5.4.13-stable review

From: Ard Biesheuvel <[email protected]>

commit 500e6807ce93b1fdc7d5b827c5cc167cc35630db upstream.

In order to allow for CBC to be chained, which is something that the CTS template relies upon, implementations of CBC need to pass the IV to be used for subsequent invocations via the IV buffer. This was not implemented yet for virtio-crypto so implement it now.

---
 drivers/crypto/virtio/virtio_crypto_algs.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -435,6 +435,11 @@ __virtio_crypto_ablkcipher_do_req(struct
 		goto free;
 	}
 	memcpy(iv, req->info, ivsize);
+	if (!vc_sym_req->encrypt)
+		scatterwalk_map_and_copy(req->info, req->src,
+					 req->nbytes - AES_BLOCK_SIZE,
+					 AES_BLOCK_SIZE, 0);
+
 	sg_init_one(&iv_sg, iv, ivsize);
 	sgs[num_out++] = &iv_sg;
 	vc_sym_req->iv = iv;

@@ -571,6 +576,10 @@ static void virtio_crypto_ablkcipher_fin
 	struct ablkcipher_request *req,
 	int err)
 {
+	if (vc_sym_req->encrypt)
+		scatterwalk_map_and_copy(req->info, req->dst,
+					 req->nbytes - AES_BLOCK_SIZE,
+					 AES_BLOCK_SIZE, 0);
 	crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine,
 					   req, err);
 	kzfree(vc_sym_req->iv);

From: Daniel Vetter <daniel.vetter-/[email protected]>

commit b2662a164f9dc48da8822e56600686d639056282 upstream.

In DMA mode we have a maximum transfer size, past that the driver falls back to PIO (see the check at the top of pxa2xx_spi_transfer_one). Falling back to PIO for big transfers defeats the point of a dma engine, hence set the max transfer size to inform spi clients that they need to do something smarter.

This was uncovered by the drm_mipi_dbi spi panel code, which does large spi transfers, but stopped splitting them after:

commit e143364b4c1774f68e923a5a0bb0fca28ac25888

Author: Noralf Trønnes <[email protected]>
Date:   Fri Jul 19 17:59:10 2019 +0200

drm/tinydrm: Remove tinydrm_spi_max_transfer_size()

After this commit the code relied on the spi core to split transfers into max dma-able blocks, which also papered over the PIO fallback issue.

Fix this by setting the overall max transfer size to the DMA limit, but only when the controller runs in DMA mode.

---
 drivers/spi/spi-pxa2xx.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -1612,6 +1612,11 @@ static int pxa2xx_spi_fw_translate_cs(st
 	return cs;
 }
 
+static size_t pxa2xx_spi_max_dma_transfer_size(struct spi_device *spi)
+{
+	return MAX_DMA_LEN;
+}
+
 static int pxa2xx_spi_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;

@@ -1717,6 +1722,8 @@ static int pxa2xx_spi_probe(struct platf
 		} else {
 			controller->can_dma = pxa2xx_spi_can_dma;
 			controller->max_dma_len = MAX_DMA_LEN;
+			controller->max_transfer_size =
+				pxa2xx_spi_max_dma_transfer_size;
 		}
 	}
 

From: Jiri Kosina <[email protected]>

[ Upstream commit 9e635c2851df6caee651e589fbf937b637973c91 ]

hidraw and uhid device nodes are always available for writing so we should always report EPOLLOUT and EPOLLWRNORM bits, not only in the cases when there is nothing to read.

---
 drivers/hid/hidraw.c |    7 ++++---
 drivers/hid/uhid.c   |    5 +++--
 2 files changed, 7 insertions(+), 5 deletions(-)

@@ -249,13 +249,14 @@ out:
 static __poll_t hidraw_poll(struct file *file, poll_table *wait)
 {
 	struct hidraw_list *list = file->private_data;
+	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */
 
 	poll_wait(file, &list->hidraw->wait, wait);
 	if (list->head != list->tail)
-		return EPOLLIN | EPOLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 	if (!list->hidraw->exist)
-		return EPOLLERR | EPOLLHUP;
-	return EPOLLOUT | EPOLLWRNORM;
+		mask |= EPOLLERR | EPOLLHUP;
+	return mask;
 }
 
 static int hidraw_open(struct inode *inode, struct file *file)

@@ -766,13 +766,14 @@ unlock:
 static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
 {
 	struct uhid_device *uhid = file->private_data;
+	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uhid is always writable */
 
 	poll_wait(file, &uhid->waitq, wait);
 
 	if (uhid->head != uhid->tail)
-		return EPOLLIN | EPOLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 
-	return EPOLLOUT | EPOLLWRNORM;
+	return mask;
 }
 
 static const struct file_operations uhid_fops = {

From: Ran Bi <[email protected]>

commit 653997eeecef95c3ead4fba1b2d27e6a5854d6cd upstream.

Alarm registers high byte was reserved for other functions. This add mask in alarm registers operation functions. This also fix error condition in interrupt handler.

---
 drivers/rtc/rtc-mt6397.c |   47 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 14 deletions(-)

@@ -47,6 +47,14 @@
 
 #define RTC_AL_SEC		0x0018
 
+#define RTC_AL_SEC_MASK		0x003f
+#define RTC_AL_MIN_MASK		0x003f
+#define RTC_AL_HOU_MASK		0x001f
+#define RTC_AL_DOM_MASK		0x001f
+#define RTC_AL_DOW_MASK		0x0007
+#define RTC_AL_MTH_MASK		0x000f
+#define RTC_AL_YEA_MASK		0x007f
+
 #define RTC_PDN2		0x002e
 #define RTC_PDN2_PWRON_ALARM	BIT(4)
 

@@ -103,7 +111,7 @@ static irqreturn_t mtk_rtc_irq_handler_t
 		irqen = irqsta & ~RTC_IRQ_EN_AL;
 		mutex_lock(&rtc->lock);
 		if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
-				 irqen) < 0)
+				 irqen) == 0)
 			mtk_rtc_write_trigger(rtc);
 		mutex_unlock(&rtc->lock);
 

@@ -225,12 +233,12 @@ static int mtk_rtc_read_alarm(struct dev
 	alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
 	mutex_unlock(&rtc->lock);
 
-	tm->tm_sec = data[RTC_OFFSET_SEC];
-	tm->tm_min = data[RTC_OFFSET_MIN];
-	tm->tm_hour = data[RTC_OFFSET_HOUR];
-	tm->tm_mday = data[RTC_OFFSET_DOM];
-	tm->tm_mon = data[RTC_OFFSET_MTH];
-	tm->tm_year = data[RTC_OFFSET_YEAR];
+	tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
+	tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
+	tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
+	tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
+	tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
+	tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
 
 	tm->tm_year += RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon--;

@@ -251,14 +259,25 @@ static int mtk_rtc_set_alarm(struct devi
 	tm->tm_year -= RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon++;
 
-	data[RTC_OFFSET_SEC] = tm->tm_sec;
-	data[RTC_OFFSET_MIN] = tm->tm_min;
-	data[RTC_OFFSET_HOUR] = tm->tm_hour;
-	data[RTC_OFFSET_DOM] = tm->tm_mday;
-	data[RTC_OFFSET_MTH] = tm->tm_mon;
-	data[RTC_OFFSET_YEAR] = tm->tm_year;
-
 	mutex_lock(&rtc->lock);
+	ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
+			       data, RTC_OFFSET_COUNT);
+	if (ret < 0)
+		goto exit;
+
+	data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
+				(tm->tm_sec & RTC_AL_SEC_MASK));
+	data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
+				(tm->tm_min & RTC_AL_MIN_MASK));
+	data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
+				(tm->tm_hour & RTC_AL_HOU_MASK));
+	data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
+				(tm->tm_mday & RTC_AL_DOM_MASK));
+	data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
+				(tm->tm_mon & RTC_AL_MTH_MASK));
+	data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
+				(tm->tm_year & RTC_AL_YEA_MASK));
+
 	if (alm->enabled) {
 		ret = regmap_bulk_write(rtc->regmap,
 					rtc->addr_base + RTC_AL_SEC,

From: Tony Lindgren <[email protected]>

commit af5d44de571811a151510bfd1236407b7f551cd9 upstream.

Only the used bits get cleared with bitmap_zero() when we call gpiod_get_array_value_cansleep(). We must mask only the bits we're using for ddata->status as the other bits in the bitmap may not be initialized.

And let's also drop useless debug code accidentally left over while at it.

---
 drivers/phy/motorola/phy-mapphone-mdm6600.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

@@ -200,7 +200,7 @@ static void phy_mdm6600_status(struct wo
 	struct phy_mdm6600 *ddata;
 	struct device *dev;
 	DECLARE_BITMAP(values, PHY_MDM6600_NR_STATUS_LINES);
-	int error, i, val = 0;
+	int error;
 
 	ddata = container_of(work, struct phy_mdm6600, status_work.work);
 	dev = ddata->dev;

@@ -212,16 +212,11 @@ static void phy_mdm6600_status(struct wo
 	if (error)
 		return;
 
-	for (i = 0; i < PHY_MDM6600_NR_STATUS_LINES; i++) {
-		val |= test_bit(i, values) << i;
-		dev_dbg(ddata->dev, "XXX %s: i: %i values[i]: %i val: %i\n",
-			__func__, i, test_bit(i, values), val);
-	}
-	ddata->status = values[0];
+	ddata->status = values[0] & ((1 << PHY_MDM6600_NR_STATUS_LINES) - 1);
 
 	dev_info(dev, "modem status: %i %s\n",
 		 ddata->status,
-		 phy_mdm6600_status_name[ddata->status & 7]);
+		 phy_mdm6600_status_name[ddata->status]);
 	complete(&ddata->ack);
 }
 

From: Selvin Xavier <[email protected]>

commit 9a4467a6b282a299b932608ac2c9034f8415359f upstream.

The driver returns an error code for MR dereg, but frees the MR structure. When the MR dereg is retried due to previous error, the system crashes as the structure is already freed.

  BUG: unable to handle kernel NULL pointer dereference at 00000000000001b8
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  CPU: 7 PID: 12178 Comm: ib_send_bw Kdump: loaded Not tainted 4.18.0-124.el8.x86_64 #1
  Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 1.1.10 03/10/2015
  RIP: 0010:__dev_printk+0x2a/0x70
  Code: 0f 1f 44 00 00 49 89 d1 48 85 f6 0f 84 f6 2b 00 00 4c 8b 46 70 4d 85 c0 75 04 4c 8b

46 10 48 8b 86 a8 00 00 00 48 85 c0 74 16 <48> 8b 08 0f be 7f 01 48 c7 c2 13 ac ac 83 83 ef 30 e9 10 fe ff ff
RSP: 0018:ffffaf7c04607a60 EFLAGS: 00010006
RAX: 00000000000001b8 RBX: ffffa0010c91c488 RCX: 0000000000000246
RDX: ffffaf7c04607a68 RSI: ffffa0010c91caa8 RDI: ffffffff83a788eb
RBP: ffffaf7c04607ac8 R08: 0000000000000000 R09: ffffaf7c04607a68
R10: 0000000000000000 R11: 0000000000000001 R12: ffffaf7c04607b90
R13: 000000000000000e R14: 0000000000000000 R15: 00000000ffffa001
FS: 0000146fa1f1cdc0(0000) GS:ffffa0012fac0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000001b8 CR3: 000000007680a003 CR4: 00000000001606e0

  Call Trace:
   dev_err+0x6c/0x90
   ? dev_printk_emit+0x4e/0x70
   bnxt_qplib_rcfw_send_message+0x594/0x660 [bnxt_re]
   ? dev_err+0x6c/0x90
   bnxt_qplib_free_mrw+0x80/0xe0 [bnxt_re]
   bnxt_re_dereg_mr+0x2e/0xd0 [bnxt_re]
   ib_dereg_mr+0x2f/0x50 [ib_core]
   destroy_hw_idr_uobject+0x20/0x70 [ib_uverbs]
   uverbs_destroy_uobject+0x2e/0x170 [ib_uverbs]
   __uverbs_cleanup_ufile+0x6e/0x90 [ib_uverbs]
   uverbs_destroy_ufile_hw+0x61/0x130 [ib_uverbs]
   ib_uverbs_close+0x1f/0x80 [ib_uverbs]
   __fput+0xb7/0x230
   task_work_run+0x8a/0xb0
   do_exit+0x2da/0xb40
...
  RIP: 0033:0x146fa113a387
  Code: Bad RIP value.
  RSP: 002b:00007fff945d1478 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
  RAX: 0000000000000000 RBX: 000055a248908d70 RCX: 0000000000000000
  RDX: 0000146fa1f2b000 RSI: 0000000000000001 RDI: 000055a248906488
  RBP: 000055a248909630 R08: 0000000000010000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000000 R12: 000055a248906488
  R13: 0000000000000001 R14: 0000000000000000 R15: 000055a2489095f0

Do not free the MR structures, when driver returns error to the stack.

---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -3323,8 +3323,10 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr
 	int rc;
 
 	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-	if (rc)
+	if (rc) {
 		dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+		return rc;
+	}
 
 	if (mr->pages) {
 		rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,

From: Selvin Xavier <[email protected]>

commit c5275723580922e5f3264f96751337661a153c7d upstream.

Some adapters need a fence Work Entry to handle retransmission. Currently the driver checks for this condition, only if the Send queue entry is signalled. Implement the condition check, irrespective of the signalled state of the Work queue entries

Failure to add the fence can result in access to memory that is already marked as completed, triggering data corruption, transmission failure, IOMMU failures, etc.

---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -2283,13 +2283,13 @@ static int bnxt_qplib_cq_process_req(str
 			/* Add qp to flush list of the CQ */
 			bnxt_qplib_add_flush_qp(qp);
 		} else {
+			/* Before we complete, do WA 9060 */
+			if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+				      cqe_sq_cons)) {
+				*lib_qp = qp;
+				goto out;
+			}
 			if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
-				/* Before we complete, do WA 9060 */
-				if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
-					      cqe_sq_cons)) {
-					*lib_qp = qp;
-					goto out;
-				}
 				cqe->status = CQ_REQ_STATUS_OK;
 				cqe++;
 				(*budget)--;

From: Kaike Wan <[email protected]>

commit ca9033ba69c7e3477f207df69867b2ea969197c8 upstream.

In the iowait structure, two iowait_work entries were included to queue a given object: one for normal IB operations, and the other for TID RDMA operations. For non-TID RDMA operations, the iowait_work structure for TID RDMA is initialized to contain a NULL function (not used). When the QP is reset, the function iowait_cancel_work will be called to cancel any pending work. The problem is that this function will call cancel_work_sync() for both iowait_work entries, even though the one for TID RDMA is not used at all. Eventually, the call cascades to __flush_work(), wherein a WARN_ON will be triggered due to the fact that work->func is NULL.

The WARN_ON was introduced in commit 4d43d395fed1 ("workqueue: Try to catch flush_work() without INIT_WORK().")

This patch fixes the issue by making sure that a work function is present for TID RDMA before calling cancel_work_sync in iowait_cancel_work.

---
 drivers/infiniband/hw/hfi1/iowait.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -81,7 +81,9 @@ void iowait_init(struct iowait *wait, u3
 void iowait_cancel_work(struct iowait *w)
 {
 	cancel_work_sync(&iowait_get_ib_work(w)->iowork);
-	cancel_work_sync(&iowait_get_tid_work(w)->iowork);
+	/* Make sure that the iowork for TID RDMA is used */
+	if (iowait_get_tid_work(w)->iowork.func)
+		cancel_work_sync(&iowait_get_tid_work(w)->iowork);
 }
 
 /**

From: Christophe Kerello <[email protected]>

commit 4114b17af41272e14939b000ce8f3ed7ba937e3c upstream.

We are currently using nand_soft_waitrdy to poll the status of the NAND flash. FMC2 enables the wait feature bit (this feature is mandatory for the sequencer mode). By enabling this feature, we can't poll the status of the NAND flash, the read status command is stucked in FMC2 pipeline until R/B# signal is high, and locks the CPU bus.
To avoid to lock the CPU bus, we poll FMC2 ISR register. This register reports the status of the R/B# signal.

---
 drivers/mtd/nand/raw/stm32_fmc2_nand.c |   38 +++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

@@ -37,6 +37,7 @@
 /* Max ECC buffer length */
 #define FMC2_MAX_ECC_BUF_LEN		(FMC2_BCHDSRS_LEN * FMC2_MAX_SG)
 
+#define FMC2_TIMEOUT_US			1000
 #define FMC2_TIMEOUT_MS			1000
 
 /* Timings */

@@ -53,6 +54,8 @@
 #define FMC2_PMEM			0x88
 #define FMC2_PATT			0x8c
 #define FMC2_HECCR			0x94
+#define FMC2_ISR			0x184
+#define FMC2_ICR			0x188
 #define FMC2_CSQCR			0x200
 #define FMC2_CSQCFGR1			0x204
 #define FMC2_CSQCFGR2			0x208

@@ -118,6 +121,12 @@
 #define FMC2_PATT_ATTHIZ(x)		(((x) & 0xff) << 24)
 #define FMC2_PATT_DEFAULT		0x0a0a0a0a
 
+/* Register: FMC2_ISR */
+#define FMC2_ISR_IHLF			BIT(1)
+
+/* Register: FMC2_ICR */
+#define FMC2_ICR_CIHLF			BIT(1)
+
 /* Register: FMC2_CSQCR */
 #define FMC2_CSQCR_CSQSTART		BIT(0)
 

@@ -1322,6 +1331,31 @@ static void stm32_fmc2_write_data(struct
 		stm32_fmc2_set_buswidth_16(fmc2, true);
 }
 
+static int stm32_fmc2_waitrdy(struct nand_chip *chip, unsigned long timeout_ms)
+{
+	struct stm32_fmc2_nfc *fmc2 = to_stm32_nfc(chip->controller);
+	const struct nand_sdr_timings *timings;
+	u32 isr, sr;
+
+	/* Check if there is no pending requests to the NAND flash */
+	if (readl_relaxed_poll_timeout_atomic(fmc2->io_base + FMC2_SR, sr,
+					      sr & FMC2_SR_NWRF, 1,
+					      FMC2_TIMEOUT_US))
+		dev_warn(fmc2->dev, "Waitrdy timeout\n");
+
+	/* Wait tWB before R/B# signal is low */
+	timings = nand_get_sdr_timings(&chip->data_interface);
+	ndelay(PSEC_TO_NSEC(timings->tWB_max));
+
+	/* R/B# signal is low, clear high level flag */
+	writel_relaxed(FMC2_ICR_CIHLF, fmc2->io_base + FMC2_ICR);
+
+	/* Wait R/B# signal is high */
+	return readl_relaxed_poll_timeout_atomic(fmc2->io_base + FMC2_ISR,
+						 isr, isr & FMC2_ISR_IHLF,
+						 5, 1000 * timeout_ms);
+}
+
 static int stm32_fmc2_exec_op(struct nand_chip *chip,
 			      const struct nand_operation *op,
 			      bool check_only)

@@ -1366,8 +1400,8 @@ static int stm32_fmc2_exec_op(struct nan
 			break;
 
 		case NAND_OP_WAITRDY_INSTR:
-			ret = nand_soft_waitrdy(chip,
-						instr->ctx.waitrdy.timeout_ms);
+			ret = stm32_fmc2_waitrdy(chip,
+						 instr->ctx.waitrdy.timeout_ms);
 			break;
 		}
 	}

From: Stefan Wahren <[email protected]>

commit 3b722da6672df8392f9c43d7c7e04bddd81d7e37 upstream.

The commit bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF") introduced a NULL pointer dereference on driver unload. It seems that we can't fetch the bus clock via devm_clk_get in bcm2835_i2c_remove. As an alternative approach store a pointer to the bus clock in the private driver structure.

---
 drivers/i2c/busses/i2c-bcm2835.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

@@ -58,6 +58,7 @@ struct bcm2835_i2c_dev {
 	struct i2c_adapter adapter;
 	struct completion completion;
 	struct i2c_msg *curr_msg;
+	struct clk *bus_clk;
 	int num_msgs;
 	u32 msg_err;
 	u8 *msg_buf;

@@ -404,7 +405,6 @@ static int bcm2835_i2c_probe(struct plat
 	struct resource *mem, *irq;
 	int ret;
 	struct i2c_adapter *adap;
-	struct clk *bus_clk;
 	struct clk *mclk;
 	u32 bus_clk_rate;
 

@@ -427,11 +427,11 @@ static int bcm2835_i2c_probe(struct plat
 		return PTR_ERR(mclk);
 	}
 
-	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk, i2c_dev);
+	i2c_dev->bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk, i2c_dev);
 
-	if (IS_ERR(bus_clk)) {
+	if (IS_ERR(i2c_dev->bus_clk)) {
 		dev_err(&pdev->dev, "Could not register clock\n");
-		return PTR_ERR(bus_clk);
+		return PTR_ERR(i2c_dev->bus_clk);
 	}
 
 	ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",

@@ -442,13 +442,13 @@ static int bcm2835_i2c_probe(struct plat
 		bus_clk_rate = 100000;
 	}
 
-	ret = clk_set_rate_exclusive(bus_clk, bus_clk_rate);
+	ret = clk_set_rate_exclusive(i2c_dev->bus_clk, bus_clk_rate);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Could not set clock frequency\n");
 		return ret;
 	}
 
-	ret = clk_prepare_enable(bus_clk);
+	ret = clk_prepare_enable(i2c_dev->bus_clk);
 	if (ret) {
 		dev_err(&pdev->dev, "Couldn't prepare clock");
 		return ret;

@@ -491,10 +491,9 @@ static int bcm2835_i2c_probe(struct plat
 static int bcm2835_i2c_remove(struct platform_device *pdev)
 {
 	struct bcm2835_i2c_dev *i2c_dev = platform_get_drvdata(pdev);
-	struct clk *bus_clk = devm_clk_get(i2c_dev->dev, "div");
 
-	clk_rate_exclusive_put(bus_clk);
-	clk_disable_unprepare(bus_clk);
+	clk_rate_exclusive_put(i2c_dev->bus_clk);
+	clk_disable_unprepare(i2c_dev->bus_clk);
 
 	free_irq(i2c_dev->irq, i2c_dev);
 	i2c_del_adapter(&i2c_dev->adapter);

This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.4.13-rc1

Kai Li <[email protected]>
ocfs2: call journal flush to mark journal as empty after journal recovery when mount

Nick Desaulniers <[email protected]>
hexagon: work around compiler crash

Nick Desaulniers <[email protected]>
hexagon: parenthesize registers in asm predicates

Ard Biesheuvel <[email protected]>
kbuild/deb-pkg: annotate libelf-dev dependency as :native

Sakari Ailus <[email protected]>
media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes

changzhu <[email protected]>
drm/amdgpu: enable gfxoff for raven1 refresh

[email protected] <[email protected]>
ioat: ioat_alloc_ring() failure handling.

Julian Wiedmann <[email protected]>
s390/qeth: lock the card while changing its hsuid

John Stultz <[email protected]>
dmaengine: k3dma: Avoid null pointer traversal

David Howells <[email protected]>
rxrpc: Fix missing security check on incoming calls

David Howells <[email protected]>

    rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call()

David Howells <[email protected]>
rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller

Ben Dooks (Codethink) <[email protected]>
drm/arm/mali: make malidp_mw_connector_helper_funcs static

Jouni Hogander <[email protected]>
MIPS: Prevent link failure with kcov instrumentation

Tetsuo Handa <[email protected]>
tomoyo: Suppress RCU warning at list_for_each_entry_rcu().

Vincenzo Frascino <[email protected]>
mips: Fix gettimeofday() in the vdso library

Vladimir Kondratiev <[email protected]>
mips: cacheinfo: report shared CPU map

Olof Johansson <[email protected]>
riscv: export flush_icache_all to modules

Mathieu Desnoyers <[email protected]>
rseq/selftests: Turn off timeout setting

Shuah Khan <[email protected]>
selftests: firmware: Fix it to do root uid check and skip

Israel Rukshin <[email protected]>
scsi: target/iblock: Fix protection error with blocks greater than 512B

Varun Prakash <[email protected]>
scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()

Johnson CH Chen (陳昭勳) <[email protected]>

    gpio: mpc8xxx: Add platform device to gpiochip->parent

Matti Vaittinen <[email protected]>
rtc: bd70528: Add MODULE ALIAS to autoload module

Chuhong Yuan <[email protected]>
rtc: brcmstb-waketimer: add missed clk_disable_unprepare

Kars de Jong <[email protected]>
rtc: msm6242: Fix reading of 10-hour digit

Olga Kornievskaia <[email protected]>
NFSD fixing possible null pointer derefering in copy offload

Chao Yu <[email protected]>
f2fs: fix potential overflow

Victorien Molle <[email protected]>
sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO

Luca Coelho <[email protected]>
iwlwifi: mvm: fix support for single antenna diversity

Nathan Chancellor <[email protected]>
rtlwifi: Remove unnecessary NULL check in rtl_regd_init

Mordechay Goodstein <[email protected]>
iwlwifi: mvm: consider ieee80211 station max amsdu value

Navid Emamdoost <[email protected]>
spi: lpspi: fix memory leak in fsl_lpspi_probe

Geert Uytterhoeven <[email protected]>
spi: rspi: Use platform_get_irq_byname_optional() for optional irqs

Mans Rullgard <[email protected]>
spi: atmel: fix handling of cs_change set on non-last xfer

Daniel Vetter <[email protected]>

    spi: pxa2xx: Set controller->max_transfer_size in dma mode

Sergei Shtylyov <[email protected]>
mtd: spi-nor: fix silent truncation in spi_nor_read_raw()

Sergei Shtylyov <[email protected]>
mtd: spi-nor: fix silent truncation in spi_nor_read()

Huanpeng Xin <[email protected]>
spi: sprd: Fix the incorrect SPI register

Zhihao Cheng <[email protected]>
ubifs: do_kill_orphans: Fix a memory leak bug

Ben Dooks (Codethink) <[email protected]>
ubifs: Fixed missed le64_to_cpu() in journal

Richard Weinberger <[email protected]>
Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"

Yong Wu <[email protected]>
memory: mtk-smi: Add PM suspend and resume ops

Yong Wu <[email protected]>
iommu/mediatek: Add a new tlb_lock for tlb_flush

Yong Wu <[email protected]>
iommu/mediatek: Correct the flush_iotlb_all callback

Jonas Karlman <[email protected]>
media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly

Navid Emamdoost <[email protected]>
media: aspeed-video: Fix memory leaks in aspeed_video_probe

Jonas Karlman <[email protected]>
media: hantro: Do not reorder H264 scaling list

Jonas Karlman <[email protected]>
media: cedrus: Use correct H264 8x8 scaling list

Philipp Zabel <[email protected]>
media: coda: fix deadlock between decoder picture run and start command

Seung-Woo Kim <[email protected]>
media: exynos4-is: Fix recursive locking in isp_video_release()

Christophe JAILLET <[email protected]>
media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()'

Boris Brezillon <[email protected]>
media: hantro: h264: Fix the frame_num wraparound case

Niklas Söderlund <[email protected]>
media: rcar-vin: Fix incorrect return statement in rvin_try_format()

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix default format not applied on device probe

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix some format attributes not under control

Janusz Krzysztofik <[email protected]>
media: ov6650: Fix incorrect use of JPEG colorspace

Dietmar Eggemann <[email protected]>
ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC

Peng Fan <[email protected]>
tty: serial: pch_uart: correct usage of dma_unmap_sg

Peng Fan <[email protected]>
tty: serial: imx: use the sg count from dma_map_sg

Thomas Bogendoerfer <[email protected]>
MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter

Tiezhu Yang <[email protected]>
MIPS: Loongson: Fix return value of loongson_hwmon_init

Thomas Bogendoerfer <[email protected]>
MIPS: PCI: remember nasid changed by set interrupt affinity

Oliver O'Halloran <[email protected]>
powerpc/powernv: Disable native PCIe port management

Bjorn Helgaas <[email protected]>
PCI/PTM: Remove spurious "d" from granularity message

Hewenliang <[email protected]>
tools: PCI: Fix fd leakage

Bjorn Helgaas <[email protected]>
PCI/PM: Clear PCIe PME Status even for legacy power management

Rob Herring <[email protected]>
PCI: Fix missing bridge dma_ranges resource list cleanup

Niklas Cassel <[email protected]>
PCI: dwc: Fix find_next_bit() usage

Remi Pommarel <[email protected]>
PCI: aardvark: Fix PCI_EXP_RTCTL register configuration

Remi Pommarel <[email protected]>
PCI: aardvark: Use LTSSM state to build link training flag

Arnd Bergmann <[email protected]>
compat_ioctl: handle SIOCOUTQNSD

Arnd Bergmann <[email protected]>
af_unix: add compat_ioctl support

Arnd Bergmann <[email protected]>
gfs2: add compat_ioctl support

Loic Poulain <[email protected]>

    arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD

Arnd Bergmann <[email protected]>
scsi: sd: enable compat ioctls for sed-opal

Xiaojie Yuan <[email protected]>
drm/amdgpu/discovery: reserve discovery data at the top of VRAM

Christian König <[email protected]>
drm/amdgpu: cleanup creating BOs at fixed location (v2)

Greg Kroah-Hartman <[email protected]>
Revert "drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper."

Mika Westerberg <[email protected]>
PCI: pciehp: Do not disable interrupt twice on suspend

Andy Shevchenko <[email protected]>
pinctrl: lewisburg: Update pin list according to v1.1v6

Geert Uytterhoeven <[email protected]>
pinctrl: sh-pfc: Do not use platform_get_irq() to count interrupts

Keiya Nobuta <[email protected]>
pinctrl: sh-pfc: Fix PINMUX_IPSR_PHYS() to set GPSR

Colin Ian King <[email protected]>
pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call

Navid Emamdoost <[email protected]>
affs: fix a memory leak in affs_remount

Denis Efremov <[email protected]>
rsi: fix potential null dereference in rsi_probe()

Leonard Crestez <[email protected]>
clk: imx: pll14xx: Fix quick switch of S/K parameter

Andy Shevchenko <[email protected]>
dmaengine: dw: platform: Mark 'hclk' clock optional

Kishon Vijay Abraham I <[email protected]>
clk: Fix memory leak in clk_unregister()

Marian Mihailescu <[email protected]>
clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume

Jerome Brunet <[email protected]>
clk: meson: axg-audio: fix regmap last register

Alexander Usyskin <[email protected]>
mei: fix modalias documentation

Alexandru Ardelean <[email protected]>
iio: imu: adis16480: assign bias value only if operation succeeded

Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: fix gyro gain definitions for LSM9DS1

Trond Myklebust <[email protected]>
NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn

Trond Myklebust <[email protected]>
NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()

Scott Mayhew <[email protected]>
nfsd: v4 support requires CRYPTO_SHA256

Scott Mayhew <[email protected]>

    nfsd: Fix cld_net->cn_tfm initialization

Trond Myklebust <[email protected]>
NFSv2: Fix a typo in encode_sattr()

Eric Biggers <[email protected]>
crypto: geode-aes - convert to skcipher API and make thread-safe

Herbert Xu <[email protected]>
crypto: algif_skcipher - Use chunksize instead of blocksize

Ard Biesheuvel <[email protected]>
crypto: virtio - implement missing support for output IVs

Yunfeng Ye <[email protected]>
crypto: arm64/aes-neonbs - add return value of skcipher_walk_done() in __xts_crypt()

Zhou Wang <[email protected]>
crypto: hisilicon - select NEED_SG_DMA_LENGTH in qm Kconfig

Phani Kiran Hemadri <[email protected]>
crypto: cavium/nitrox - fix firmware assignment to AE cores

Can Guo <[email protected]>
scsi: ufs: Give an unique ID to each ufs-bsg

Diego Calleja <[email protected]>
dm: add dm-clone to the documentation index

Chuck Lever <[email protected]>
xprtrdma: Fix oops in Receive handler after device removal

Chuck Lever <[email protected]>
xprtrdma: Fix completion wait during device removal

Chuck Lever <[email protected]>
xprtrdma: Fix create_qp crash on device unload

Vadim Pasternak <[email protected]>
Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces

Vadim Pasternak <[email protected]>
Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces

Mike Rapoport <[email protected]>
asm-generic/nds32: don't redefine cacheflush primitives

Hans de Goede <[email protected]>
platform/x86: GPD pocket fan: Use default values when wrong modparams are given

Jian-Hong Pan <[email protected]>
platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0

Liming Sun <[email protected]>
platform/mellanox: fix potential deadlock in the tmfifo driver

Xiang Chen <[email protected]>

    scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI

James Bottomley <[email protected]>
scsi: enclosure: Fix stale device oops with hot replug

David Howells <[email protected]>
keys: Fix request_key() cache

David Howells <[email protected]>
afs: Fix afs_lookup() to not clobber the version on a new dentry

David Howells <[email protected]>
afs: Fix use-after-loss-of-ref

Andrii Nakryiko <[email protected]>
libbpf: Fix Makefile' libbpf symbol mismatch diagnostic

Stanislav Fomichev <[email protected]>
bpf: Support pre-2.25-binutils objcopy for vmlinux BTF

John Fastabend <[email protected]>
bpf: skmsg, fix potential psock NULL pointer dereference

Daniel Borkmann <[email protected]>
bpf: Make use of probe_user_write in probe write helper

Daniel Borkmann <[email protected]>
uaccess: Add non-pagefault user-space write function

Bart Van Assche <[email protected]>
RDMA/srpt: Report the SCSI residual to the initiator

Leon Romanovsky <[email protected]>
RDMA/mlx5: Return proper error value

Jason Gunthorpe <[email protected]>
rdma: Remove nes ABI header

Yangyang Li <[email protected]>
RDMA/hns: Bugfix for qpc/cqc timer configuration

Lijun Ou <[email protected]>
RDMA/hns: Fix to support 64K page for srq

Chuck Lever <[email protected]>
xprtrdma: Close window between waking RPC senders and posting Receives

Chuck Lever <[email protected]>
xprtrdma: Fix MR list handling

Chuck Lever <[email protected]>
xprtrdma: Connection becomes unstable after a reconnect

Chuck Lever <[email protected]>
xprtrdma: Add unique trace points for posting Local Invalidate WRs

Yangyang Li <[email protected]>
RDMA/hns: Release qp resources when failed to destroy qp

Arnd Bergmann <[email protected]>
RDMA/hns: Fix build error again

Bart Van Assche <[email protected]>
RDMA/siw: Fix port number endianness in a debug message

Mark Zhang <[email protected]>
RDMA/counter: Prevent QP counter manual binding in auto mode

Lang Cheng <[email protected]>
RDMA/hns: Modify return value of restrack functions

Weihang Li <[email protected]>
RDMA/hns: remove a redundant le16_to_cpu

Jason Gunthorpe <[email protected]>
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

Nilkanth Ahirrao <[email protected]>
ASoC: rsnd: fix DALIGN register for SSIU

Takashi Iwai <[email protected]>
ASoC: core: Fix compile warning with CONFIG_DEBUG_FS=n

Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy driver

Shengjiu Wang <[email protected]>
ASoC: fsl_esai: Add spin lock to protect reset, stop and start

Daniel Baluta <[email protected]>
ASoC: simple_card_utils.h: Add missing include

Tzung-Bi Shih <[email protected]>
ASoC: dt-bindings: mt8183: add missing update

Arnd Bergmann <[email protected]>
netfilter: nft_meta: use 64-bit time arithmetic

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables_offload: release flow_rule on error from commit path

Goldwyn Rodrigues <[email protected]>
btrfs: simplify inode locking for RWF_NOWAIT

Taehee Yoo <[email protected]>
hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()

Sami Tolvanen <[email protected]>
syscalls/x86: Fix function types in COND_SYSCALL

Sami Tolvanen <[email protected]>
syscalls/x86: Use the correct function type for sys_ni_syscall

Sami Tolvanen <[email protected]>
syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn

Andy Lutomirski <[email protected]>
syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0

Ed Maste <[email protected]>
perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description

David Howells <[email protected]>
afs: Fix missing cell comparison in afs_test_super()

Florian Fainelli <[email protected]>
reset: brcmstb: Remove resource checks

Florian Fainelli <[email protected]>
dt-bindings: reset: Fix brcmstb-reset example

Marc Kleine-Budde <[email protected]>
can: j1939: fix address claim code example

Christian Lamparter <[email protected]>
ath9k: use iowrite32 over __raw_writel

Andy Shevchenko <[email protected]>
MAINTAINERS: Append missed file to the database

Paul Menzel <[email protected]>
scsi: smartpqi: Update attribute name to driver_version

Nathan Chancellor <[email protected]>
cifs: Adjust indentation in smb2_open_file

Julian Wiedmann <[email protected]>
s390/qeth: fix initialization on old HW

Alexandra Winter <[email protected]>
s390/qeth: vnicc Fix init to default

Alexandra Winter <[email protected]>
s390/qeth: Fix vnicc_is_in_use if rx_bcast not set

Alexandra Winter <[email protected]>
s390/qeth: fix false reporting of VNIC CHAR config failure

Julian Wiedmann <[email protected]>
s390/qeth: fix qdio teardown after early init error

Taehee Yoo <[email protected]>
hsr: reset network header when supervision frame is created

Taehee Yoo <[email protected]>
hsr: rename debugfs file when interface name is changed

Taehee Yoo <[email protected]>
hsr: add hsr root debugfs directory

Thierry Reding <[email protected]>
drm/tegra: Fix ordering of cleanup code

Neil Armstrong <[email protected]>
PCI: amlogic: Fix probed clock names

Arnd Bergmann <[email protected]>
PM / devfreq: tegra: Add COMMON_CLK dependency

Geert Uytterhoeven <[email protected]>
gpio: Fix error message on out-of-range GPIO in lookup table

Dan Carpenter <[email protected]>
scsi: mpt3sas: Fix double free in attach error handling

Ming Lei <[email protected]>
fs: move guard_bio_eod() after bio_set_op_attrs

Roman Gushchin <[email protected]>
bpf: cgroup: prevent out-of-order release of cgroup bpf

Jon Derrick <[email protected]>
iommu: Remove device link to group on failure

Jon Derrick <[email protected]>
iommu/vt-d: Unlink device if failed to add to group

Hangbin Liu <[email protected]>
selftests: loopback.sh: skip this test if the driver does not support

Qianggui Song <[email protected]>
pinctrl: meson: Fix wrong shift value when get drive-strength

Swapna Manupati <[email protected]>
gpio: zynq: Fix for bug in zynq_gpio_restore_context API

Peter Ujfalusi <[email protected]>
mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy

Daniel Baluta <[email protected]>
ASoC: SOF: imx8: Fix dsp_box offset

wenxu <[email protected]>
netfilter: nft_flow_offload: fix underflow in flowtable reference counter

Arnd Bergmann <[email protected]>
pinctrl: lochnagar: select GPIOLIB

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix input pin state management

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix race condition in irq handler

Olivier Moysan <[email protected]>
ASoC: stm32: spdifrx: fix inconsistent lock state

Daniel Baluta <[email protected]>
ASoC: soc-core: Set dpcm_playback / dpcm_capture

Colin Ian King <[email protected]>

    ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev

Stefan Wahren <[email protected]>
i2c: bcm2835: Store pointer to bus clock

Christophe Kerello <[email protected]>
mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus

Kaike Wan <[email protected]>
IB/hfi1: Don't cancel unused work item

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix Send Work Entry state check while polling completions

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Avoid freeing MR resources if dereg fails

Tony Lindgren <[email protected]>
phy: mapphone-mdm6600: Fix uninitialized status value regression

Ran Bi <[email protected]>
rtc: mt6397: fix alarm register overwrite

Jiri Kosina <[email protected]>
HID: hidraw, uhid: Always report EPOLLOUT

-------------

Diffstat:

 Documentation/ABI/stable/sysfs-driver-mlxreg-io    |  13 +-
 Documentation/ABI/testing/sysfs-bus-mei            |   2 +-
 Documentation/admin-guide/device-mapper/index.rst  |   1 +
 .../bindings/reset/brcm,brcmstb-reset.txt          |   2 +-
 .../sound/mt8183-mt6358-ts3a227-max98357.txt       |   4 +-
 Documentation/networking/j1939.rst                 |   2 +-
 Documentation/scsi/smartpqi.txt                    |   2 +-
 MAINTAINERS                                        |   1 +
 Makefile                                           |   4 +-
 arch/arm/kernel/smp.c                              |   4 +
 arch/arm/kernel/topology.c                         |  10 +-
 arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi       |   2 +
 arch/arm64/crypto/aes-neonbs-glue.c                |   2 +-
 arch/hexagon/include/asm/atomic.h                  |   8 +-
 arch/hexagon/include/asm/bitops.h                  |   8 +-
 arch/hexagon/include/asm/cmpxchg.h                 |   2 +-
 arch/hexagon/include/asm/futex.h                   |   6 +-
 arch/hexagon/include/asm/spinlock.h                |  20 +-
 arch/hexagon/kernel/stacktrace.c                   |   4 +-
 arch/hexagon/kernel/vm_entry.S                     |   2 +-
 arch/mips/boot/compressed/Makefile                 |   3 +
 arch/mips/include/asm/vdso/gettimeofday.h          |  13 -
 arch/mips/kernel/cacheinfo.c                       |  27 +-
 arch/mips/pci/pci-xtalk-bridge.c                   |   5 +-
 arch/mips/sgi-ip27/ip27-irq.c                      |   4 +
 arch/mips/vdso/vgettimeofday.c                     |  20 +
 arch/nds32/include/asm/cacheflush.h                |  11 +-
 arch/powerpc/platforms/powernv/pci.c               |  17 +
 arch/riscv/mm/cacheflush.c                         |   1 +
 arch/x86/entry/syscall_32.c                        |   8 +-
 arch/x86/entry/syscall_64.c                        |  14 +-
 arch/x86/entry/syscalls/syscall_32.tbl             |   8 +-
 arch/x86/ia32/ia32_signal.c                        |   5 +-
 arch/x86/include/asm/syscall_wrapper.h             |  53 ++-
 block/bio.c                                        |  12 +-
 crypto/algif_skcipher.c                            |   2 +-
 drivers/clk/clk.c                                  |   1 +
 drivers/clk/imx/clk-pll14xx.c                      |  40 +-
 drivers/clk/meson/axg-audio.c                      |   2 +-
 drivers/clk/samsung/clk-exynos5420.c               |   2 +
 drivers/crypto/cavium/nitrox/nitrox_main.c         |   9 +-
 drivers/crypto/geode-aes.c                         | 440 +++++++--------------
 drivers/crypto/geode-aes.h                         |  15 +-
 drivers/crypto/hisilicon/Kconfig                   |   1 +
 drivers/crypto/virtio/virtio_crypto_algs.c         |   9 +
 drivers/devfreq/Kconfig                            |   1 +
 drivers/dma/dw/platform.c                          |   2 +-
 drivers/dma/ioat/dma.c                             |   3 +-
 drivers/dma/k3dma.c                                |  12 +-
 drivers/gpio/gpio-mpc8xxx.c                        |   1 +
 drivers/gpio/gpio-zynq.c                           |   8 +-
 drivers/gpio/gpiolib.c                             |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu.h                |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c      |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.h      |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  61 +++
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h         |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |  85 +---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  99 ++---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  15 +-
 drivers/gpu/drm/amd/include/discovery.h            |   1 -
 drivers/gpu/drm/arm/malidp_mw.c                    |   2 +-
 drivers/gpu/drm/tegra/drm.c                        |  14 +-
 drivers/gpu/drm/virtio/virtgpu_ioctl.c             |  28 +-
 drivers/hid/hidraw.c                               |   7 +-
 drivers/hid/uhid.c                                 |   5 +-
 drivers/i2c/busses/i2c-bcm2835.c                   |  17 +-
 drivers/iio/imu/adis16480.c                        |   6 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   7 +-
 drivers/infiniband/core/counters.c                 |  12 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   4 +-
 drivers/infiniband/hw/bnxt_re/qplib_fp.c           |  12 +-
 drivers/infiniband/hw/hfi1/iowait.c                |   4 +-
 drivers/infiniband/hw/hns/Kconfig                  |  17 +-
 drivers/infiniband/hw/hns/Makefile                 |   8 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  18 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h         |   4 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  10 +-
 drivers/infiniband/hw/hns/hns_roce_restrack.c      |   2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |   2 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |   9 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  24 ++
 drivers/iommu/intel-iommu.c                        |  13 +-
 drivers/iommu/iommu.c                              |   1 +
 drivers/iommu/mtk_iommu.c                          |  25 +-
 drivers/iommu/mtk_iommu.h                          |   1 +
 drivers/media/i2c/ov6650.c                         |  79 ++--
 drivers/media/platform/aspeed-video.c              |   3 +-
 drivers/media/platform/cadence/cdns-csi2rx.c       |   2 +-
 drivers/media/platform/coda/coda-common.c          |   4 +-
 drivers/media/platform/exynos4-is/fimc-isp-video.c |   2 +-
 drivers/media/platform/rcar-vin/rcar-v4l2.c        |   3 +-
 drivers/memory/mtk-smi.c                           |   4 +
 drivers/misc/enclosure.c                           |   3 +-
 drivers/mtd/nand/onenand/omap2.c                   |   3 +-
 drivers/mtd/nand/raw/stm32_fmc2_nand.c             |  38 +-
 drivers/mtd/spi-nor/spi-nor.c                      |   4 +-
 .../net/wireless/ath/ath9k/ath9k_pci_owl_loader.c  |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  20 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c     |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c        |   7 +-
 drivers/net/wireless/realtek/rtlwifi/regd.c        |   2 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c             |   2 +-
 drivers/pci/controller/dwc/pci-meson.c             |   6 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |  11 +-
 drivers/pci/controller/pci-aardvark.c              |  42 +-
 drivers/pci/hotplug/pciehp_core.c                  |  25 +-
 drivers/pci/pci-driver.c                           |   3 +-
 drivers/pci/pcie/ptm.c                             |   2 +-
 drivers/pci/probe.c                                |   1 +
 drivers/phy/motorola/phy-mapphone-mdm6600.c        |  11 +-
 drivers/pinctrl/cirrus/Kconfig                     |   1 +
 drivers/pinctrl/intel/pinctrl-lewisburg.c          | 171 ++++----
 drivers/pinctrl/meson/pinctrl-meson.c              |   1 +
 drivers/pinctrl/sh-pfc/core.c                      |  16 +-
 drivers/pinctrl/sh-pfc/sh_pfc.h                    |   4 +-
 drivers/pinctrl/ti/pinctrl-ti-iodelay.c            |   2 +-
 drivers/platform/mellanox/mlxbf-tmfifo.c           |  19 +-
 drivers/platform/mips/cpu_hwmon.c                  |   2 +-
 drivers/platform/x86/asus-wmi.c                    |   8 +-
 drivers/platform/x86/gpd-pocket-fan.c              |  25 +-
 drivers/reset/reset-brcmstb.c                      |   6 -
 drivers/rtc/rtc-bd70528.c                          |   1 +
 drivers/rtc/rtc-brcmstb-waketimer.c                |   1 +
 drivers/rtc/rtc-msm6242.c                          |   3 +-
 drivers/rtc/rtc-mt6397.c                           |  47 ++-
 drivers/s390/net/qeth_core_main.c                  |  29 +-
 drivers/s390/net/qeth_l2_main.c                    |  10 +-
 drivers/s390/net/qeth_l3_main.c                    |   2 +-
 drivers/s390/net/qeth_l3_sys.c                     |  40 +-
 drivers/scsi/cxgbi/libcxgbi.c                      |   3 +-
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   1 -
 drivers/scsi/sd.c                                  |  18 +-
 drivers/scsi/ufs/ufs_bsg.c                         |   2 +-
 drivers/spi/spi-atmel.c                            |  10 +-
 drivers/spi/spi-fsl-lpspi.c                        |   2 +-
 drivers/spi/spi-pxa2xx.c                           |   7 +
 drivers/spi/spi-rspi.c                             |   8 +-
 drivers/spi/spi-sprd.c                             |   2 +-
 drivers/staging/media/hantro/hantro_g1_h264_dec.c  |   2 +-
 drivers/staging/media/hantro/hantro_h264.c         |  73 ++--
 drivers/staging/media/ipu3/include/intel-ipu3.h    |   2 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |   4 +-
 drivers/target/target_core_iblock.c                |   4 +-
 drivers/tty/serial/imx.c                           |   2 +-
 drivers/tty/serial/pch_uart.c                      |   5 +-
 fs/affs/super.c                                    |   6 -
 fs/afs/dir.c                                       |  18 +-
 fs/afs/super.c                                     |   1 +
 fs/btrfs/file.c                                    |   5 +-
 fs/buffer.c                                        |   8 +-
 fs/cifs/smb2file.c                                 |   2 +-
 fs/f2fs/data.c                                     |   2 +-
 fs/f2fs/file.c                                     |   2 +-
 fs/gfs2/file.c                                     |  30 ++
 fs/internal.h                                      |   2 +-
 fs/mpage.c                                         |   2 +-
 fs/nfs/nfs2xdr.c                                   |   2 +-
 fs/nfs/nfs4proc.c                                  |  38 +-
 fs/nfsd/Kconfig                                    |   2 +-
 fs/nfsd/nfs4proc.c                                 |   3 +-
 fs/nfsd/nfs4recover.c                              |  12 +-
 fs/ocfs2/journal.c                                 |   8 +
 fs/ubifs/journal.c                                 |   2 +-
 fs/ubifs/orphan.c                                  |  17 +-
 fs/ubifs/super.c                                   |   4 +-
 include/asm-generic/cacheflush.h                   |  33 +-
 include/crypto/internal/skcipher.h                 |  30 --
 include/crypto/skcipher.h                          |  30 ++
 include/linux/uaccess.h                            |  12 +
 include/sound/simple_card_utils.h                  |   1 +
 include/trace/events/afs.h                         |  12 +-
 include/trace/events/rpcrdma.h                     |  25 ++
 include/uapi/rdma/nes-abi.h                        | 115 ------
 kernel/bpf/cgroup.c                                |  11 +-
 kernel/cred.c                                      |   4 +-
 kernel/trace/bpf_trace.c                           |   6 +-
 mm/maccess.c                                       |  45 ++-
 net/core/skmsg.c                                   |  13 +-
 net/hsr/hsr_debugfs.c                              |  36 +-
 net/hsr/hsr_device.c                               |   2 +
 net/hsr/hsr_main.c                                 |   5 +
 net/hsr/hsr_main.h                                 |  10 +
 net/hsr/hsr_netlink.c                              |   1 +
 net/netfilter/nf_tables_offload.c                  |  26 +-
 net/netfilter/nft_flow_offload.c                   |   3 -
 net/netfilter/nft_meta.c                           |  10 +-
 net/rxrpc/ar-internal.h                            |  10 +-
 net/rxrpc/call_accept.c                            |  60 +--
 net/rxrpc/conn_event.c                             |  16 +-
 net/rxrpc/conn_service.c                           |   4 +
 net/rxrpc/input.c                                  |  18 -
 net/rxrpc/rxkad.c                                  |   5 +-
 net/rxrpc/security.c                               |  70 ++--
 net/sched/sch_cake.c                               |   1 +
 net/socket.c                                       |   1 +
 net/sunrpc/xprtrdma/frwr_ops.c                     |   4 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |   1 +
 net/sunrpc/xprtrdma/transport.c                    |   3 +
 net/sunrpc/xprtrdma/verbs.c                        | 103 +++--
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   3 +
 net/unix/af_unix.c                                 |  19 +
 scripts/link-vmlinux.sh                            |   7 +-
 scripts/package/mkdebian                           |   2 +-
 security/tomoyo/common.c                           |   9 +-
 security/tomoyo/domain.c                           |  15 +-
 security/tomoyo/group.c                            |   9 +-
 security/tomoyo/util.c                             |   6 +-
 sound/soc/fsl/fsl_esai.c                           |  12 +
 sound/soc/intel/Kconfig                            |   3 +
 sound/soc/sh/rcar/core.c                           |  20 +-
 sound/soc/soc-core.c                               |   2 +
 sound/soc/soc-pcm.c                                |   2 +
 sound/soc/sof/imx/imx8.c                           |   5 +-
 sound/soc/sof/intel/Kconfig                        |  10 +-
 sound/soc/stm/stm32_spdifrx.c                      |  40 +-
 tools/lib/bpf/Makefile                             |   2 +-
 tools/pci/pcitest.c                                |   1 +
 .../perf/pmu-events/arch/s390/cf_z14/extended.json |   2 +-
 tools/testing/selftests/firmware/fw_lib.sh         |   6 +
 tools/testing/selftests/net/forwarding/loopback.sh |   8 +
 tools/testing/selftests/rseq/settings              |   1 +
 222 files changed, 1849 insertions(+), 1423 deletions(-)

From: Hangbin Liu <[email protected]>

commit cc7e3f63d7299dd1119be39aa187b867d6f8aa17 upstream.

The loopback feature is only supported on a few drivers like broadcom, mellanox, etc. The default veth driver has not supported it yet. To avoid returning failed and making the runner feel confused, let's just skip the test on drivers that not support loopback.

---
 tools/testing/selftests/net/forwarding/loopback.sh |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -1,6 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 ALL_TESTS="loopback_test"
 NUM_NETIFS=2
 source tc_common.sh

@@ -72,6 +75,11 @@ setup_prepare()
 
 	h1_create
 	h2_create
+
+	if ethtool -k $h1 | grep loopback | grep -q fixed; then
+		log_test "SKIP: dev $h1 does not support loopback feature"
+		exit $ksft_skip
+	fi
 }
 
 cleanup()

From: Jon Derrick <[email protected]>

commit 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 upstream.

This adds the missing teardown step that removes the device link from the group when the device addition fails.

---
 drivers/iommu/iommu.c |    1 +
 1 file changed, 1 insertion(+)

@@ -751,6 +751,7 @@ err_put_group:
 	mutex_unlock(&group->mutex);
 	dev->iommu_group = NULL;
 	kobject_put(group->devices_kobj);
+	sysfs_remove_link(group->devices_kobj, device->name);
 err_free_name:
 	kfree(device->name);
 err_remove_link:

From: Roman Gushchin <[email protected]>

commit e10360f815ca6367357b2c2cfef17fc663e50f7b upstream.

Before commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") cgroup bpf structures were released with
corresponding cgroup structures. It guaranteed the hierarchical order
of destruction: children were always first. It preserved attached
programs from being released before their propagated copies.

But with cgroup auto-detachment there are no such guarantees anymore:
cgroup bpf is released as soon as the cgroup is offline and there are no live associated sockets. It means that an attached program can be detached and released, while its propagated copy is still living in the cgroup subtree. This will obviously lead to an use-after-free bug.

To reproduce the issue the following script can be used:

#!/bin/bash

CGROOT=/sys/fs/cgroup

  mkdir -p ${CGROOT}/A ${CGROOT}/B ${CGROOT}/A/C
  sleep 1

  ./test_cgrp2_attach ${CGROOT}/A egress &
  A_PID=$!
  ./test_cgrp2_attach ${CGROOT}/B egress &
  B_PID=$!

  echo $$ > ${CGROOT}/A/C/cgroup.procs
  iperf -s &
  S_PID=$!
  iperf -c localhost -t 100 &
  C_PID=$!

sleep 1

  echo $$ > ${CGROOT}/B/cgroup.procs
  echo ${S_PID} > ${CGROOT}/B/cgroup.procs
  echo ${C_PID} > ${CGROOT}/B/cgroup.procs

sleep 1

  rmdir ${CGROOT}/A/C
  rmdir ${CGROOT}/A

sleep 1

  kill -9 ${S_PID} ${C_PID} ${A_PID} ${B_PID}

On the unpatched kernel the following stacktrace can be obtained:

[   33.619799] BUG: unable to handle page fault for address: ffffbdb4801ab002
[   33.620677] #PF: supervisor read access in kernel mode
[   33.621293] #PF: error_code(0x0000) - not-present page
[   33.622754] Oops: 0000 [#1] SMP NOPTI
[   33.623202] CPU: 0 PID: 601 Comm: iperf Not tainted 5.5.0-rc2+ #23
[   33.625545] RIP: 0010:__cgroup_bpf_run_filter_skb+0x29f/0x3d0
[   33.635809] Call Trace:
[   33.636118]  ? __cgroup_bpf_run_filter_skb+0x2bf/0x3d0
[   33.636728]  ? __switch_to_asm+0x40/0x70
[   33.637196]  ip_finish_output+0x68/0xa0
[   33.637654]  ip_output+0x76/0xf0
[   33.638046]  ? __ip_finish_output+0x1c0/0x1c0
[   33.638576]  __ip_queue_xmit+0x157/0x410
[   33.639049]  __tcp_transmit_skb+0x535/0xaf0
[   33.639557]  tcp_write_xmit+0x378/0x1190
[   33.640049]  ? _copy_from_iter_full+0x8d/0x260
[   33.640592]  tcp_sendmsg_locked+0x2a2/0xdc0
[   33.641098]  ? sock_has_perm+0x10/0xa0
[   33.641574]  tcp_sendmsg+0x28/0x40
[   33.641985]  sock_sendmsg+0x57/0x60
[   33.642411]  sock_write_iter+0x97/0x100
[   33.642876]  new_sync_write+0x1b6/0x1d0
[   33.643339]  vfs_write+0xb6/0x1a0
[   33.643752]  ksys_write+0xa7/0xe0
[   33.644156]  do_syscall_64+0x5b/0x1b0
[   33.644605]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix this by grabbing a reference to the bpf structure of each ancestor on the initialization of the cgroup bpf structure, and dropping the reference at the end of releasing the cgroup bpf structure.

This will restore the hierarchical order of cgroup bpf releasing, without adding any operations on hot paths.

Thanks to Josef Bacik for the debugging and the initial analysis of the problem.

---
 kernel/bpf/cgroup.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

@@ -35,8 +35,8 @@ void cgroup_bpf_offline(struct cgroup *c
  */
 static void cgroup_bpf_release(struct work_struct *work)
 {
-	struct cgroup *cgrp = container_of(work, struct cgroup,
-					   bpf.release_work);
+	struct cgroup *p, *cgrp = container_of(work, struct cgroup,
+					       bpf.release_work);
 	enum bpf_cgroup_storage_type stype;
 	struct bpf_prog_array *old_array;
 	unsigned int type;

@@ -65,6 +65,9 @@ static void cgroup_bpf_release(struct wo
 
 	mutex_unlock(&cgroup_mutex);
 
+	for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p))
+		cgroup_bpf_put(p);
+
 	percpu_ref_exit(&cgrp->bpf.refcnt);
 	cgroup_put(cgrp);
 }

@@ -199,6 +202,7 @@ int cgroup_bpf_inherit(struct cgroup *cg
  */
 #define	NR ARRAY_SIZE(cgrp->bpf.effective)
 	struct bpf_prog_array *arrays[NR] = {};
+	struct cgroup *p;
 	int ret, i;
 
 	ret = percpu_ref_init(&cgrp->bpf.refcnt, cgroup_bpf_release_fn, 0,

@@ -206,6 +210,9 @@ int cgroup_bpf_inherit(struct cgroup *cg
 	if (ret)
 		return ret;
 
+	for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p))
+		cgroup_bpf_get(p);
+
 	for (i = 0; i < NR; i++)
 		INIT_LIST_HEAD(&cgrp->bpf.progs[i]);
 

From: Arnd Bergmann <[email protected]>

commit 5fdb0684b5b0f41402161f068d3d84bf6ed1c3f4 upstream.

Compile-testing this driver fails if CONFIG_COMMON_CLK is not set:

drivers/devfreq/tegra30-devfreq.o: In function `tegra_devfreq_target':
tegra30-devfreq.c:(.text+0x164): undefined reference to `clk_set_min_rate'

---
 drivers/devfreq/Kconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -99,6 +99,7 @@ config ARM_TEGRA_DEVFREQ
 		ARCH_TEGRA_210_SOC || \
 		COMPILE_TEST
 	select PM_OPP
+	depends on COMMON_CLK
 	help
 	  This adds the DEVFREQ driver for the Tegra family of SoCs.
 	  It reads ACTMON counters of memory controllers and adjusts the

From: Ming Lei <[email protected]>

commit 83c9c547168e8b914ea6398430473a4de68c52cc upstream.

Commit 85a8ce62c2ea ("block: add bio_truncate to fix guard_bio_eod") adds bio_truncate() for handling bio EOD. However, bio_truncate() doesn't use the passed 'op' parameter from guard_bio_eod's callers.

So bio_trunacate() may retrieve wrong 'op', and zering pages may not be done for READ bio.

Fixes this issue by moving guard_bio_eod() after bio_set_op_attrs() in submit_bh_wbc() so that bio_truncate() can always retrieve correct op info.

Meantime remove the 'op' parameter from guard_bio_eod() because it isn't used any more.

Fold in kerneldoc and bio_op() change.

---
 block/bio.c   |   12 +++++++++++-
 fs/buffer.c   |    8 ++++----
 fs/internal.h |    2 +-
 fs/mpage.c    |    2 +-
 4 files changed, 17 insertions(+), 7 deletions(-)

@@ -535,6 +535,16 @@ void zero_fill_bio_iter(struct bio *bio,
 }
 EXPORT_SYMBOL(zero_fill_bio_iter);
 
+/**
+ * bio_truncate - truncate the bio to small size of @new_size
+ * @bio:	the bio to be truncated
+ * @new_size:	new size for truncating the bio
+ *
+ * Description:
+ *   Truncate the bio to new size of @new_size. If bio_op(bio) is
+ *   REQ_OP_READ, zero the truncated part. This function should only
+ *   be used for handling corner cases, such as bio eod.
+ */
 void bio_truncate(struct bio *bio, unsigned new_size)
 {
 	struct bio_vec bv;

@@ -545,7 +555,7 @@ void bio_truncate(struct bio *bio, unsig
 	if (new_size >= bio->bi_iter.bi_size)
 		return;
 
-	if (bio_data_dir(bio) != READ)
+	if (bio_op(bio) != REQ_OP_READ)
 		goto exit;
 
 	bio_for_each_segment(bv, bio, iter) {

@@ -2991,7 +2991,7 @@ static void end_bio_bh_io_sync(struct bi
  * errors, this only handles the "we need to be able to
  * do IO at the final sector" case.
  */
-void guard_bio_eod(int op, struct bio *bio)
+void guard_bio_eod(struct bio *bio)
 {
 	sector_t maxsector;
 	struct hd_struct *part;

@@ -3055,15 +3055,15 @@ static int submit_bh_wbc(int op, int op_
 	bio->bi_end_io = end_bio_bh_io_sync;
 	bio->bi_private = bh;
 
-	/* Take care of bh's that straddle the end of the device */
-	guard_bio_eod(op, bio);
-
 	if (buffer_meta(bh))
 		op_flags |= REQ_META;
 	if (buffer_prio(bh))
 		op_flags |= REQ_PRIO;
 	bio_set_op_attrs(bio, op, op_flags);
 
+	/* Take care of bh's that straddle the end of the device */
+	guard_bio_eod(bio);
+
 	if (wbc) {
 		wbc_init_bio(wbc, bio);
 		wbc_account_cgroup_owner(wbc, bh->b_page, bh->b_size);

@@ -38,7 +38,7 @@ static inline int __sync_blockdev(struct
 /*
  * buffer.c
  */
-extern void guard_bio_eod(int rw, struct bio *bio);
+extern void guard_bio_eod(struct bio *bio);
 extern int __block_write_begin_int(struct page *page, loff_t pos, unsigned len,
 		get_block_t *get_block, struct iomap *iomap);
 

@@ -62,7 +62,7 @@ static struct bio *mpage_bio_submit(int
 {
 	bio->bi_end_io = mpage_end_io;
 	bio_set_op_attrs(bio, op, op_flags);
-	guard_bio_eod(op, bio);
+	guard_bio_eod(bio);
 	submit_bio(bio);
 	return NULL;
 }

From: Neil Armstrong <[email protected]>

commit eacaf7dcf08eb062a1059c6c115fa3fced3374ae upstream.

Fix the clock names used in the probe function according to the bindings.

---
 drivers/pci/controller/dwc/pci-meson.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -250,15 +250,15 @@ static int meson_pcie_probe_clocks(struc
 	if (IS_ERR(res->port_clk))
 		return PTR_ERR(res->port_clk);
 
-	res->mipi_gate = meson_pcie_probe_clock(dev, "pcie_mipi_en", 0);
+	res->mipi_gate = meson_pcie_probe_clock(dev, "mipi", 0);
 	if (IS_ERR(res->mipi_gate))
 		return PTR_ERR(res->mipi_gate);
 
-	res->general_clk = meson_pcie_probe_clock(dev, "pcie_general", 0);
+	res->general_clk = meson_pcie_probe_clock(dev, "general", 0);
 	if (IS_ERR(res->general_clk))
 		return PTR_ERR(res->general_clk);
 
-	res->clk = meson_pcie_probe_clock(dev, "pcie", 0);
+	res->clk = meson_pcie_probe_clock(dev, "pclk", 0);
 	if (IS_ERR(res->clk))
 		return PTR_ERR(res->clk);
 

From: Dan Carpenter <[email protected]>

commit ee560e7bbab0c10cf3f0e71997fbc354ab2ee5cb upstream.

The caller also calls _base_release_memory_pools() on error so it leads to a number of double frees:

drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->chain_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->hpr_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->internal_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->pcie_sgl_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_array_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->sense_dma_pool' double freed

---
 drivers/scsi/mpt3sas/mpt3sas_base.c |    1 -
 1 file changed, 1 deletion(-)

@@ -5234,7 +5234,6 @@ _base_allocate_memory_pools(struct MPT3S
 					&ct->chain_buffer_dma);
 			if (!ct->chain_buffer) {
 				ioc_err(ioc, "chain_lookup: pci_pool_alloc failed\n");
-				_base_release_memory_pools(ioc);
 				goto out;
 			}
 		}

From: Olivier Moysan <[email protected]>

commit 3b7658679d88b5628939f9bdc8e613f79cd821f9 upstream.

Changing input state in iec capture control is not safe, as the pin state may be changed concurrently by ASoC framework.
Remove pin state handling in iec capture control.

Note: This introduces a restriction on capture control, when pin sleep state is defined in device tree. In this case channel status can be captured only when an audio stream capture is active.

---
 sound/soc/stm/stm32_spdifrx.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -12,7 +12,6 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/of_platform.h>
-#include <linux/pinctrl/consumer.h>
 #include <linux/regmap.h>
 #include <linux/reset.h>
 

@@ -482,8 +481,6 @@ static int stm32_spdifrx_get_ctrl_data(s
 	memset(spdifrx->cs, 0, SPDIFRX_CS_BYTES_NB);
 	memset(spdifrx->ub, 0, SPDIFRX_UB_BYTES_NB);
 
-	pinctrl_pm_select_default_state(&spdifrx->pdev->dev);
-
 	ret = stm32_spdifrx_dma_ctrl_start(spdifrx);
 	if (ret < 0)
 		return ret;

@@ -515,7 +512,6 @@ static int stm32_spdifrx_get_ctrl_data(s
 
 end:
 	clk_disable_unprepare(spdifrx->kclk);
-	pinctrl_pm_select_sleep_state(&spdifrx->pdev->dev);
 
 	return ret;
 }

From: Arnd Bergmann <[email protected]>

commit f7e36e18946b4ec756b9c5cf4fb8891be8d1e4a3 upstream.

In a rare randconfig build I came across one configuration that does not enable CONFIG_GPIOLIB, which is needed by lochnagar:

ERROR: "devm_gpiochip_add_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_generic_free" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_generic_request" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!
ERROR: "gpiochip_get_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined!

Add another 'select' like all other pinctrl drivers have.

---
 drivers/pinctrl/cirrus/Kconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -2,6 +2,7 @@
 config PINCTRL_LOCHNAGAR
 	tristate "Cirrus Logic Lochnagar pinctrl driver"
 	depends on MFD_LOCHNAGAR
+	select GPIOLIB
 	select PINMUX
 	select PINCONF
 	select GENERIC_PINCONF

From: wenxu <[email protected]>

commit 8ca79606cdfde2e37ee4f0707b9d1874a6f0eb38 upstream.

The .deactivate and .activate interfaces already deal with the reference counter. Otherwise, this results in spurious "Device is busy" errors.

---
 net/netfilter/nft_flow_offload.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -197,9 +197,6 @@ static void nft_flow_offload_activate(co
 static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
 				     const struct nft_expr *expr)
 {
-	struct nft_flow_offload *priv = nft_expr_priv(expr);
-
-	priv->flowtable->use--;
 	nf_ct_netns_put(ctx->net, ctx->family);
 }
 

From: Swapna Manupati <[email protected]>

commit 36f2e7207f21a83ca0054116191f119ac64583ab upstream.

This patch writes the inverse value of Interrupt Mask Status register into the Interrupt Enable register in zynq_gpio_restore_context API to fix the bug.

---
 drivers/gpio/gpio-zynq.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

@@ -681,6 +681,8 @@ static void zynq_gpio_restore_context(st
 	unsigned int bank_num;
 
 	for (bank_num = 0; bank_num < gpio->p_data->max_bank; bank_num++) {
+		writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
+				ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
 		writel_relaxed(gpio->context.datalsw[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_DATA_LSW_OFFSET(bank_num));

@@ -690,9 +692,6 @@ static void zynq_gpio_restore_context(st
 		writel_relaxed(gpio->context.dirm[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_DIRM_OFFSET(bank_num));
-		writel_relaxed(gpio->context.int_en[bank_num],
-			       gpio->base_addr +
-			       ZYNQ_GPIO_INTEN_OFFSET(bank_num));
 		writel_relaxed(gpio->context.int_type[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_INTTYPE_OFFSET(bank_num));

@@ -702,6 +701,9 @@ static void zynq_gpio_restore_context(st
 		writel_relaxed(gpio->context.int_any[bank_num],
 			       gpio->base_addr +
 			       ZYNQ_GPIO_INTANY_OFFSET(bank_num));
+		writel_relaxed(~(gpio->context.int_en[bank_num]),
+			       gpio->base_addr +
+			       ZYNQ_GPIO_INTEN_OFFSET(bank_num));
 	}
 }
 

From: Qianggui Song <[email protected]>

commit 35c60be220572de7d6605c4318f640d133982040 upstream.

In meson_pinconf_get_drive_strength, variable bit is calculated by meson_calc_reg_and_bit, this value is the offset from the first pin of a certain bank to current pin, while Meson SoCs use two bits for each pin to depict drive-strength. So a left shift by 1 should be done or node pinconf-pins shows wrong message.

---
 drivers/pinctrl/meson/pinctrl-meson.c |    1 +
 1 file changed, 1 insertion(+)

@@ -441,6 +441,7 @@ static int meson_pinconf_get_drive_stren
 		return ret;
 
 	meson_calc_reg_and_bit(bank, pin, REG_DS, &reg, &bit);
+	bit = bit << 1;
 
 	ret = regmap_read(pc->reg_ds, reg, &val);
 	if (ret)

From: Daniel Baluta <[email protected]>

commit 218fe9b7ec7f32c10a07539365488d80af7b0084 upstream.

When converting a normal link to a DPCM link we need to set dpcm_playback / dpcm_capture otherwise playback/capture streams will not be created resulting in errors like this:

[   36.039111]  sai1-wm8960-hifi: ASoC: no backend playback stream

---
 sound/soc/soc-core.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1886,6 +1886,8 @@ match:
 
 			/* convert non BE into BE */
 			dai_link->no_pcm = 1;
+			dai_link->dpcm_playback = 1;
+			dai_link->dpcm_capture = 1;
 
 			/* override any BE fixups */
 			dai_link->be_hw_params_fixup =

From: Paul Menzel <[email protected]>

commit a2bdd0c904da12b223c8d7218e98138d4e6d9f4f upstream.

The file name in the documentation is currently incorrect, so fix it.

---
 Documentation/scsi/smartpqi.txt |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -29,7 +29,7 @@ smartpqi specific entries in /sys
   smartpqi host attributes:
   -------------------------
   /sys/class/scsi_host/host*/rescan
-  /sys/class/scsi_host/host*/version
+  /sys/class/scsi_host/host*/driver_version
 
   The host rescan attribute is a write only attribute. Writing to this
   attribute will trigger the driver to scan for new, changed, or removed

From: Andy Shevchenko <[email protected]>

commit 44fe5cb32c7599a4059931a98794e0418619aa96 upstream.

When gpiolib.h internal header had been split to few, the commit 77cb907abe6c ("gpiolib: acpi: Split ACPI stuff to gpiolib-acpi.h") in particular missed the MAINTAINERS database update. Do it here.

---
 MAINTAINERS |    1 +
 1 file changed, 1 insertion(+)

@@ -6973,6 +6973,7 @@ L:	[email protected]
 S:	Maintained
 F:	Documentation/firmware-guide/acpi/gpio-properties.rst
 F:	drivers/gpio/gpiolib-acpi.c
+F:	drivers/gpio/gpiolib-acpi.h
 
 GPIO IR Transmitter
 M:	Sean Young <[email protected]>

From: Christian Lamparter <[email protected]>

commit 22d0d5ae7a089967e9295a06694aa3e8a812b15e upstream.

This patch changes the ath9k_pci_owl_loader to use the same iowrite32 memory accessor that ath9k_pci is using to communicate with the PCI(e) chip.

This will fix endian issues that came up during testing with loaned AVM Fritz!Box 7360 (Lantiq MIPS SoCs + AR9287).

---
 drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -84,7 +84,7 @@ static int ath9k_pci_fixup(struct pci_de
 			val = swahb32(val);
 		}
 
-		__raw_writel(val, mem + reg);
+		iowrite32(val, mem + reg);
 		usleep_range(100, 120);
 	}
 

From: Marc Kleine-Budde <[email protected]>

commit 8ac9d71d601374222a230804e419cd40c4492e1c upstream.

During development the define J1939_PGN_ADDRESS_REQUEST was renamed to J1939_PGN_REQUEST. It was forgotten to adjust the documentation accordingly.

This patch fixes the name of the symbol.

---
 Documentation/networking/j1939.rst |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -339,7 +339,7 @@ To claim an address following code examp
 			.pgn = J1939_PGN_ADDRESS_CLAIMED,
 			.pgn_mask = J1939_PGN_PDU1_MAX,
 		}, {
-			.pgn = J1939_PGN_ADDRESS_REQUEST,
+			.pgn = J1939_PGN_REQUEST,
 			.pgn_mask = J1939_PGN_PDU1_MAX,
 		}, {
 			.pgn = J1939_PGN_ADDRESS_COMMANDED,

From: Florian Fainelli <[email protected]>

commit 392a9f63058f2cdcec8363b849a25532ee40da9f upstream.

The reset controller has a #reset-cells value of 1, so we should see a phandle plus a register identifier, fix the example.

---
 Documentation/devicetree/bindings/reset/brcm,brcmstb-reset.txt |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -22,6 +22,6 @@ Example:
 	};
 
 	&ethernet_switch {
-		resets = <&reset>;
+		resets = <&reset 26>;
 		reset-names = "switch";
 	};

From: David Howells <[email protected]>

commit 106bc79843c3c6f4f00753d1f46e54e815f99377 upstream.

Fix missing cell comparison in afs_test_super(). Without this, any pair volumes that have the same volume ID will share a superblock, no matter the cell, unless they're in different network namespaces.

Normally, most users will only deal with a single cell and so they won't see this. Even if they do look into a second cell, they won't see a problem unless they happen to hit a volume with the same ID as one they've already got mounted.

Before the patch:

    # ls /afs/grand.central.org/archive
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # ls /afs/kth.se/
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # cat /proc/mounts | grep afs
    none /afs afs rw,relatime,dyn,autocell 0 0
    #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/kth.se afs ro,relatime 0 0

After the patch:

    # ls /afs/grand.central.org/archive
    linuxdev/  mailman/  moin/  mysql/  pipermail/  stage/  twiki/
    # ls /afs/kth.se/
    admin/        common/  install/  OldFiles/  service/  system/
    bakrestores/  home/    misc/     pkg/       src/      wsadmin/
    # cat /proc/mounts | grep afs
    none /afs afs rw,relatime,dyn,autocell 0 0
    #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0
    #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0
    #kth.se:root.cell /afs/kth.se afs ro,relatime 0 0

---
 fs/afs/super.c |    1 +
 1 file changed, 1 insertion(+)

@@ -404,6 +404,7 @@ static int afs_test_super(struct super_b
 	return (as->net_ns == fc->net_ns &&
 		as->volume &&
 		as->volume->vid == ctx->volume->vid &&
+		as->cell == ctx->cell &&
 		!as->dyn_root);
 }
 

From: Taehee Yoo <[email protected]>

commit 4c2d5e33dcd3a6333a7895be3b542ff3d373177c upstream.

hsr interface has own debugfs file, which name is same with interface name. So, interface name is changed, debugfs file name should be changed too.

---
 net/hsr/hsr_debugfs.c |   13 +++++++++++++
 net/hsr/hsr_main.c    |    3 +++
 net/hsr/hsr_main.h    |    4 ++++
 3 files changed, 20 insertions(+)

@@ -65,6 +65,19 @@ hsr_node_table_open(struct inode *inode,
 	return single_open(filp, hsr_node_table_show, inode->i_private);
 }
 
+void hsr_debugfs_rename(struct net_device *dev)
+{
+	struct hsr_priv *priv = netdev_priv(dev);
+	struct dentry *d;
+
+	d = debugfs_rename(hsr_debugfs_root_dir, priv->node_tbl_root,
+			   hsr_debugfs_root_dir, dev->name);
+	if (IS_ERR(d))
+		netdev_warn(dev, "failed to rename\n");
+	else
+		priv->node_tbl_root = d;
+}
+
 static const struct file_operations hsr_fops = {
 	.open	= hsr_node_table_open,
 	.read	= seq_read,

@@ -45,6 +45,9 @@ static int hsr_netdev_notify(struct noti
 	case NETDEV_CHANGE:	/* Link (carrier) state changes */
 		hsr_check_carrier_and_operstate(hsr);
 		break;
+	case NETDEV_CHANGENAME:
+		hsr_debugfs_rename(dev);
+		break;
 	case NETDEV_CHANGEADDR:
 		if (port->type == HSR_PT_MASTER) {
 			/* This should not happen since there's no

@@ -185,11 +185,15 @@ static inline u16 hsr_get_skb_sequence_n
 }
 
 #if IS_ENABLED(CONFIG_DEBUG_FS)
+void hsr_debugfs_rename(struct net_device *dev);
 void hsr_debugfs_init(struct hsr_priv *priv, struct net_device *hsr_dev);
 void hsr_debugfs_term(struct hsr_priv *priv);
 void hsr_debugfs_create_root(void);
 void hsr_debugfs_remove_root(void);
 #else
+static inline void void hsr_debugfs_rename(struct net_device *dev)
+{
+}
 static inline void hsr_debugfs_init(struct hsr_priv *priv,
 				    struct net_device *hsr_dev)
 {}

From: Taehee Yoo <[email protected]>

commit 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 upstream.

The supervision frame is L2 frame.
When supervision frame is created, hsr module doesn't set network header. If tap routine is enabled, dev_queue_xmit_nit() is called and it checks network_header. If network_header pointer wasn't set(or invalid), it resets network_header and warns.
In order to avoid unnecessary warning message, resetting network_header is needed.

Test commands:
ip netns add nst
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth3
ip link set veth1 netns nst
ip link set veth3 netns nst
ip link set veth0 up
ip link set veth2 up
ip link add hsr0 type hsr slave1 veth0 slave2 veth2
ip a a 192.168.100.1/24 dev hsr0
ip link set hsr0 up
ip netns exec nst ip link set veth1 up
ip netns exec nst ip link set veth3 up
ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3 ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
ip netns exec nst ip link set hsr1 up
tcpdump -nei veth0

Splat looks like:

[  175.852292][    C3] protocol 88fb is buggy, dev veth0

---
 net/hsr/hsr_device.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -272,6 +272,8 @@ static void send_hsr_supervision_frame(s
 			    skb->dev->dev_addr, skb->len) <= 0)
 		goto out;
 	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
 
 	if (hsr_ver > 0) {
 		hsr_tag = skb_put(skb, sizeof(struct hsr_tag));

From: Julian Wiedmann <[email protected]>

commit 8b5026bc16938920e4780b9094c3bf20e1e0939d upstream.

qeth_l?_set_online() goes through a number of initialization steps, and on any error uses qeth_l?_stop_card() to tear down the residual state.

The first initialization step is qeth_core_hardsetup_card(). When this fails after having established a QDIO context on the device (ie. somewhere after qeth_mpc_initialize()), qeth_l?_stop_card() doesn't shut down this QDIO context again (since the card state hasn't progressed from DOWN at this stage).

Even worse, we then call qdio_free() as final teardown step to free the QDIO data structures - while some of them are still hooked into wider QDIO infrastructure such as the IRQ list. This is inevitably followed by use-after-frees and other nastyness.

Fix this by unconditionally calling qeth_qdio_clear_card() to shut down the QDIO context, and also to halt/clear any pending activity on the various IO channels.
Remove the naive attempt at handling the teardown in qeth_mpc_initialize(), it clearly doesn't suffice and we're handling it properly now in the wider teardown code.

---
 drivers/s390/net/qeth_core_main.c |   20 ++++++++------------
 drivers/s390/net/qeth_l2_main.c   |    2 +-
 drivers/s390/net/qeth_l3_main.c   |    2 +-
 3 files changed, 10 insertions(+), 14 deletions(-)

@@ -2451,50 +2451,46 @@ static int qeth_mpc_initialize(struct qe
 	rc = qeth_cm_enable(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "2err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_cm_setup(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "3err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_ulp_enable(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "4err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_ulp_setup(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "5err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_alloc_qdio_queues(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "5err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_qdio_establish(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "6err%d", rc);
 		qeth_free_qdio_queues(card);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_qdio_activate(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "7err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 	rc = qeth_dm_act(card);
 	if (rc) {
 		QETH_CARD_TEXT_(card, 2, "8err%d", rc);
-		goto out_qdio;
+		return rc;
 	}
 
 	return 0;
-out_qdio:
-	qeth_qdio_clear_card(card, !IS_IQD(card));
-	qdio_free(CARD_DDEV(card));
-	return rc;
 }
 
 void qeth_print_status_message(struct qeth_card *card)

@@ -287,12 +287,12 @@ static void qeth_l2_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_qdio_clear_card(card, 0);
 		qeth_drain_output_queues(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
 
+	qeth_qdio_clear_card(card, 0);
 	flush_workqueue(card->event_wq);
 	card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
 	card->info.promisc_mode = 0;

@@ -1426,12 +1426,12 @@ static void qeth_l3_stop_card(struct qet
 		card->state = CARD_STATE_HARDSETUP;
 	}
 	if (card->state == CARD_STATE_HARDSETUP) {
-		qeth_qdio_clear_card(card, 0);
 		qeth_drain_output_queues(card);
 		qeth_clear_working_pool_list(card);
 		card->state = CARD_STATE_DOWN;
 	}
 
+	qeth_qdio_clear_card(card, 0);
 	flush_workqueue(card->event_wq);
 	card->info.promisc_mode = 0;
 }

From: Alexandra Winter <[email protected]>

commit e8a66d800471e2df7f0b484e2e46898b21d1fa82 upstream.

Symptom: After vnicc/rx_bcast has been manually set to 0,
bridge_* sysfs parameters can still be set or written.
Only occurs on HiperSockets, as OSA doesn't support changing rx_bcast.

Vnic characteristics and bridgeport settings are mutually exclusive. rx_bcast defaults to 1, so manually setting it to 0 should disable bridge_* parameters.

Instead it makes sense here to check the supported mask. If the card does not support vnicc at all, bridge commands are always allowed.

---
 drivers/s390/net/qeth_l2_main.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -1983,8 +1983,7 @@ int qeth_l2_vnicc_get_timeout(struct qet
 /* check if VNICC is currently enabled */
 bool qeth_l2_vnicc_is_in_use(struct qeth_card *card)
 {
-	/* if everything is turned off, VNICC is not active */
-	if (!card->options.vnicc.cur_chars)
+	if (!card->options.vnicc.sup_chars)
 		return false;
 	/* default values are only OK if rx_bcast was not enabled by user
 	 * or the card is offline.

From: Julian Wiedmann <[email protected]>

commit 0b698c838e84149b690c7e979f78cccb6f8aa4b9 upstream.

I stumbled over an old OSA model that claims to support DIAG_ASSIST, but then rejects the cmd to query its DIAG capabilities.

In the old code this was ok, as the returned raw error code was > 0. Now that we translate the raw codes to errnos, the "rc < 0" causes us to fail the initialization of the device.

The fix is trivial: don't bail out when the DIAG query fails. Such an error is not critical, we can still use the device (with a slightly reduced set of features).

---
 drivers/s390/net/qeth_core_main.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

@@ -4968,10 +4968,8 @@ retriable:
 	}
 	if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
 		rc = qeth_query_setdiagass(card);
-		if (rc < 0) {
+		if (rc)
 			QETH_CARD_TEXT_(card, 2, "8err%d", rc);
-			goto out;
-		}
 	}
 	return 0;
 out:

From: Nathan Chancellor <[email protected]>

commit 7935799e041ae10d380d04ea23868240f082bd11 upstream.

Clang warns:

../fs/cifs/smb2file.c:70:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]

         if (oparms->tcon->use_resilient) {
         ^
../fs/cifs/smb2file.c:66:2: note: previous statement is here
        if (rc)
        ^

1 warning generated.

This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.

---
 fs/cifs/smb2file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -67,7 +67,7 @@ smb2_open_file(const unsigned int xid, s
 		goto out;
 
 
-	 if (oparms->tcon->use_resilient) {
+	if (oparms->tcon->use_resilient) {
 		/* default timeout is 0, servers pick default (120 seconds) */
 		nr_ioctl_req.Timeout =
 			cpu_to_le32(oparms->tcon->handle_timeout);

From: Thierry Reding <[email protected]>

commit 051172e8c1ceef8749f19faacc1d3bef65d20d8d upstream.

Commit Fixes: b9f8b09ce256 ("drm/tegra: Setup shared IOMMU domain after initialization") changed the initialization order of the IOMMU related bits but didn't update the cleanup path accordingly. This asymmetry can cause failures during error recovery.

---
 drivers/gpu/drm/tegra/drm.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -201,19 +201,19 @@ hub:
 	if (tegra->hub)
 		tegra_display_hub_cleanup(tegra->hub);
 device:
-	host1x_device_exit(device);
-fbdev:
-	drm_kms_helper_poll_fini(drm);
-	tegra_drm_fb_free(drm);
-config:
-	drm_mode_config_cleanup(drm);
-
 	if (tegra->domain) {
 		mutex_destroy(&tegra->mm_lock);
 		drm_mm_takedown(&tegra->mm);
 		put_iova_domain(&tegra->carveout.domain);
 		iova_cache_put();
 	}
+
+	host1x_device_exit(device);
+fbdev:
+	drm_kms_helper_poll_fini(drm);
+	tegra_drm_fb_free(drm);
+config:
+	drm_mode_config_cleanup(drm);
 domain:
 	if (tegra->domain)
 		iommu_domain_free(tegra->domain);

From: Sami Tolvanen <[email protected]>

commit 00198a6eaf66609de5e4de9163bb42c7ca9dd7b7 upstream.

Use COMPAT_SYSCALL_DEFINE0 to define (rt_)sigreturn() syscalls to replace sys32_sigreturn() and sys32_rt_sigreturn(). This fixes indirect call mismatches with Control-Flow Integrity (CFI) checking.

---
 arch/x86/entry/syscalls/syscall_32.tbl |    4 ++--
 arch/x86/ia32/ia32_signal.c            |    5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

@@ -130,7 +130,7 @@
 116	i386	sysinfo			sys_sysinfo			__ia32_compat_sys_sysinfo
 117	i386	ipc			sys_ipc				__ia32_compat_sys_ipc
 118	i386	fsync			sys_fsync			__ia32_sys_fsync
-119	i386	sigreturn		sys_sigreturn			sys32_sigreturn
+119	i386	sigreturn		sys_sigreturn			__ia32_compat_sys_sigreturn
 120	i386	clone			sys_clone			__ia32_compat_sys_x86_clone
 121	i386	setdomainname		sys_setdomainname		__ia32_sys_setdomainname
 122	i386	uname			sys_newuname			__ia32_sys_newuname

@@ -184,7 +184,7 @@
 170	i386	setresgid		sys_setresgid16			__ia32_sys_setresgid16
 171	i386	getresgid		sys_getresgid16			__ia32_sys_getresgid16
 172	i386	prctl			sys_prctl			__ia32_sys_prctl
-173	i386	rt_sigreturn		sys_rt_sigreturn		sys32_rt_sigreturn
+173	i386	rt_sigreturn		sys_rt_sigreturn		__ia32_compat_sys_rt_sigreturn
 174	i386	rt_sigaction		sys_rt_sigaction		__ia32_compat_sys_rt_sigaction
 175	i386	rt_sigprocmask		sys_rt_sigprocmask		__ia32_compat_sys_rt_sigprocmask
 176	i386	rt_sigpending		sys_rt_sigpending		__ia32_compat_sys_rt_sigpending

@@ -21,6 +21,7 @@
 #include <linux/personality.h>
 #include <linux/compat.h>
 #include <linux/binfmts.h>
+#include <linux/syscalls.h>
 #include <asm/ucontext.h>
 #include <linux/uaccess.h>
 #include <asm/fpu/internal.h>

@@ -118,7 +119,7 @@ static int ia32_restore_sigcontext(struc
 	return err;
 }
 
-asmlinkage long sys32_sigreturn(void)
+COMPAT_SYSCALL_DEFINE0(sigreturn)
 {
 	struct pt_regs *regs = current_pt_regs();
 	struct sigframe_ia32 __user *frame = (struct sigframe_ia32 __user *)(regs->sp-8);

@@ -144,7 +145,7 @@ badframe:
 	return 0;
 }
 
-asmlinkage long sys32_rt_sigreturn(void)
+COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
 {
 	struct pt_regs *regs = current_pt_regs();
 	struct rt_sigframe_ia32 __user *frame;

From: Takashi Iwai <[email protected]>

commit bd0b609e0c3362cb167c51d4bd4330d79fc00987 upstream.

Paper over a compile warning:
sound/soc/soc-pcm.c:1185:8: warning: unused variable ‘name’

---
 sound/soc/soc-pcm.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1148,7 +1148,9 @@ static int dpcm_be_connect(struct snd_so
 {
 	struct snd_soc_dpcm *dpcm;
 	unsigned long flags;
+#ifdef CONFIG_DEBUG_FS
 	char *name;
+#endif
 
 	/* only add new dpcms */
 	for_each_dpcm_be(fe, stream, dpcm) {

From: Nilkanth Ahirrao <[email protected]>

commit ef8e14794308a428b194f8b06ad9ae06b43466e4 upstream.

The current driver only sets 0x76543210 and 0x67452301 for DALIGN. This doesn’t work well for TDM split and ex-split mode for all SSIU. This patch programs the DALIGN registers based on the SSIU number.

---
 sound/soc/sh/rcar/core.c |   20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

@@ -376,6 +376,17 @@ u32 rsnd_get_adinr_bit(struct rsnd_mod *
  */
 u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io)
 {
+	static const u32 dalign_values[8][2] = {
+		{0x76543210, 0x67452301},
+		{0x00000032, 0x00000023},
+		{0x00007654, 0x00006745},
+		{0x00000076, 0x00000067},
+		{0xfedcba98, 0xefcdab89},
+		{0x000000ba, 0x000000ab},
+		{0x0000fedc, 0x0000efcd},
+		{0x000000fe, 0x000000ef},
+	};
+	int id = 0, inv;
 	struct rsnd_mod *ssiu = rsnd_io_to_mod_ssiu(io);
 	struct rsnd_mod *target;
 	struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);

@@ -411,13 +422,18 @@ u32 rsnd_get_dalign(struct rsnd_mod *mod
 		target = cmd ? cmd : ssiu;
 	}
 
+	if (mod == ssiu)
+		id = rsnd_mod_id_sub(mod);
+
 	/* Non target mod or non 16bit needs normal DALIGN */
 	if ((snd_pcm_format_width(runtime->format) != 16) ||
 	    (mod != target))
-		return 0x76543210;
+		inv = 0;
 	/* Target mod needs inverted DALIGN when 16bit */
 	else
-		return 0x67452301;
+		inv = 1;
+
+	return dalign_values[id][inv];
 }
 
 u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod)

From: Weihang Li <[email protected]>

commit 9f7d7064009c37cb26eee4a83302cf077fe180d6 upstream.

Type of ah->av.vlan is u16, there will be a problem using le16_to_cpu on it.

---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -389,7 +389,7 @@ static int hns_roce_v2_post_send(struct
 			roce_set_field(ud_sq_wqe->byte_36,
 				       V2_UD_SEND_WQE_BYTE_36_VLAN_M,
 				       V2_UD_SEND_WQE_BYTE_36_VLAN_S,
-				       le16_to_cpu(ah->av.vlan));
+				       ah->av.vlan);
 			roce_set_field(ud_sq_wqe->byte_36,
 				       V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_M,
 				       V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_S,

From: Lang Cheng <[email protected]>

commit cfd82da4e741c16d71a12123bf0cb585af2b8796 upstream.

The restrack function return EINVAL instead of EMSGSIZE when the driver operation fails.

---
 drivers/infiniband/hw/hns/hns_roce_restrack.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -95,7 +95,7 @@ static int hns_roce_fill_res_cq_entry(st
 
 	ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context);
 	if (ret)
-		goto err;
+		return -EINVAL;
 
 	table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER);
 	if (!table_attr) {

From: Sami Tolvanen <[email protected]>

commit f48f01a92cca09e86d46c91d8edf9d5a71c61727 upstream.

Use the correct function type for sys_ni_syscall() in system call tables to fix indirect call mismatches with Control-Flow Integrity (CFI) checking.

---
 arch/x86/entry/syscall_32.c            |    8 +++-----
 arch/x86/entry/syscall_64.c            |   14 ++++++++++----
 arch/x86/entry/syscalls/syscall_32.tbl |    4 ++--
 3 files changed, 15 insertions(+), 11 deletions(-)

@@ -10,13 +10,11 @@
 #ifdef CONFIG_IA32_EMULATION
 /* On X86_64, we use struct pt_regs * to pass parameters to syscalls */
 #define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);
-
-/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */
-extern asmlinkage long sys_ni_syscall(const struct pt_regs *);
-
+#define __sys_ni_syscall __ia32_sys_ni_syscall
 #else /* CONFIG_IA32_EMULATION */
 #define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
+#define __sys_ni_syscall sys_ni_syscall
 #endif /* CONFIG_IA32_EMULATION */
 
 #include <asm/syscalls_32.h>

@@ -29,6 +27,6 @@ __visible const sys_call_ptr_t ia32_sys_
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_compat_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_compat_max] = &__sys_ni_syscall,
 #include <asm/syscalls_32.h>
 };

@@ -4,11 +4,17 @@
 #include <linux/linkage.h>
 #include <linux/sys.h>
 #include <linux/cache.h>
+#include <linux/syscalls.h>
 #include <asm/asm-offsets.h>
 #include <asm/syscall.h>
 
-/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */
-extern asmlinkage long sys_ni_syscall(const struct pt_regs *);
+extern asmlinkage long sys_ni_syscall(void);
+
+SYSCALL_DEFINE0(ni_syscall)
+{
+	return sys_ni_syscall();
+}
+
 #define __SYSCALL_64(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);
 #define __SYSCALL_X32(nr, sym, qual) __SYSCALL_64(nr, sym, qual)
 #include <asm/syscalls_64.h>

@@ -23,7 +29,7 @@ asmlinkage const sys_call_ptr_t sys_call
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_max] = &__x64_sys_ni_syscall,
 #include <asm/syscalls_64.h>
 };
 

@@ -40,7 +46,7 @@ asmlinkage const sys_call_ptr_t x32_sys_
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
 	 */
-	[0 ... __NR_syscall_x32_max] = &sys_ni_syscall,
+	[0 ... __NR_syscall_x32_max] = &__x64_sys_ni_syscall,
 #include <asm/syscalls_64.h>
 };
 

@@ -124,7 +124,7 @@
 110	i386	iopl			sys_iopl			__ia32_sys_iopl
 111	i386	vhangup			sys_vhangup			__ia32_sys_vhangup
 112	i386	idle
-113	i386	vm86old			sys_vm86old			sys_ni_syscall
+113	i386	vm86old			sys_vm86old			__ia32_sys_ni_syscall
 114	i386	wait4			sys_wait4			__ia32_compat_sys_wait4
 115	i386	swapoff			sys_swapoff			__ia32_sys_swapoff
 116	i386	sysinfo			sys_sysinfo			__ia32_compat_sys_sysinfo

@@ -177,7 +177,7 @@
 163	i386	mremap			sys_mremap			__ia32_sys_mremap
 164	i386	setresuid		sys_setresuid16			__ia32_sys_setresuid16
 165	i386	getresuid		sys_getresuid16			__ia32_sys_getresuid16
-166	i386	vm86			sys_vm86			sys_ni_syscall
+166	i386	vm86			sys_vm86			__ia32_sys_ni_syscall
 167	i386	query_module
 168	i386	poll			sys_poll			__ia32_sys_poll
 169	i386	nfsservctl

From: Taehee Yoo <[email protected]>

commit 04b69426d846cd04ca9acefff1ea39e1c64d2714 upstream.

hsr slave interfaces don't have debugfs directory.
So, hsr_debugfs_rename() shouldn't be called when hsr slave interface name is changed.

Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 ip link set dummy0 name ap

Splat looks like:

[21071.899367][T22666] ap: renamed from dummy0
[21071.914005][T22666] ==================================================================
[21071.919008][T22666] BUG: KASAN: slab-out-of-bounds in hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.923640][T22666] Read of size 8 at addr ffff88805febcd98 by task ip/22666
[21071.926941][T22666]
[21071.927750][T22666] CPU: 0 PID: 22666 Comm: ip Not tainted 5.5.0-rc2+ #240
[21071.929919][T22666] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[21071.935094][T22666] Call Trace:
[21071.935867][T22666]  dump_stack+0x96/0xdb
[21071.936687][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.937774][T22666]  print_address_description.constprop.5+0x1be/0x360
[21071.939019][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.940081][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.940949][T22666]  __kasan_report+0x12a/0x16f
[21071.941758][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.942674][T22666]  kasan_report+0xe/0x20
[21071.943325][T22666]  hsr_debugfs_rename+0xaa/0xb0 [hsr]
[21071.944187][T22666]  hsr_netdev_notify+0x1fe/0x9b0 [hsr]
[21071.945052][T22666]  ? __module_text_address+0x13/0x140
[21071.945897][T22666]  notifier_call_chain+0x90/0x160
[21071.946743][T22666]  dev_change_name+0x419/0x840
[21071.947496][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
[21071.948600][T22666]  ? netdev_adjacent_rename_links+0x280/0x280
[21071.949577][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
[21071.950672][T22666]  ? lock_downgrade+0x6e0/0x6e0
[21071.951345][T22666]  ? do_setlink+0x811/0x2ef0
[21071.951991][T22666]  do_setlink+0x811/0x2ef0
[21071.952613][T22666]  ? is_bpf_text_address+0x81/0xe0

[ ... ]

---
 net/hsr/hsr_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -46,7 +46,8 @@ static int hsr_netdev_notify(struct noti
 		hsr_check_carrier_and_operstate(hsr);
 		break;
 	case NETDEV_CHANGENAME:
-		hsr_debugfs_rename(dev);
+		if (is_hsr_master(dev))
+			hsr_debugfs_rename(dev);
 		break;
 	case NETDEV_CHANGEADDR:
 		if (port->type == HSR_PT_MASTER) {

From: Goldwyn Rodrigues <[email protected]>

commit 9cf35f673583ccc9f3e2507498b3079d56614ad3 upstream.

This is similar to 942491c9e6d6 ("xfs: fix AIM7 regression"). Apparently our current rwsem code doesn't like doing the trylock, then lock for real scheme. This causes extra contention on the lock and can be measured eg. by AIM7 benchmark. So change our read/write methods to just do the trylock for the RWF_NOWAIT case.

---
 fs/btrfs/file.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -1903,9 +1903,10 @@ static ssize_t btrfs_file_write_iter(str
 	    (iocb->ki_flags & IOCB_NOWAIT))
 		return -EOPNOTSUPP;
 
-	if (!inode_trylock(inode)) {
-		if (iocb->ki_flags & IOCB_NOWAIT)
+	if (iocb->ki_flags & IOCB_NOWAIT) {
+		if (!inode_trylock(inode))
 			return -EAGAIN;
+	} else {
 		inode_lock(inode);
 	}
 

From: Arnd Bergmann <[email protected]>

commit 6408c40c39d8eee5caaf97f5219b7dd4e041cc59 upstream.

On 32-bit architectures, get_seconds() returns an unsigned 32-bit time value, which also matches the type used in the nft_meta code. This will not overflow in year 2038 as a time_t would, but it still suffers from the overflow problem later on in year 2106.

Change this instance to use the time64_t type consistently and avoid the deprecated get_seconds().

The nft_meta_weekday() calculation potentially gets a little slower on 32-bit architectures, but now it has the same behavior as on 64-bit architectures and does not overflow.

---
 net/netfilter/nft_meta.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -33,19 +33,19 @@
 
 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
 
-static u8 nft_meta_weekday(unsigned long secs)
+static u8 nft_meta_weekday(time64_t secs)
 {
 	unsigned int dse;
 	u8 wday;
 
 	secs -= NFT_META_SECS_PER_MINUTE * sys_tz.tz_minuteswest;
-	dse = secs / NFT_META_SECS_PER_DAY;
+	dse = div_u64(secs, NFT_META_SECS_PER_DAY);
 	wday = (4 + dse) % NFT_META_DAYS_PER_WEEK;
 
 	return wday;
 }
 
-static u32 nft_meta_hour(unsigned long secs)
+static u32 nft_meta_hour(time64_t secs)
 {
 	struct tm tm;
 

@@ -250,10 +250,10 @@ void nft_meta_get_eval(const struct nft_
 		nft_reg_store64(dest, ktime_get_real_ns());
 		break;
 	case NFT_META_TIME_DAY:
-		nft_reg_store8(dest, nft_meta_weekday(get_seconds()));
+		nft_reg_store8(dest, nft_meta_weekday(ktime_get_real_seconds()));
 		break;
 	case NFT_META_TIME_HOUR:
-		*dest = nft_meta_hour(get_seconds());
+		*dest = nft_meta_hour(ktime_get_real_seconds());
 		break;
 	default:
 		WARN_ON(1);

From: Tzung-Bi Shih <[email protected]>

commit 7cf2804775f8a388411624b3e768e55d08711e9d upstream.

Headset codec is optional. Add missing update to DT binding document.

---
 Documentation/devicetree/bindings/sound/mt8183-mt6358-ts3a227-max98357.txt |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -2,9 +2,11 @@ MT8183 with MT6358, TS3A227 and MAX98357
 
 Required properties:
 - compatible : "mediatek,mt8183_mt6358_ts3a227_max98357"
-- mediatek,headset-codec: the phandles of ts3a227 codecs
 - mediatek,platform: the phandle of MT8183 ASoC platform
 
+Optional properties:
+- mediatek,headset-codec: the phandles of ts3a227 codecs
+
 Example:
 
 	sound {

From: Daniel Baluta <[email protected]>

commit 4bbee14d8e5487e3d2662138e3767cf4678cdf57 upstream.

When debug is enabled compiler cannot find the definition of clk_get_rate resulting in the following error:

./include/sound/simple_card_utils.h:168:40: note: previous implicit declaration of ‘clk_get_rate’ was here
dev_dbg(dev, "%s clk %luHz\n", name, clk_get_rate(dai->clk));
./include/sound/simple_card_utils.h:168:3: note: in expansion of macro ‘dev_dbg’
dev_dbg(dev, "%s clk %luHz\n", name, clk_get_rate(dai->clk));

Fix this by including the appropriate header.

---
 include/sound/simple_card_utils.h |    1 +
 1 file changed, 1 insertion(+)

@@ -8,6 +8,7 @@
 #ifndef __SIMPLE_CARD_UTILS_H
 #define __SIMPLE_CARD_UTILS_H
 
+#include <linux/clk.h>
 #include <sound/soc.h>
 
 #define asoc_simple_init_hp(card, sjack, prefix) \

From: Bart Van Assche <[email protected]>

commit e88982ad1bb12db699de96fbc07096359ef6176c upstream.

The code added by this patch is similar to the code that already exists in ibmvscsis_determine_resid(). This patch has been tested by running the following command:

strace sg_raw -r 1k /dev/sdb 12 00 00 00 60 00 -o inquiry.bin |&
grep resid=

---
 drivers/infiniband/ulp/srpt/ib_srpt.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

@@ -1364,9 +1364,11 @@ static int srpt_build_cmd_rsp(struct srp
 			      struct srpt_send_ioctx *ioctx, u64 tag,
 			      int status)
 {
+	struct se_cmd *cmd = &ioctx->cmd;
 	struct srp_rsp *srp_rsp;
 	const u8 *sense_data;
 	int sense_data_len, max_sense_len;
+	u32 resid = cmd->residual_count;
 
 	/*
 	 * The lowest bit of all SAM-3 status codes is zero (see also

@@ -1388,6 +1390,28 @@ static int srpt_build_cmd_rsp(struct srp
 	srp_rsp->tag = tag;
 	srp_rsp->status = status;
 
+	if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+		if (cmd->data_direction == DMA_TO_DEVICE) {
+			/* residual data from an underflow write */
+			srp_rsp->flags = SRP_RSP_FLAG_DOUNDER;
+			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
+		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
+			/* residual data from an underflow read */
+			srp_rsp->flags = SRP_RSP_FLAG_DIUNDER;
+			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
+		}
+	} else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
+		if (cmd->data_direction == DMA_TO_DEVICE) {
+			/* residual data from an overflow write */
+			srp_rsp->flags = SRP_RSP_FLAG_DOOVER;
+			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
+		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
+			/* residual data from an overflow read */
+			srp_rsp->flags = SRP_RSP_FLAG_DIOVER;
+			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
+		}
+	}
+
 	if (sense_data_len) {
 		BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp));
 		max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp);

From: Arnd Bergmann <[email protected]>

commit d5b60e26e86a463ca83bb5ec502dda6ea685159e upstream.

This is not the first attempt to fix building random configurations, unfortunately the attempt in commit a07fc0bb483e ("RDMA/hns: Fix build error") caused a new problem when CONFIG_INFINIBAND_HNS_HIP06=m and CONFIG_INFINIBAND_HNS_HIP08=y:

drivers/infiniband/hw/hns/hns_roce_main.o:(.rodata+0xe60): undefined reference to `__this_module'

Revert commits a07fc0bb483e ("RDMA/hns: Fix build error") and a3e2d4c7e766 ("RDMA/hns: remove obsolete Kconfig comment") to get back to the previous state, then fix the issues described there differently, by adding more specific dependencies: INFINIBAND_HNS can now only be built-in if at least one of HNS or HNS3 are built-in, and the individual back-ends are only available if that code is reachable from the main driver.

---
 drivers/infiniband/hw/hns/Kconfig  |   17 ++++++++++++++---
 drivers/infiniband/hw/hns/Makefile |    8 ++++++--
 2 files changed, 20 insertions(+), 5 deletions(-)

@@ -1,23 +1,34 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config INFINIBAND_HNS
-	bool "HNS RoCE Driver"
+	tristate "HNS RoCE Driver"
 	depends on NET_VENDOR_HISILICON
 	depends on ARM64 || (COMPILE_TEST && 64BIT)
+	depends on (HNS_DSAF && HNS_ENET) || HNS3
 	---help---
 	  This is a RoCE/RDMA driver for the Hisilicon RoCE engine. The engine
 	  is used in Hisilicon Hip06 and more further ICT SoC based on
 	  platform device.
 
+	  To compile HIP06 or HIP08 driver as module, choose M here.
+
 config INFINIBAND_HNS_HIP06
-	tristate "Hisilicon Hip06 Family RoCE support"
+	bool "Hisilicon Hip06 Family RoCE support"
 	depends on INFINIBAND_HNS && HNS && HNS_DSAF && HNS_ENET
+	depends on INFINIBAND_HNS=m || (HNS_DSAF=y && HNS_ENET=y)
 	---help---
 	  RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip06 and
 	  Hip07 SoC. These RoCE engines are platform devices.
 
+	  To compile this driver, choose Y here: if INFINIBAND_HNS is m, this
+	  module will be called hns-roce-hw-v1
+
 config INFINIBAND_HNS_HIP08
-	tristate "Hisilicon Hip08 Family RoCE support"
+	bool "Hisilicon Hip08 Family RoCE support"
 	depends on INFINIBAND_HNS && PCI && HNS3
+	depends on INFINIBAND_HNS=m || HNS3=y
 	---help---
 	  RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC.
 	  The RoCE engine is a PCI device.
+
+	  To compile this driver, choose Y here: if INFINIBAND_HNS is m, this
+	  module will be called hns-roce-hw-v2.

@@ -9,8 +9,12 @@ hns-roce-objs := hns_roce_main.o hns_roc
 	hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \
 	hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o
 
+ifdef CONFIG_INFINIBAND_HNS_HIP06
 hns-roce-hw-v1-objs := hns_roce_hw_v1.o $(hns-roce-objs)
-obj-$(CONFIG_INFINIBAND_HNS_HIP06) += hns-roce-hw-v1.o
+obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v1.o
+endif
 
+ifdef CONFIG_INFINIBAND_HNS_HIP08
 hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs)
-obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o
+obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o
+endif

From: Stanislav Fomichev <[email protected]>

commit da5fb18225b49b97bb37c51bcbbb2990a507c364 upstream.

If vmlinux BTF generation fails, but CONFIG_DEBUG_INFO_BTF is set, .BTF section of vmlinux is empty and kernel will prohibit BPF loading and return "in-kernel BTF is malformed".

--dump-section argument to binutils' objcopy was added in version 2.25. When using pre-2.25 binutils, BTF generation silently fails. Convert to --only-section which is present on pre-2.25 binutils.

Documentation/process/changes.rst states that binutils 2.21+ is supported, not sure those standards apply to BPF subsystem.

v2:
* exit and print an error if gen_btf fails (John Fastabend)

v3:
* resend with Andrii's Acked-by/Tested-by tags

---
 scripts/link-vmlinux.sh |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -127,7 +127,8 @@ gen_btf()
 		cut -d, -f1 | cut -d' ' -f2)
 	bin_format=$(LANG=C ${OBJDUMP} -f ${1} | grep 'file format' | \
 		awk '{print $4}')
-	${OBJCOPY} --dump-section .BTF=.btf.vmlinux.bin ${1} 2>/dev/null
+	${OBJCOPY} --set-section-flags .BTF=alloc -O binary \
+		--only-section=.BTF ${1} .btf.vmlinux.bin 2>/dev/null
 	${OBJCOPY} -I binary -O ${bin_format} -B ${bin_arch} \
 		--rename-section .data=.BTF .btf.vmlinux.bin ${2}
 }

@@ -253,6 +254,10 @@ btf_vmlinux_bin_o=""
 if [ -n "${CONFIG_DEBUG_INFO_BTF}" ]; then
 	if gen_btf .tmp_vmlinux.btf .btf.vmlinux.bin.o ; then
 		btf_vmlinux_bin_o=.btf.vmlinux.bin.o
+	else
+		echo >&2 "Failed to generate BTF for vmlinux"
+		echo >&2 "Try to disable CONFIG_DEBUG_INFO_BTF"
+		exit 1
 	fi
 fi
 

From: Daniel Borkmann <[email protected]>

commit 1d1585ca0f48fe7ed95c3571f3e4a82b2b5045dc upstream.

Commit 3d7081822f7f ("uaccess: Add non-pagefault user-space read functions") missed to add probe write function, therefore factor out a probe_write_common() helper with most logic of probe_kernel_write() except setting KERNEL_DS, and add a new probe_user_write() helper so it can be used from BPF side.

Again, on some archs, the user address space and kernel address space can co-exist and be overlapping, so in such case, setting KERNEL_DS would mean that the given address is treated as being in kernel address space.

---
 include/linux/uaccess.h |   12 ++++++++++++
 mm/maccess.c            |   45 +++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 53 insertions(+), 4 deletions(-)

@@ -337,6 +337,18 @@ extern long __probe_user_read(void *dst,
 extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
 extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
 
+/*
+ * probe_user_write(): safely attempt to write to a location in user space
+ * @dst: address to write to
+ * @src: pointer to the data that shall be written
+ * @size: size of the data chunk
+ *
+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+extern long notrace probe_user_write(void __user *dst, const void *src, size_t size);
+extern long notrace __probe_user_write(void __user *dst, const void *src, size_t size);
+
 extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
 extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
 				     long count);

From: Andrii Nakryiko <[email protected]>

commit b568405856906ee4d9ba6284fd36f2928653a623 upstream.

Fix Makefile's diagnostic diff output when there is LIBBPF_API-versioned symbols mismatch.

---
 tools/lib/bpf/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -215,7 +215,7 @@ check_abi: $(OUTPUT)libbpf.so
 		     "versioned symbols in $^ ($(VERSIONED_SYM_COUNT))." \
 		     "Please make sure all LIBBPF_API symbols are"	 \
 		     "versioned in $(VERSION_SCRIPT)." >&2;		 \
-		readelf -s --wide $(OUTPUT)libbpf-in.o |		 \
+		readelf -s --wide $(BPF_IN_SHARED) |			 \
 		    cut -d "@" -f1 | sed 's/_v[0-9]_[0-9]_[0-9].*//' |	 \
 		    awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$8}'|   \
 		    sort -u > $(OUTPUT)libbpf_global_syms.tmp;		 \

From: Daniel Borkmann <[email protected]>

commit eb1b66887472eaa7342305b7890ae510dd9d1a79 upstream.

Convert the bpf_probe_write_user() helper to probe_user_write() such that writes are not attempted under KERNEL_DS anymore which is buggy as kernel and user space pointers can have overlapping addresses. Also, given we have the access_ok() check inside probe_user_write(), the helper doesn't need to do it twice.

---
 kernel/trace/bpf_trace.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

@@ -163,7 +163,7 @@ static const struct bpf_func_proto bpf_p
 	.arg3_type	= ARG_ANYTHING,
 };
 
-BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src,
+BPF_CALL_3(bpf_probe_write_user, void __user *, unsafe_ptr, const void *, src,
 	   u32, size)
 {
 	/*

@@ -186,10 +186,8 @@ BPF_CALL_3(bpf_probe_write_user, void *,
 		return -EPERM;
 	if (unlikely(!nmi_uaccess_okay()))
 		return -EPERM;
-	if (!access_ok(unsafe_ptr, size))
-		return -EPERM;
 
-	return probe_kernel_write(unsafe_ptr, src, size);
+	return probe_user_write(unsafe_ptr, src, size);
 }
 
 static const struct bpf_func_proto bpf_probe_write_user_proto = {

From: Yangyang Li <[email protected]>

commit d302c6e3a6895608a5856bc708c47bda1770b24d upstream.

Even if no response from hardware, we should make sure that qp related resources are released to avoid memory leaks.

---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c |   12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

@@ -4650,16 +4650,14 @@ static int hns_roce_v2_destroy_qp_common
 {
 	struct hns_roce_cq *send_cq, *recv_cq;
 	struct ib_device *ibdev = &hr_dev->ib_dev;
-	int ret;
+	int ret = 0;
 
 	if (hr_qp->ibqp.qp_type == IB_QPT_RC && hr_qp->state != IB_QPS_RESET) {
 		/* Modify qp to reset before destroying qp */
 		ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0,
 					    hr_qp->state, IB_QPS_RESET);
-		if (ret) {
+		if (ret)
 			ibdev_err(ibdev, "modify QP to Reset failed.\n");
-			return ret;
-		}
 	}
 
 	send_cq = to_hr_cq(hr_qp->ibqp.send_cq);

@@ -4715,7 +4713,7 @@ static int hns_roce_v2_destroy_qp_common
 		kfree(hr_qp->rq_inl_buf.wqe_list);
 	}
 
-	return 0;
+	return ret;
 }
 
 static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)

@@ -4725,11 +4723,9 @@ static int hns_roce_v2_destroy_qp(struct
 	int ret;
 
 	ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
-	if (ret) {
+	if (ret)
 		ibdev_err(&hr_dev->ib_dev, "Destroy qp 0x%06lx failed(%d)\n",
 			  hr_qp->qpn, ret);
-		return ret;
-	}
 
 	if (hr_qp->ibqp.qp_type == IB_QPT_GSI)
 		kfree(hr_to_hr_sqp(hr_qp));

From: Chuck Lever <[email protected]>

commit 2ae50ad68cd79224198b525f7bd645c9da98b6ff upstream.

A recent clean up attempted to separate Receive handling and RPC Reply processing, in the name of clean layering.

Unfortunately, we can't do this because the Receive Queue has to be refilled _after_ the most recent credit update from the responder is parsed from the transport header, but _before_ we wake up the next RPC sender. That is right in the middle of rpcrdma_reply_handler().

Usually this isn't a problem because current responder implementations don't vary their credit grant. The one exception is when a connection is established: the grant goes from one to a much larger number on the first Receive. The requester MUST post enough Receives right then so that any outstanding requests can be sent without risking RNR and connection loss.

---
 net/sunrpc/xprtrdma/rpc_rdma.c  |    1 +
 net/sunrpc/xprtrdma/verbs.c     |   11 +++++++----
 net/sunrpc/xprtrdma/xprt_rdma.h |    1 +
 3 files changed, 9 insertions(+), 4 deletions(-)

@@ -1362,6 +1362,7 @@ void rpcrdma_reply_handler(struct rpcrdm
 		xprt->cwnd = credits << RPC_CWNDSHIFT;
 		spin_unlock(&xprt->transport_lock);
 	}
+	rpcrdma_post_recvs(r_xprt, false);
 
 	req = rpcr_to_rdmar(rqst);
 	if (req->rl_reply) {

@@ -84,7 +84,6 @@ rpcrdma_regbuf_alloc(size_t size, enum d
 		     gfp_t flags);
 static void rpcrdma_regbuf_dma_unmap(struct rpcrdma_regbuf *rb);
 static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb);
-static void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
 
 /* Wait for outstanding transport work to finish. ib_drain_qp
  * handles the drains in the wrong order for us, so open code

@@ -170,7 +169,6 @@ rpcrdma_wc_receive(struct ib_cq *cq, str
 				   rdmab_addr(rep->rr_rdmabuf),
 				   wc->byte_len, DMA_FROM_DEVICE);
 
-	rpcrdma_post_recvs(r_xprt, false);
 	rpcrdma_reply_handler(rep);
 	return;
 

@@ -1478,8 +1476,13 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
 	return 0;
 }
 
-static void
-rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
+/**
+ * rpcrdma_post_recvs - Refill the Receive Queue
+ * @r_xprt: controlling transport instance
+ * @temp: mark Receive buffers to be deleted after use
+ *
+ */
+void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
 {
 	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
 	struct rpcrdma_ep *ep = &r_xprt->rx_ep;

@@ -474,6 +474,7 @@ void rpcrdma_ep_disconnect(struct rpcrdm
 
 int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *,
 				struct rpcrdma_req *);
+void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
 
 /*
  * Buffer calls - xprtrdma/verbs.c

From: Chuck Lever <[email protected]>

commit 4b93dab36f28e673725e5e6123ebfccf7697f96a upstream.

When adding frwr_unmap_async way back when, I re-used the existing trace_xprtrdma_post_send() trace point to record the return code of ib_post_send.

Unfortunately there are some cases where re-using that trace point causes a crash. Instead, construct a trace point specific to posting Local Invalidate WRs that will always be safe to use in that context, and will act as a trace log eye-catcher for Local Invalidation.

---
 include/trace/events/rpcrdma.h |   25 +++++++++++++++++++++++++
 net/sunrpc/xprtrdma/frwr_ops.c |    4 ++--
 2 files changed, 27 insertions(+), 2 deletions(-)

@@ -735,6 +735,31 @@ TRACE_EVENT(xprtrdma_post_recvs,
 	)
 );
 
+TRACE_EVENT(xprtrdma_post_linv,
+	TP_PROTO(
+		const struct rpcrdma_req *req,
+		int status
+	),
+
+	TP_ARGS(req, status),
+
+	TP_STRUCT__entry(
+		__field(const void *, req)
+		__field(int, status)
+		__field(u32, xid)
+	),
+
+	TP_fast_assign(
+		__entry->req = req;
+		__entry->status = status;
+		__entry->xid = be32_to_cpu(req->rl_slot.rq_xid);
+	),
+
+	TP_printk("req=%p xid=0x%08x status=%d",
+		__entry->req, __entry->xid, __entry->status
+	)
+);
+
 /**
  ** Completion events
  **/

@@ -570,7 +570,6 @@ void frwr_unmap_sync(struct rpcrdma_xprt
 	 */
 	bad_wr = NULL;
 	rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr);
-	trace_xprtrdma_post_send(req, rc);
 
 	/* The final LOCAL_INV WR in the chain is supposed to
 	 * do the wake. If it was never posted, the wake will

@@ -583,6 +582,7 @@ void frwr_unmap_sync(struct rpcrdma_xprt
 
 	/* Recycle MRs in the LOCAL_INV chain that did not get posted.
 	 */
+	trace_xprtrdma_post_linv(req, rc);
 	while (bad_wr) {
 		frwr = container_of(bad_wr, struct rpcrdma_frwr,
 				    fr_invwr);

@@ -673,12 +673,12 @@ void frwr_unmap_async(struct rpcrdma_xpr
 	 */
 	bad_wr = NULL;
 	rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr);
-	trace_xprtrdma_post_send(req, rc);
 	if (!rc)
 		return;
 
 	/* Recycle MRs in the LOCAL_INV chain that did not get posted.
 	 */
+	trace_xprtrdma_post_linv(req, rc);
 	while (bad_wr) {
 		frwr = container_of(bad_wr, struct rpcrdma_frwr, fr_invwr);
 		mr = container_of(frwr, struct rpcrdma_mr, frwr);

From: Jason Gunthorpe <[email protected]>

commit 949b452f9cfef17e78055239f978d95ba729eee1 upstream.

This was missed when nes was removed.

---
 include/uapi/rdma/nes-abi.h |  115 --------------------------------------------
 1 file changed, 115 deletions(-)

@@ -1,115 +0,0 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
-/*
- * Copyright (c) 2006 - 2011 Intel Corporation.  All rights reserved.
- * Copyright (c) 2005 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Cisco Systems.  All rights reserved.
- * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- *
- */
-
-#ifndef NES_ABI_USER_H
-#define NES_ABI_USER_H
-
-#include <linux/types.h>
-
-#define NES_ABI_USERSPACE_VER 2
-#define NES_ABI_KERNEL_VER    2
-
-/*
- * Make sure that all structs defined in this file remain laid out so
- * that they pack the same way on 32-bit and 64-bit architectures (to
- * avoid incompatibility between 32-bit userspace and 64-bit kernels).
- * In particular do not use pointer types -- pass pointers in __u64
- * instead.
- */
-
-struct nes_alloc_ucontext_req {
-	__u32 reserved32;
-	__u8  userspace_ver;
-	__u8  reserved8[3];
-};
-
-struct nes_alloc_ucontext_resp {
-	__u32 max_pds; /* maximum pds allowed for this user process */
-	__u32 max_qps; /* maximum qps allowed for this user process */
-	__u32 wq_size; /* size of the WQs (sq+rq) allocated to the mmaped area */
-	__u8  virtwq;  /* flag to indicate if virtual WQ are to be used or not */
-	__u8  kernel_ver;
-	__u8  reserved[2];
-};
-
-struct nes_alloc_pd_resp {
-	__u32 pd_id;
-	__u32 mmap_db_index;
-};
-
-struct nes_create_cq_req {
-	__aligned_u64 user_cq_buffer;
-	__u32 mcrqf;
-	__u8 reserved[4];
-};
-
-struct nes_create_qp_req {
-	__aligned_u64 user_wqe_buffers;
-	__aligned_u64 user_qp_buffer;
-};
-
-enum iwnes_memreg_type {
-	IWNES_MEMREG_TYPE_MEM = 0x0000,
-	IWNES_MEMREG_TYPE_QP = 0x0001,
-	IWNES_MEMREG_TYPE_CQ = 0x0002,
-	IWNES_MEMREG_TYPE_MW = 0x0003,
-	IWNES_MEMREG_TYPE_FMR = 0x0004,
-	IWNES_MEMREG_TYPE_FMEM = 0x0005,
-};
-
-struct nes_mem_reg_req {
-	__u32 reg_type;	/* indicates if id is memory, QP or CQ */
-	__u32 reserved;
-};
-
-struct nes_create_cq_resp {
-	__u32 cq_id;
-	__u32 cq_size;
-	__u32 mmap_db_index;
-	__u32 reserved;
-};
-
-struct nes_create_qp_resp {
-	__u32 qp_id;
-	__u32 actual_sq_size;
-	__u32 actual_rq_size;
-	__u32 mmap_sq_db_index;
-	__u32 mmap_rq_db_index;
-	__u32 nes_drv_opt;
-};
-
-#endif	/* NES_ABI_USER_H */

From: Lijun Ou <[email protected]>

commit 5c7e76fb7cb5071be800c938ebf2c475e140d3f0 upstream.

SRQ's page size configuration of BA and buffer should depend on current PAGE_SHIFT, or it can't work in scenario of 64K page.

---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -6088,11 +6088,11 @@ static void hns_roce_v2_write_srqc(struc
 	roce_set_field(srq_context->byte_44_idxbufpgsz_addr,
 		       SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_M,
 		       SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_S,
-		       hr_dev->caps.idx_ba_pg_sz);
+		       hr_dev->caps.idx_ba_pg_sz + PG_SHIFT_OFFSET);
 	roce_set_field(srq_context->byte_44_idxbufpgsz_addr,
 		       SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_M,
 		       SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_S,
-		       hr_dev->caps.idx_buf_pg_sz);
+		       hr_dev->caps.idx_buf_pg_sz + PG_SHIFT_OFFSET);
 
 	srq_context->idx_nxt_blk_addr =
 		cpu_to_le32(mtts_idx[1] >> PAGE_ADDR_SHIFT);

From: Bart Van Assche <[email protected]>

commit 050dbddf249eee3e936b5734c30b2e1b427efdc3 upstream.

sin_port and sin6_port are big endian member variables. Convert these port numbers into CPU endianness before printing.