a05850a8094ea8fd6dd09a8e6824fff ]
+
+Some kernel-internal ASYNC flags have been superseded by tty-port flags
+and should no longer be used by kernel drivers.
+
+Fix the misspelled "__KERNEL__" compile guards which failed their sole
+purpose to break out-of-tree drivers that have not yet been updated.
+
+Fixes: 5c0517fefc92 ("tty: core: Undefine ASYNC_* flags superceded by TTY_PORT* flags")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/tty_flags.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h
+index 900a32e63424..6a3ac496a56c 100644
+--- a/include/uapi/linux/tty_flags.h
++++ b/include/uapi/linux/tty_flags.h
+@@ -39,7 +39,7 @@
+ * WARNING: These flags are no longer used and have been superceded by the
+ * TTY_PORT_ flags in the iflags field (and not userspace-visible)
+ */
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */
+ #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */
+ #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */
+@@ -81,7 +81,7 @@
+ #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI)
+ #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI)
+
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ /* These flags are no longer used (and were always masked from userspace) */
+ #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED)
+ #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE)
+--
+2.30.2
+
--- /dev/null
+From 991425857d00313bcd65fb1debb804b4f91623cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 11:52:02 +0200
+Subject: tty: fix return value for unsupported ioctls
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ]
+
+Drivers should return -ENOTTY ("Inappropriate I/O control operation")
+when an ioctl isn't supported, while -EINVAL is used for invalid
+arguments.
+
+Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned
+-EINVAL when a tty driver did not implement the corresponding
+operations.
+
+Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a
+corresponding Fixes tag below.
+
+Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_io.c | 8 ++++----
+ include/linux/tty_driver.h | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 642765bf1023..cee7514c3aaf 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2407,14 +2407,14 @@ out:
+ * @p: pointer to result
+ *
+ * Obtain the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+
+ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ {
+- int retval = -EINVAL;
++ int retval = -ENOTTY;
+
+ if (tty->ops->tiocmget) {
+ retval = tty->ops->tiocmget(tty);
+@@ -2432,7 +2432,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ * @p: pointer to desired bits
+ *
+ * Set the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+@@ -2444,7 +2444,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
+ unsigned int set, clear, val;
+
+ if (tty->ops->tiocmset == NULL)
+- return -EINVAL;
++ return -ENOTTY;
+
+ retval = get_user(val, p);
+ if (retval)
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index 358446247ccd..7186d77f431e 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -236,7 +236,7 @@
+ *
+ * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
+ * structure to complete. This method is optional and will only be called
+- * if provided (otherwise EINVAL will be returned).
++ * if provided (otherwise ENOTTY will be returned).
+ */
+
+ #include <linux/export.h>
+--
+2.30.2
+
--- /dev/null
+From 30a7f34914741a63881edb678164b2053dbaafc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 09:22:22 +0900
+Subject: ttyprintk: Add TTY hangup callback.
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ]
+
+syzbot is reporting hung task due to flood of
+
+ tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
+ port->count);
+
+message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
+decrementing port->count due to tty_hung_up_p() == true.
+
+----------
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+ int i;
+ int fd[10];
+
+ for (i = 0; i < 10; i++)
+ fd[i] = open("/dev/ttyprintk", O_WRONLY);
+ ioctl(fd[0], TIOCVHANGUP);
+ for (i = 0; i < 10; i++)
+ close(fd[i]);
+ close(open("/dev/ttyprintk", O_WRONLY));
+ return 0;
+}
+----------
+
+When TTY hangup happens, port->count needs to be reset via
+"struct tty_operations"->hangup callback.
+
+[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
+
+Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
+Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com>
+Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
+Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ttyprintk.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
+index 56db949a7b70..e6258b4485dc 100644
+--- a/drivers/char/ttyprintk.c
++++ b/drivers/char/ttyprintk.c
+@@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
+ return 0;
+ }
+
++/*
++ * TTY operations hangup function.
++ */
++static void tpk_hangup(struct tty_struct *tty)
++{
++ struct ttyprintk_port *tpkp = tty->driver_data;
++
++ tty_port_hangup(&tpkp->port);
++}
++
+ static const struct tty_operations ttyprintk_ops = {
+ .open = tpk_open,
+ .close = tpk_close,
+ .write = tpk_write,
+ .write_room = tpk_write_room,
+ .ioctl = tpk_ioctl,
++ .hangup = tpk_hangup,
+ };
+
+ static const struct tty_port_operations null_ops = { };
+--
+2.30.2
+
--- /dev/null
+From 986bad983750faa63a87da5585a1f6543ded7ede Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 15:16:02 +0200
+Subject: USB: cdc-acm: fix TIOCGSERIAL implementation
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 496960274153bdeb9d1f904ff1ea875cef8232c1 ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+The xmit_fifo_size parameter could be used to set the hardware transmit
+fifo size of a legacy UART when it could not be detected, but the
+interface is limited to eight bits and should be left unset when it is
+not used.
+
+Similarly, baud_base could be used to set the UART base clock when it
+could not be detected, but might as well be left unset when it is not
+known (which is the case for CDC).
+
+Fix the cdc-acm TIOCGSERIAL implementation by dropping its custom
+interpretation of the unused xmit_fifo_size and baud_base fields, which
+overflowed the former with the URB buffer size and set the latter to the
+current line speed. Also return the port line number, which is the only
+other value used besides the close parameters.
+
+Note that the current line speed can still be retrieved through the
+standard termios interfaces.
+
+Fixes: 18c75720e667 ("USB: allow users to run setserial with cdc-acm")
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210408131602.27956-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 362d4a2d4f86..1e9aab6118f5 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -928,8 +928,7 @@ static int get_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ {
+ struct acm *acm = tty->driver_data;
+
+- ss->xmit_fifo_size = acm->writesize;
+- ss->baud_base = le32_to_cpu(acm->line.dwDTERate);
++ ss->line = acm->minor;
+ ss->close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
+ ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ ASYNC_CLOSING_WAIT_NONE :
+--
+2.30.2
+
--- /dev/null
+From 6e6b263d0a540bf3558cf382fdaa5eb7205307d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 15:16:01 +0200
+Subject: USB: cdc-acm: fix unprivileged TIOCCSERIAL
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ]
+
+TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
+serial devices is only useful for setting the close_delay and
+closing_wait parameters.
+
+A non-privileged user has only ever been able to set the since long
+deprecated ASYNC_SPD flags and trying to change any other *supported*
+feature should result in -EPERM being returned. Setting the current
+values for any supported features should return success.
+
+Fix the cdc-acm implementation which instead indicated that the
+TIOCSSERIAL ioctl was not even implemented when a non-privileged user
+set the current values.
+
+Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)")
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7e894dabcca8..362d4a2d4f86 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -954,8 +954,6 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ if ((close_delay != acm->port.close_delay) ||
+ (closing_wait != acm->port.closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ acm->port.close_delay = close_delay;
+ acm->port.closing_wait = closing_wait;
+--
+2.30.2
+
--- /dev/null
+From 480c290529e3c00e885c00bbb10a90914c3f05f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 16:47:14 +0400
+Subject: usb: dwc2: Fix hibernation between host and device modes.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+[ Upstream commit 24d209dba5a3959b2ebde7cf3ad40c8015e814cf ]
+
+When core is in hibernation in host mode and a device cable
+was connected then driver exited from device hibernation.
+However, registers saved for host mode and when exited from
+device hibernation register restore would be done for device
+register which was wrong because there was no device registers
+stored to restore.
+
+- Added dwc_handle_gpwrdn_disc_det() function which handles
+ gpwrdn disconnect detect flow and exits hibernation
+ without restoring the registers.
+- Updated exiting from hibernation in GPWRDN_STS_CHGINT with
+ calling dwc_handle_gpwrdn_disc_det() function. Here no register
+ is restored which is the solution described above.
+
+Fixes: 65c9c4c6b01f ("usb: dwc2: Add dwc2_handle_gpwrdn_intr() handler")
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210416124715.75355A005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/core_intr.c | 154 +++++++++++++++++++----------------
+ 1 file changed, 83 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index f73e78143ad1..9da27ec22d58 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -665,6 +665,71 @@ static u32 dwc2_read_common_intr(struct dwc2_hsotg *hsotg)
+ return 0;
+ }
+
++/**
++ * dwc_handle_gpwrdn_disc_det() - Handles the gpwrdn disconnect detect.
++ * Exits hibernation without restoring registers.
++ *
++ * @hsotg: Programming view of DWC_otg controller
++ * @gpwrdn: GPWRDN register
++ */
++static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg,
++ u32 gpwrdn)
++{
++ u32 gpwrdn_tmp;
++
++ /* Switch-on voltage to the core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable Power Down Clamp */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Deassert reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable PMU interrupt */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ /* De-assert Wakeup Logic */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUACTV;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ hsotg->hibernated = 0;
++ hsotg->bus_suspended = 0;
++
++ if (gpwrdn & GPWRDN_IDSTS) {
++ hsotg->op_state = OTG_STATE_B_PERIPHERAL;
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hsotg_core_init_disconnected(hsotg, false);
++ dwc2_hsotg_core_connect(hsotg);
++ } else {
++ hsotg->op_state = OTG_STATE_A_HOST;
++
++ /* Initialize the Core for Host mode */
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hcd_start(hsotg);
++ }
++}
++
+ /*
+ * GPWRDN interrupt handler.
+ *
+@@ -686,64 +751,14 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+
+ if ((gpwrdn & GPWRDN_DISCONN_DET) &&
+ (gpwrdn & GPWRDN_DISCONN_DET_MSK) && !linestate) {
+- u32 gpwrdn_tmp;
+-
+ dev_dbg(hsotg->dev, "%s: GPWRDN_DISCONN_DET\n", __func__);
+-
+- /* Switch-on voltage to the core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable Power Down Clamp */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Deassert reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable PMU interrupt */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- /* De-assert Wakeup Logic */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUACTV;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- hsotg->hibernated = 0;
+-
+- if (gpwrdn & GPWRDN_IDSTS) {
+- hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hsotg_core_init_disconnected(hsotg, false);
+- dwc2_hsotg_core_connect(hsotg);
+- } else {
+- hsotg->op_state = OTG_STATE_A_HOST;
+-
+- /* Initialize the Core for Host mode */
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hcd_start(hsotg);
+- }
+- }
+-
+- if ((gpwrdn & GPWRDN_LNSTSCHG) &&
+- (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
++ /*
++ * Call disconnect detect function to exit from
++ * hibernation
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
++ } else if ((gpwrdn & GPWRDN_LNSTSCHG) &&
++ (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_LNSTSCHG\n", __func__);
+ if (hsotg->hw_params.hibernation &&
+ hsotg->hibernated) {
+@@ -754,24 +769,21 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+ dwc2_exit_hibernation(hsotg, 1, 0, 1);
+ }
+ }
+- }
+- if ((gpwrdn & GPWRDN_RST_DET) && (gpwrdn & GPWRDN_RST_DET_MSK)) {
++ } else if ((gpwrdn & GPWRDN_RST_DET) &&
++ (gpwrdn & GPWRDN_RST_DET_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_RST_DET\n", __func__);
+ if (!linestate && (gpwrdn & GPWRDN_BSESSVLD))
+ dwc2_exit_hibernation(hsotg, 0, 1, 0);
+- }
+- if ((gpwrdn & GPWRDN_STS_CHGINT) &&
+- (gpwrdn & GPWRDN_STS_CHGINT_MSK) && linestate) {
++ } else if ((gpwrdn & GPWRDN_STS_CHGINT) &&
++ (gpwrdn & GPWRDN_STS_CHGINT_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_STS_CHGINT\n", __func__);
+- if (hsotg->hw_params.hibernation &&
+- hsotg->hibernated) {
+- if (gpwrdn & GPWRDN_IDSTS) {
+- dwc2_exit_hibernation(hsotg, 0, 0, 0);
+- call_gadget(hsotg, resume);
+- } else {
+- dwc2_exit_hibernation(hsotg, 1, 0, 1);
+- }
+- }
++ /*
++ * As GPWRDN_STS_CHGINT exit from hibernation flow is
++ * the same as in GPWRDN_DISCONN_DET flow. Call
++ * disconnect detect helper function to exit from
++ * hibernation.
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From bbe0bf91484ca8f01f165f50b810c3254195a2bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 16:47:06 +0400
+Subject: usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+[ Upstream commit c2db8d7b9568b10e014af83b3c15e39929e3579e ]
+
+Added setting "port_connect_status_change" flag to "1" in order
+to re-enumerate, because after exit from hibernation port
+connection status is not detected.
+
+Fixes: c5c403dc4336 ("usb: dwc2: Add host/device hibernation functions")
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210416124707.5EEC2A005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 258056c82206..f29fbadb0548 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5580,7 +5580,15 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup,
+ return ret;
+ }
+
+- dwc2_hcd_rem_wakeup(hsotg);
++ if (rem_wakeup) {
++ dwc2_hcd_rem_wakeup(hsotg);
++ /*
++ * Change "port_connect_status_change" flag to re-enumerate,
++ * because after exit from hibernation port connection status
++ * is not detected.
++ */
++ hsotg->flags.b.port_connect_status_change = 1;
++ }
+
+ hsotg->hibernated = 0;
+ hsotg->bus_suspended = 0;
+--
+2.30.2
+
--- /dev/null
+From 308bf7b4c23264d8f935e49b7263dae190dba03e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 21:58:31 -0700
+Subject: usb: gadget: aspeed: fix dma map failure
+
+From: Tao Ren <rentao.bupt@gmail.com>
+
+[ Upstream commit bd4d607044b961cecbf8c4c2f3bb5da4fb156993 ]
+
+Currently the virtual port_dev device is passed to DMA API, and this is
+wrong because the device passed to DMA API calls must be the actual
+hardware device performing the DMA.
+
+The patch replaces usb_gadget_map_request/usb_gadget_unmap_request APIs
+with usb_gadget_map_request_by_dev/usb_gadget_unmap_request_by_dev APIs
+so the DMA capable platform device can be passed to the DMA APIs.
+
+The patch fixes below backtrace detected on Facebook AST2500 OpenBMC
+platforms:
+
+[<80106550>] show_stack+0x20/0x24
+[<80106868>] dump_stack+0x28/0x30
+[<80823540>] __warn+0xfc/0x110
+[<8011ac30>] warn_slowpath_fmt+0xb0/0xc0
+[<8011ad44>] dma_map_page_attrs+0x24c/0x314
+[<8016a27c>] usb_gadget_map_request_by_dev+0x100/0x1e4
+[<805cedd8>] usb_gadget_map_request+0x1c/0x20
+[<805cefbc>] ast_vhub_epn_queue+0xa0/0x1d8
+[<7f02f710>] usb_ep_queue+0x48/0xc4
+[<805cd3e8>] ecm_do_notify+0xf8/0x248
+[<7f145920>] ecm_set_alt+0xc8/0x1d0
+[<7f145c34>] composite_setup+0x680/0x1d30
+[<7f00deb8>] ast_vhub_ep0_handle_setup+0xa4/0x1bc
+[<7f02ee94>] ast_vhub_dev_irq+0x58/0x84
+[<7f0309e0>] ast_vhub_irq+0xb0/0x1c8
+[<7f02e118>] __handle_irq_event_percpu+0x50/0x19c
+[<8015e5bc>] handle_irq_event_percpu+0x38/0x8c
+[<8015e758>] handle_irq_event+0x38/0x4c
+
+Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
+Link: https://lore.kernel.org/r/20210331045831.28700-1-rentao.bupt@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/aspeed-vhub/core.c | 3 ++-
+ drivers/usb/gadget/udc/aspeed-vhub/epn.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/core.c b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+index 90b134d5dca9..c1bfbfd9491d 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/core.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+@@ -36,6 +36,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+ int status)
+ {
+ bool internal = req->internal;
++ struct ast_vhub *vhub = ep->vhub;
+
+ EPVDBG(ep, "completing request @%p, status %d\n", req, status);
+
+@@ -46,7 +47,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+
+ if (req->req.dma) {
+ if (!WARN_ON(!ep->dev))
+- usb_gadget_unmap_request(&ep->dev->gadget,
++ usb_gadget_unmap_request_by_dev(&vhub->pdev->dev,
+ &req->req, ep->epn.is_in);
+ req->req.dma = 0;
+ }
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+index 66d8884615f0..2cd406e8dd99 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -376,7 +376,7 @@ static int ast_vhub_epn_queue(struct usb_ep* u_ep, struct usb_request *u_req,
+ if (ep->epn.desc_mode ||
+ ((((unsigned long)u_req->buf & 7) == 0) &&
+ (ep->epn.is_in || !(u_req->length & (u_ep->maxpacket - 1))))) {
+- rc = usb_gadget_map_request(&ep->dev->gadget, u_req,
++ rc = usb_gadget_map_request_by_dev(&vhub->pdev->dev, u_req,
+ ep->epn.is_in);
+ if (rc) {
+ dev_warn(&vhub->pdev->dev,
+--
+2.30.2
+
--- /dev/null
+From 8bd97d722bd80b1134204c9f403d53fc69fa12e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:22 +0200
+Subject: usb: gadget: pch_udc: Check for DMA mapping error
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ]
+
+DMA mapping might fail, we have to check it with dma_mapping_error().
+Otherwise DMA-API is not happy:
+
+ DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single]
+
+Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 7026d4b088db..da8aeecc59b2 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -2973,7 +2973,7 @@ static int init_dma_pools(struct pch_udc_dev *dev)
+ dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf,
+ UDC_EP0OUT_BUFF_SIZE * 4,
+ DMA_FROM_DEVICE);
+- return 0;
++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr);
+ }
+
+ static int pch_udc_start(struct usb_gadget *g,
+--
+2.30.2
+
--- /dev/null
+From 1ede625bf56e6a2326c60e84dd6becc20bb0a30e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:21 +0200
+Subject: usb: gadget: pch_udc: Check if driver is present before calling
+ ->setup()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ]
+
+Since we have a separate routine for VBUS sense, the interrupt may occur
+before gadget driver is present. Hence, ->setup() call may oops the kernel:
+
+[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010
+...
+[ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f
+...
+[ 55.245843] <IRQ>
+[ 55.245843] ? pch_udc_svc_data_out+0x160/0x160
+
+Check if driver is present before calling ->setup().
+
+Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 4006c946d993..7026d4b088db 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -2325,6 +2325,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
+ pch_udc_set_dma(dev, DMA_DIR_RX);
+ }
+
++static int pch_udc_gadget_setup(struct pch_udc_dev *dev)
++ __must_hold(&dev->lock)
++{
++ int rc;
++
++ /* In some cases we can get an interrupt before driver gets setup */
++ if (!dev->driver)
++ return -ESHUTDOWN;
++
++ spin_unlock(&dev->lock);
++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data);
++ spin_lock(&dev->lock);
++ return rc;
++}
++
+ /**
+ * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts
+ * @dev: Reference to the device structure
+@@ -2396,15 +2411,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
+ dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
+ else /* OUT */
+ dev->gadget.ep0 = &ep->ep;
+- spin_lock(&dev->lock);
+ /* If Mass storage Reset */
+ if ((dev->setup_data.bRequestType == 0x21) &&
+ (dev->setup_data.bRequest == 0xFF))
+ dev->prot_stall = 0;
+ /* call gadget with setup data received */
+- setup_supported = dev->driver->setup(&dev->gadget,
+- &dev->setup_data);
+- spin_unlock(&dev->lock);
++ setup_supported = pch_udc_gadget_setup(dev);
+
+ if (dev->setup_data.bRequestType & USB_DIR_IN) {
+ ep->td_data->status = (ep->td_data->status &
+@@ -2652,9 +2664,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
+ dev->ep[i].halted = 0;
+ }
+ dev->stall = 0;
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+@@ -2689,9 +2699,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
+ dev->stall = 0;
+
+ /* call gadget zero with setup data received */
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From f4e1274109452b5fdf68a47123853be860b17dc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 17:36:20 +0200
+Subject: usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ]
+
+Either way ~0 will be in the correct byte order, hence
+replace cpu_to_le32() by lower_32_bits(). Moreover,
+it makes sparse happy, otherwise it complains:
+
+.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types)
+.../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr
+.../pch_udc.c:1813:27: got restricted __le32 [usertype]
+
+Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index e5577315c717..4006c946d993 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -1782,7 +1782,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep,
+ }
+ /* prevent from using desc. - set HOST BUSY */
+ dma_desc->status |= PCH_UDC_BS_HST_BSY;
+- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID);
++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID);
+ req->td_data = dma_desc;
+ req->td_data_last = dma_desc;
+ req->chain_len = 1;
+--
+2.30.2
+
--- /dev/null
+From 78d799a00daa9b9dc720b4403c48468559385909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 19:45:10 +0100
+Subject: usb: gadget: r8a66597: Add missing null check on return from
+ platform_get_resource
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ]
+
+The call to platform_get_resource can potentially return a NULL pointer
+on failure, so add this check and return -EINVAL if it fails.
+
+Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Addresses-Coverity: ("Dereference null return")
+Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
+index 11e25a3f4f1f..a766476fd742 100644
+--- a/drivers/usb/gadget/udc/r8a66597-udc.c
++++ b/drivers/usb/gadget/udc/r8a66597-udc.c
+@@ -1852,6 +1852,8 @@ static int r8a66597_probe(struct platform_device *pdev)
+ return PTR_ERR(reg);
+
+ ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++ if (!ires)
++ return -EINVAL;
+ irq = ires->start;
+ irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
+
+--
+2.30.2
+
--- /dev/null
+From 9970cadf6894a903b382857dfbeec3b9f8c69b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 21:01:59 +0800
+Subject: USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 2e3d055bf27d70204cae349335a62a4f9b7c165a ]
+
+IS_ERR() and PTR_ERR() use wrong pointer, it should be
+udc->virt_addr, fix it.
+
+Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210330130159.1051979-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/snps_udc_plat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c
+index 32f1d3e90c26..99805d60a7ab 100644
+--- a/drivers/usb/gadget/udc/snps_udc_plat.c
++++ b/drivers/usb/gadget/udc/snps_udc_plat.c
+@@ -114,8 +114,8 @@ static int udc_plat_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ udc->virt_addr = devm_ioremap_resource(dev, res);
+- if (IS_ERR(udc->regs))
+- return PTR_ERR(udc->regs);
++ if (IS_ERR(udc->virt_addr))
++ return PTR_ERR(udc->virt_addr);
+
+ /* udc csr registers base */
+ udc->csr = udc->virt_addr + UDC_CSR_ADDR;
+--
+2.30.2
+
--- /dev/null
+From ec97df8f829915decf55d018ee0c0ae98a6e037e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 23:09:31 -0800
+Subject: usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ]
+
+While interpreting CC_STATUS, ROLE_CONTROL has to be read to make
+sure that CC1/CC2 is not forced presenting Rp/Rd.
+
+>From the TCPCI spec:
+
+4.4.5.2 ROLE_CONTROL (Normative):
+The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes
+to control the Rp/Rd directly instead of having the TCPC perform
+DRP toggling autonomously. When controlling Rp/Rd directly, the
+TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the
+CC1/CC2 values. This control is used for TCPM-TCPC implementing
+Source or Sink only as well as when a connection has been detected
+via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk.
+
+Table 4-22. CC_STATUS Register Definition:
+If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1)
+00b: SNK.Open (Below maximum vRa)
+01b: SNK.Default (Above minimum vRd-Connect)
+10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A
+11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A
+
+If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1)
+00b: SNK.Open (Below maximum vRa)
+01b: SNK.Default (Above minimum vRd-Connect)
+10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A
+11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A
+
+Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20210304070931.1947316-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/tcpci.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
+index 753645bb2527..59e304a341f8 100644
+--- a/drivers/usb/typec/tcpm/tcpci.c
++++ b/drivers/usb/typec/tcpm/tcpci.c
+@@ -20,6 +20,15 @@
+
+ #define PD_RETRY_COUNT 3
+
++#define tcpc_presenting_cc1_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT)))
++#define tcpc_presenting_cc2_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT)))
++
+ struct tcpci {
+ struct device *dev;
+
+@@ -168,19 +177,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc,
+ enum typec_cc_status *cc1, enum typec_cc_status *cc2)
+ {
+ struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
+- unsigned int reg;
++ unsigned int reg, role_control;
+ int ret;
+
++ ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control);
++ if (ret < 0)
++ return ret;
++
+ ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, ®);
+ if (ret < 0)
+ return ret;
+
+ *cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) &
+ TCPC_CC_STATUS_CC1_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc1_rd(role_control));
+ *cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) &
+ TCPC_CC_STATUS_CC2_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc2_rd(role_control));
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From d30777c473852ca85f713f5e2596446ded59ea81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 19:23:05 +0800
+Subject: usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 1d08ed588c6a85a35a24c82eb4cf0807ec2b366a ]
+
+Add the missing unlock before return from function usbip_sockfd_store()
+in the error handling case.
+
+Fixes: bd8b82042269 ("usbip: vudc synchronize sysfs code paths")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20210408112305.1022247-1-yebin10@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vudc_sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index f7633ee655a1..d1cf6b51bf85 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -156,12 +156,14 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+ tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx");
+ if (IS_ERR(tcp_rx)) {
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+ tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx");
+ if (IS_ERR(tcp_tx)) {
+ kthread_stop(tcp_rx);
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 56d2145b29a6986781e9737855c29f57974a44af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 16:40:25 -0300
+Subject: vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ]
+
+There is a small race where the parent is NULL even though the kobj has
+already been made visible in sysfs.
+
+For instance the attribute_group is made visible in sysfs_create_files()
+and the mdev_type_attr_show() does:
+
+ ret = attr->show(kobj, type->parent->dev, buf);
+
+Which will crash on NULL parent. Move the parent setup to before the type
+pointer leaves the stack frame.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Message-Id: <2-v2-d36939638fc6+d54-vfio2_jgg@nvidia.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index f32c582611eb..ca9476883f15 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -105,6 +105,7 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ return ERR_PTR(-ENOMEM);
+
+ type->kobj.kset = parent->mdev_types_kset;
++ type->parent = parent;
+
+ ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL,
+ "%s-%s", dev_driver_string(parent->dev),
+@@ -132,7 +133,6 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ }
+
+ type->group = group;
+- type->parent = parent;
+ return type;
+
+ attrs_failed:
+--
+2.30.2
+
--- /dev/null
+From b0c57c630abcc301d535eeef304665ee207cad47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 12:44:16 +0200
+Subject: vsock/vmci: log once the failed queue pair allocation
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]
+
+VMCI feature is not supported in conjunction with the vSphere Fault
+Tolerance (FT) feature.
+
+VMware Tools can repeatedly try to create a vsock connection. If FT is
+enabled the kernel logs is flooded with the following messages:
+
+ qp_alloc_hypercall result = -20
+ Could not attach to queue pair with -20
+
+"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307
+("VMCI: Stop log spew when qp allocation isn't possible"), but "Could
+not attach to queue pair with -20" is still there flooding the log.
+
+Since the error message can be useful in some cases, print it only once.
+
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 8c9c4ed90fa7..aaabcd84268a 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -576,8 +576,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
+ peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
+ out:
+ if (err < 0) {
+- pr_err("Could not attach to queue pair with %d\n",
+- err);
++ pr_err_once("Could not attach to queue pair with %d\n", err);
+ err = vmci_transport_error_to_vsock_error(err);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 2acce86ac752a3abd81fc87dc44011a5151febbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 17:11:11 -0700
+Subject: x86/events/amd/iommu: Fix sysfs type mismatch
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ]
+
+dev_attr_show() calls _iommu_event_show() via an indirect call but
+_iommu_event_show()'s type does not currently match the type of the
+show() member in 'struct device_attribute', resulting in a Control Flow
+Integrity violation.
+
+$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit
+csource=0x0a
+
+$ dmesg | grep "CFI failure"
+[ 3526.735140] CFI failure (target: _iommu_event_show...):
+
+Change _iommu_event_show() and 'struct amd_iommu_event_desc' to
+'struct device_attribute' so that there is no more CFI violation.
+
+Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
+index be50ef8572cc..6a98a7651621 100644
+--- a/arch/x86/events/amd/iommu.c
++++ b/arch/x86/events/amd/iommu.c
+@@ -81,12 +81,12 @@ static struct attribute_group amd_iommu_events_group = {
+ };
+
+ struct amd_iommu_event_desc {
+- struct kobj_attribute attr;
++ struct device_attribute attr;
+ const char *event;
+ };
+
+-static ssize_t _iommu_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf)
++static ssize_t _iommu_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct amd_iommu_event_desc *event =
+ container_of(attr, struct amd_iommu_event_desc, attr);
+--
+2.30.2
+
--- /dev/null
+From a27aafb0fcc3656399fc07fa7ffd3d15f21618af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 19:08:31 +0900
+Subject: x86/kprobes: Fix to check non boostable prefixes correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ]
+
+There are 2 bugs in the can_boost() function because of using
+x86 insn decoder. Since the insn->opcode never has a prefix byte,
+it can not find CS override prefix in it. And the insn->attr is
+the attribute of the opcode, thus inat_is_address_size_prefix(
+insn->attr) always returns false.
+
+Fix those by checking each prefix bytes with for_each_insn_prefix
+loop and getting the correct attribute for each prefix byte.
+Also, this removes unlikely, because this is a slow path.
+
+Fixes: a8d11cd0714f ("kprobes/x86: Consolidate insn decoder users for copying code")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/161666691162.1120877.2808435205294352583.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 5294018535d0..c205d77d57da 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -157,6 +157,8 @@ NOKPROBE_SYMBOL(skip_prefixes);
+ int can_boost(struct insn *insn, void *addr)
+ {
+ kprobe_opcode_t opcode;
++ insn_byte_t prefix;
++ int i;
+
+ if (search_exception_tables((unsigned long)addr))
+ return 0; /* Page fault may occur on this address. */
+@@ -169,9 +171,14 @@ int can_boost(struct insn *insn, void *addr)
+ if (insn->opcode.nbytes != 1)
+ return 0;
+
+- /* Can't boost Address-size override prefix */
+- if (unlikely(inat_is_address_size_prefix(insn->attr)))
+- return 0;
++ for_each_insn_prefix(insn, i, prefix) {
++ insn_attr_t attr;
++
++ attr = inat_get_opcode_attribute(prefix);
++ /* Can't boost Address-size override prefix and CS override prefix */
++ if (prefix == 0x2e || inat_is_address_size_prefix(attr))
++ return 0;
++ }
+
+ opcode = insn->opcode.bytes[0];
+
+@@ -196,8 +203,8 @@ int can_boost(struct insn *insn, void *addr)
+ /* clear and set flags are boostable */
+ return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));
+ default:
+- /* CS override prefix and call are not boostable */
+- return (opcode != 0x2e && opcode != 0x9a);
++ /* call is not boostable */
++ return opcode != 0x9a;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 51a3d0d9d0c50ec212b841e534c6882f275480a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 09:55:15 -0700
+Subject: x86/microcode: Check for offline CPUs before requesting new microcode
+
+From: Otavio Pontes <otavio.pontes@intel.com>
+
+[ Upstream commit 7189b3c11903667808029ec9766a6e96de5012a5 ]
+
+Currently, the late microcode loading mechanism checks whether any CPUs
+are offlined, and, in such a case, aborts the load attempt.
+
+However, this must be done before the kernel caches new microcode from
+the filesystem. Otherwise, when offlined CPUs are onlined later, those
+cores are going to be updated through the CPU hotplug notifier callback
+with the new microcode, while CPUs previously onine will continue to run
+with the older microcode.
+
+For example:
+
+Turn off one core (2 threads):
+
+ echo 0 > /sys/devices/system/cpu/cpu3/online
+ echo 0 > /sys/devices/system/cpu/cpu1/online
+
+Install the ucode fails because a primary SMT thread is offline:
+
+ cp intel-ucode/06-8e-09 /lib/firmware/intel-ucode/
+ echo 1 > /sys/devices/system/cpu/microcode/reload
+ bash: echo: write error: Invalid argument
+
+Turn the core back on
+
+ echo 1 > /sys/devices/system/cpu/cpu3/online
+ echo 1 > /sys/devices/system/cpu/cpu1/online
+ cat /proc/cpuinfo |grep microcode
+ microcode : 0x30
+ microcode : 0xde
+ microcode : 0x30
+ microcode : 0xde
+
+The rationale for why the update is aborted when at least one primary
+thread is offline is because even if that thread is soft-offlined
+and idle, it will still have to participate in broadcasted MCE's
+synchronization dance or enter SMM, and in both examples it will execute
+instructions so it better have the same microcode revision as the other
+cores.
+
+ [ bp: Heavily edit and extend commit message with the reasoning behind all
+ this. ]
+
+Fixes: 30ec26da9967 ("x86/microcode: Do not upload microcode if CPUs are offline")
+Signed-off-by: Otavio Pontes <otavio.pontes@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Ashok Raj <ashok.raj@intel.com>
+Link: https://lkml.kernel.org/r/20210319165515.9240-2-otavio.pontes@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/microcode/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index cb0fdcaf1415..4a4198b806b4 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -626,16 +626,16 @@ static ssize_t reload_store(struct device *dev,
+ if (val != 1)
+ return size;
+
+- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
+- if (tmp_ret != UCODE_NEW)
+- return size;
+-
+ get_online_cpus();
+
+ ret = check_online_cpus();
+ if (ret)
+ goto put;
+
++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
++ if (tmp_ret != UCODE_NEW)
++ goto put;
++
+ mutex_lock(µcode_mutex);
+ ret = microcode_reload_late();
+ mutex_unlock(µcode_mutex);
+--
+2.30.2
+
--- /dev/null
+From e20c1fe0155495deed017dc6bc2ccdff323c82a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 09:47:42 +0200
+Subject: x86/platform/uv: Fix !KEXEC build failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit c2209ea55612efac75de0a58ef5f7394fae7fa0f ]
+
+When KEXEC is disabled, the UV build fails:
+
+ arch/x86/platform/uv/uv_nmi.c:875:14: error: ‘uv_nmi_kexec_failed’ undeclared (first use in this function)
+
+Since uv_nmi_kexec_failed is only defined in the KEXEC_CORE #ifdef branch,
+this code cannot ever have been build tested:
+
+ if (main)
+ pr_err("UV: NMI kdump: KEXEC not supported in this kernel\n");
+ atomic_set(&uv_nmi_kexec_failed, 1);
+
+Nor is this use possible in uv_handle_nmi():
+
+ atomic_set(&uv_nmi_kexec_failed, 0);
+
+These bugs were introduced in this commit:
+
+ d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails")
+
+Which added the uv_nmi_kexec_failed assignments to !KEXEC code, while making the
+definition KEXEC-only - apparently without testing the !KEXEC case.
+
+Instead of complicating the #ifdef maze, simplify the code by requiring X86_UV
+to depend on KEXEC_CORE. This pattern is present in other architectures as well.
+
+( We'll remove the untested, 7 years old !KEXEC complications from the file in a
+ separate commit. )
+
+Fixes: d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Mike Travis <travis@sgi.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 8ef85139553f..36a28b9e46cb 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -550,6 +550,7 @@ config X86_UV
+ depends on X86_EXTENDED_PLATFORM
+ depends on NUMA
+ depends on EFI
++ depends on KEXEC_CORE
+ depends on X86_X2APIC
+ depends on PCI
+ ---help---
+--
+2.30.2
+
--- /dev/null
+From 0487a39342b1d55e93177e31c6f0544d073597ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:56:59 +0000
+Subject: xen-blkback: fix compatibility bug with single page rings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Durrant <pdurrant@amazon.com>
+
+[ Upstream commit d75e7f63b7c95c527cde42efb5d410d7f961498f ]
+
+Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid
+inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the
+behaviour of xen-blkback when connecting to a frontend was:
+
+- read 'ring-page-order'
+- if not present then expect a single page ring specified by 'ring-ref'
+- else expect a ring specified by 'ring-refX' where X is between 0 and
+ 1 << ring-page-order
+
+This was correct behaviour, but was broken by the afforementioned commit to
+become:
+
+- read 'ring-page-order'
+- if not present then expect a single page ring (i.e. ring-page-order = 0)
+- expect a ring specified by 'ring-refX' where X is between 0 and
+ 1 << ring-page-order
+- if that didn't work then see if there's a single page ring specified by
+ 'ring-ref'
+
+This incorrect behaviour works most of the time but fails when a frontend
+that sets 'ring-page-order' is unloaded and replaced by one that does not
+because, instead of reading 'ring-ref', xen-blkback will read the stale
+'ring-ref0' left around by the previous frontend will try to map the wrong
+grant reference.
+
+This patch restores the original behaviour.
+
+Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront")
+Signed-off-by: Paul Durrant <pdurrant@amazon.com>
+Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>
+Reviewed-by: "Roger Pau Monné" <roger.pau@citrix.com>
+Link: https://lore.kernel.org/r/20210202175659.18452-1-paul@xen.org
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/xen-blkback/common.h | 1 +
+ drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++-----------------
+ 2 files changed, 17 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
+index 1d3002d773f7..20cb0c23a22c 100644
+--- a/drivers/block/xen-blkback/common.h
++++ b/drivers/block/xen-blkback/common.h
+@@ -316,6 +316,7 @@ struct xen_blkif {
+
+ struct work_struct free_work;
+ unsigned int nr_ring_pages;
++ bool multi_ref;
+ /* All rings for this device. */
+ struct xen_blkif_ring *rings;
+ unsigned int nr_rings;
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 040d7bb21397..dca91d641f1d 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -949,14 +949,17 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ for (i = 0; i < nr_grefs; i++) {
+ char ring_ref_name[RINGREF_NAME_LEN];
+
+- snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
++ if (blkif->multi_ref)
++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
++ else {
++ WARN_ON(i != 0);
++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref");
++ }
++
+ err = xenbus_scanf(XBT_NIL, dir, ring_ref_name,
+ "%u", &ring_ref[i]);
+
+ if (err != 1) {
+- if (nr_grefs == 1)
+- break;
+-
+ err = -EINVAL;
+ xenbus_dev_fatal(dev, err, "reading %s/%s",
+ dir, ring_ref_name);
+@@ -964,18 +967,6 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ }
+ }
+
+- if (err != 1) {
+- WARN_ON(nr_grefs != 1);
+-
+- err = xenbus_scanf(XBT_NIL, dir, "ring-ref", "%u",
+- &ring_ref[0]);
+- if (err != 1) {
+- err = -EINVAL;
+- xenbus_dev_fatal(dev, err, "reading %s/ring-ref", dir);
+- return err;
+- }
+- }
+-
+ err = -ENOMEM;
+ for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+@@ -1079,10 +1070,15 @@ static int connect_ring(struct backend_info *be)
+ blkif->nr_rings, blkif->blk_protocol, protocol,
+ pers_grants ? "persistent grants" : "");
+
+- ring_page_order = xenbus_read_unsigned(dev->otherend,
+- "ring-page-order", 0);
+-
+- if (ring_page_order > xen_blkif_max_ring_order) {
++ err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-page-order", "%u",
++ &ring_page_order);
++ if (err != 1) {
++ blkif->nr_ring_pages = 1;
++ blkif->multi_ref = false;
++ } else if (ring_page_order <= xen_blkif_max_ring_order) {
++ blkif->nr_ring_pages = 1 << ring_page_order;
++ blkif->multi_ref = true;
++ } else {
+ err = -EINVAL;
+ xenbus_dev_fatal(dev, err,
+ "requested ring page order %d exceed max:%d",
+@@ -1091,8 +1087,6 @@ static int connect_ring(struct backend_info *be)
+ return err;
+ }
+
+- blkif->nr_ring_pages = 1 << ring_page_order;
+-
+ if (blkif->nr_rings == 1)
+ return read_per_ring_refs(&blkif->rings[0], dev->otherend);
+ else {
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
