LF-3494-3: arch: arm64: imx8qxp-mek-sof-cs42888: remove useless route

ESAI0.OUT related route is added automatically on topology load,
so there is no need to specify it in DTS.

Suggested-by: Viorel Suman <viorel.suman@nxp.com>
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
(cherry picked from commit 37a511e41355377ed788ffec72b37f8afbfadcd5)

LF-3494-2: arch: arm64: imx8qxp-mek-sof-wm8960: remove useless routes

Both SAI1.IN and SAI1.OUT related routes are added automatically
on topology load, so there is no need to specify these routes in
DTS.

Suggested-by: Viorel Suman <viorel.suman@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
(cherry picked from commit 87564e99d6ce30ce7719adf01fc4c7cd41b0cbf4)

LF-3494: arch: arm64: imx8mp-evk-sof-wm8960: remove useless routes

Both SAI3.IN and SAI3.OUT related routes are added automatically
on topology load, so there is no need to specify these routes in
DTS. On the other hand not all topologies have both SAI3 IN and
OUT ports - like KWD topology for instance which has just SAI3.IN.

Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
(cherry picked from commit 1dda13ef4d141da0ac32b38ac25729e28f7ad491)

LF-3724-9: ASoC: imx-ak4497: set tdm slot for DSD

set tdm slot for DSD

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-8: ASoC: fsl_sai: Set proper words_per_fifo value

If period_size % words_per_fifo != 0, then the multi fifo
sdma script can't work correctly. So set proper word_per_fifo
value to avoid such issue.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3503 ARM64: imx8mp-ddr4-evk: add nand support

Add nand support for i.MX8MP-DDR4-EVK board.

Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Reviewed-by: Han Xu <han.xu@nxp.com>

LF-3264-2 arm: dts: imx7ulp: enable edma support for lpi2c nodes

Enable edma support for all lpi2c nodes in imx7ulp-evk.

Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Reviewed-by: Li Jun <jun.li@nxp.com>

LF-3264-1 i2c: lpi2c: add edma mode support

Add eDMA receive and send mode support.
Support to read and write data larger than 256 bytes in one frame.

Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Reviewed-by: Li Jun <jun.li@nxp.com>

LF-3652 gpu-viv: Integrate 6.4.3.p2 20210416 release

This version includes more bug-fixings for 8ULP GPU

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>

gpu-viv: Integrate 6.4.3.p2 GPU kernel driver

Major accomplishments
*  Vulkan driver memory leak issue
*  Android11 NN1.3 CTS
*  OCL3.0 CTS(not fully pass yet)
*  Solved Antutu v8 Quality and unstable issue

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>

tty: serial: imx: add peripheral_config/peripheral_size for config

Add peripheral_config/peripheral_size for sdma, otherwise, the random
value of local variable slave_config may cause unexpected
peripheral_config and make sdma mess up.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
(cherry picked from commit ba33de1c9535416f702fbf8bcbcef17f9cced409)

spi: spi-imx: add peripheral_config/peripheral_size for config

Add peripheral_config/peripheral_size for sdma, otherwise, the random
value of local variable tx/rx may cause unexpected
peripheral_config and make sdma mess up.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Clark Wang <xiaoning.wang@nxp.com>
(cherry picked from commit 77e7980fb495193019bf74639ef9198045fb6045)

dmaengine: fsl-edma-v3: dynamic change burst length

Dynamic change burst length in case transfer length is not multiple of
burst length to  meet the edmav3 hardware limitation.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 4b92c1194ba9f1c6f6d9a6f13a09639323787ce9)

LF-3435: arm64: defconfig: remove CONFIG_COMMON_CLK_BD718XX

remove CONFIG_COMMON_CLK_BD718XX since 32khz out from BD71847 not used on
i.mx8mm/i.mx8mn board, otherwise, below clk-bd718x7.ko would be inserted
by Yocto and below warning comes out:

[    8.944889] bd718xx-clk: probe of bd71847-clk.2.auto failed with error -22

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Acked-by: Clark Wang <xiaoning.wang@nxp.com>
(cherry picked from commit 634bd96794c640e8442493c91a3e8408f893fcc1)

dmaengine: imx-sdma: add fifo offset/words_per_fifo for sais script

Add fifo offset and words_per_fifo for  mcu_2_sai/sai_2_mcu scripts.

fifo offset:
0: no offset between fifos, means all fifos are continuous.
1: means 1 word offset between fifos.
2: means 2 word offset between fifos.
...
n: means n word offset between fifos, n max is 15.

words_per_fifo means how many times of fill/fetch fifo before jump to next
fifo, such as 2 audio channels need to be filled per lane.
0: only one time(audio channel) of fill/fetch per fifo before jump.
1: two times(audio channels) of fill/fetch per fifo before jump.
...
n: means n + 1 times(audio channels) of fill/fetch per fifo before jump.
   n max is 15.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit b59cc564e30dc789a78ea3abf8ae1920369b5e56)

dt-bindings: dma: fsl-imx-sdma: remove sw_done/selector

remove sw_done/selector since they are pass by slave_config instead.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 26d937473479ac9c4acd0779858164d5b03cb673)

dmaengine: imx-sdma: move dma parameters from imx_dma_data to slave_config

use 'peripheral_config' to pass our special sdma parameters from
dma_request_slave_channel() to dmaengine_slave_config(), thus could make
upper driver much cleaner, besides could make binding docs much cleaner
too and easier to upstreaming.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 6f52f8e232017df86fa50270c206f99b21a37ac2)

MLK-25266: dmaengine: imx-sdma: add i2c dma support

add new i2c dma script.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Acked-by: Clark Wang <xiaoning.wang@nxp.com>

LF-3724-7: ak4458: Consider slots number for DSD case

DSD clock frequency need to consider the slots number,
previously on slots=1 is considered.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-6: ASoC: fsl_asrc_dma: add sdma_audio_config support

Add sdma_audio_config support especially for multi fifo

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-5: ASoC: fsl_asrc_m2m: clear peripheral_config

clear peripheral_config

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-4: ASoC: fsl_easrc_m2m: clear peripheral_config

clear peripheral_config

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-3: ASoC: fsl_micfil: add sdma_audio_config support

Add sdma_audio_config support especially for multi fifo

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-2: ASoC: fsl_sai: add sdma_audio_config support

Add sdma_audio_config support especially for multi fifo.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3724-1: ASoC: fsl_ssi: add sdma_audio_config support

Add sdma_audio_config support especially for dual fifo

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

ASoC: dmaengine_pcm: add peripheral configuration

The commit e7bbb7acabf4 ("dmaengine: add peripheral configuration")
adds peripheral configuration for dma_slave_config.

This configuration is useful for some audio peripherals, for
example, the peripheral supports multi fifos, we can
let the DMA know which fifos are selected. So also add
this configuration for snd_dmaengine_dai_dma_data.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://lore.kernel.org/r/1612509985-11063-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>

dmaengine: add peripheral configuration

Some complex dmaengine controllers have capability to program the
peripheral device, so pass on the peripheral configuration as part of
dma_slave_config

Link: https://lore.kernel.org/r/20201109085450.24843-3-vkoul@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>

Revert "MLK-16224-3: ASoC: imx-pcm-dma-v2: fifo_num is used by dma slave config"

This reverts commit a28e7b0e8505b0d235f266e6fc0b35168de14cf4.

Revert "MLK-16224-2: ASoC: dmaengine_pcm: add fifo_num to snd_dmaengine_dai_dma_data"

This reverts commit 32cabc13306693b05e1a22cf1627c765ac82e861.

Revert "MLK-16224-1: dmaengine: add src_fifo_num and dst_fifo_num in dma_slave_config"

This reverts commit 54311ce5f603cdf36ba00c7101e0dbb7599bf497.

MLK-21499 arm: imx: put pads into OFF state before entering VLLS

Due to the hardware limitation, the power supply for the PADs could not
be off during VLLS mode. To reduce the power consumption under VLLS
state, put all the PADs on iomuxc1 into OFF state before the
system enters into VLLS mode.

Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>

MA-18933-02: media: isi-m2m: add invalid format handle for ISI mem2mem

When user set invalid value for width or height, driver will return
error, so adding invalid format handle for the case. The value will
be selected among the minimum and maximum value of ISI support

Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

MA-18933-01: media: imx8-common: change integer data type to unsigned

Change data type of ISI_2K, ISI_4K, ISI_8K to unsign integer and add macro
for ISI minimum support width or height.

Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

MLK-25455-02: media: isi: refine error message handle for ISI core driver

Refine error message handle for ISI core driver

Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

MLK-25455-01: media: csi: refine error message handle for Samsung mipi csi driver

Refine error message handle for Samsung mipi csi driver

Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

MLK-25441 clk: imx8mp: fix ISP clocks in mediamix

ISP1/2 share the core/axi/ahb clock in mediamix
BIT13/14/15(ISP1_core/axi/ahb) should be reserved bits.

The patch fixed it.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

MLK-25356 arm64: dts: imx8mp: fix overlap for reserved memory for isp

Remove reserved memory for isp1 because now only use one isp0 for tuning tool.
The reserved memory is only used for tuning tool, could be removed for normal
operations.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>
(cherry picked from commit 5f2220e87dd8a8fb86f524ea7945ab1d4155bc73)

MLK-25362 arm64: dts: imx8mp: use max-pixel-frequency to differentiate used MIPI clock

This patch replaced link-frequencies to express single/dual cameras case, which
is introduced from 21c3114f6b280aef16b9298857ba2cd6f3e6d479
MLK-23600-6 Update Basler camera link-frequencies to differentiate used MIPI clock

Originally from Thies Moeller <thies.moeller@baslerweb.com>
With the fix for max-pixel-frequency for dual cameras basler camera + ov5640.

For other sensor porting, could also use max-pixel-frequency property.
Other properties might be optional.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

MLK-23600-6 Update Basler camera link-frequencies to differentiate used MIPI clock

for 1 ISP camera on CSI0, MIPI CSI clock set to 500MHz
for 2 ISP cameras on CSI0/CSI1, MIPI CSI clock both set to 266MHz

Basler camera driver uses link-frequencies to retrieve proper clocks on
1 ISP or 2 ISP cameras cases.

Originally from Thies Moeller <thies.moeller@baslerweb.com>

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit bb98a98727e49cc40539be66c5f7aefc8e6009b9)

MLK-23600-5 Fix the way VIV_VIDIOC_QUERY_EXTMEM used reserved memory

use memory-region to get reserved memory

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit 5a28380ef4f4afffdabcfacd062706487cc150f8)

MLK-23600-4 Use GPR to control dewarp in driver

Previously it controls dewarp in mipi driver which is not standard way.
Now use gpr to control dewarp in dewarp driver.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit 22373bd4b6979bc9c8e63b678bcd5204714fd4c9)

MLK-23600-2 Update Dewarp power domain

update Dewarp power domain

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit e6031680ba2d67a6961a5da5fc68a913962c66d2)

MLK-23600-1 Change MIPI CSI clock to 266MHz for dual ISP cameras

Set MIPI clock according to IC team.
for 1 ISP camera on CSI0, MIPI CSI clock set to 500MHz
for 2 ISP cameras on CSI0/CSI1, MIPI CSI clock both set to 266MHz

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit a38f457b63fa8a0d9b4c5de39a12959c172e7e35)

MLK-25215-4 ARM64: dts: imx8mp-evk: add dual baslers cameras support

add dual baslers camera support to work with dual ISPs

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit a755ce242b551dafcca648f9d54585fd9ba02493)

MLK-25215-3 ARM64: dts: imx8mp-evk: add dual isp cameras basler and ov2775

add dual isp supports with basler camera and ov2775

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.zhou <guoniu.zhou@nxp.com>
(cherry picked from commit af20fa807f455ef846f7ffcebc6f489f285b1622)

LF-3712 net: stmmac: fix kernel dump when system suspend if EQOS down

Fix kernel dump when system suspend if EQOS down:

[  136.705424] ------------[ cut here ]------------
[  136.705428] enet_qos_root_clk already disabled
[  136.705466] WARNING: CPU: 0 PID: 503 at drivers/clk/clk.c:952 clk_core_disable+0xa0/0xa8
[  136.705468] Modules linked in:
[  136.705476] CPU: 0 PID: 503 Comm: sh Not tainted 5.10.29-103840-g470aa06b5004 #1064
[  136.705478] Hardware name: NXP i.MX8MPlus EVK board (DT)
[  136.705482] pstate: 40000085 (nZcv daIf -PAN -UAO -TCO BTYPE=--)
[  136.705485] pc : clk_core_disable+0xa0/0xa8
[  136.705488] lr : clk_core_disable+0xa0/0xa8
[  136.705490] sp : ffff800012433a10
[  136.705492] x29: ffff800012433a10 x28: ffff800011aafd68
[  136.705496] x27: 0000000000000000 x26: ffff800010784040
[  136.705500] x25: ffff800011ba0000 x24: 0000001fd4235124
[  136.705504] x23: 0000000000000000 x22: ffff800011b4e000
[  136.705508] x21: ffff0000c0defe00 x20: ffff0000c0addb00
[  136.705513] x19: ffff0000c0addb00 x18: ffff0000c74f44c0
[  136.705516] x17: 0000000000000000 x16: 0000000000000000
[  136.705520] x15: 0000000000000000 x14: 00000000000000fe
[  136.705524] x13: ffff8000119f1650 x12: 0000000000000001
[  136.705528] x11: 0000000000000000 x10: 00000000000009d0
[  136.705532] x9 : 00000000fffffffe x8 : 646165726c61206b
[  136.705536] x7 : 6c635f746f6f725f x6 : ffff800012433728
[  136.705540] x5 : ffff00017f36f900 x4 : 0000000000000000
[  136.705544] x3 : 0000000000000027 x2 : 0000000000000023
[  136.705548] x1 : 5d31c447452a7300 x0 : 0000000000000000
[  136.705552] Call trace:
[  136.705556]  clk_core_disable+0xa0/0xa8
[  136.705560]  clk_core_disable_lock+0x20/0x38
[  136.705563]  clk_disable+0x1c/0x28
[  136.705568]  stmmac_bus_clks_enable+0x4c/0xf0
[  136.705572]  stmmac_noirq_suspend+0x38/0x50
[  136.705578]  dpm_run_callback.isra.0+0x38/0xd8
[  136.705582]  __device_suspend_noirq+0xc4/0x1b8
[  136.705584]  dpm_suspend_noirq+0x100/0x258
[  136.705588]  suspend_devices_and_enter+0x160/0x5b8
[  136.705591]  pm_suspend+0x2ec/0x350
[  136.705595]  state_store+0x88/0x108
[  136.705599]  kobj_attr_store+0x14/0x28
[  136.705603]  sysfs_kf_write+0x40/0x50
[  136.705606]  kernfs_fop_write_iter+0x110/0x1a0
[  136.705610]  new_sync_write+0xe4/0x178
[  136.705613]  vfs_write+0x24c/0x380
[  136.705616]  ksys_write+0x68/0xf0
[  136.705619]  __arm64_sys_write+0x18/0x20
[  136.705625]  el0_svc_common.constprop.0+0x68/0x160
[  136.705628]  do_el0_svc+0x20/0x80
[  136.705632]  el0_svc+0x10/0x18
[  136.705635]  el0_sync_handler+0xa8/0xb0
[  136.705639]  el0_sync+0x140/0x180
[  136.705641] ---[ end trace f87fd1287132338e ]---
[  136.705644] ------------[ cut here ]------------
[  136.705645] enet_qos_root_clk already unprepared
[  136.705667] WARNING: CPU: 0 PID: 503 at drivers/clk/clk.c:810 clk_core_unprepare+0xe0/0x100
[  136.705669] Modules linked in:
[  136.705674] CPU: 0 PID: 503 Comm: sh Tainted: G        W         5.10.29-103840-g470aa06b5004 #1064
[  136.705675] Hardware name: NXP i.MX8MPlus EVK board (DT)
[  136.705678] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[  136.705681] pc : clk_core_unprepare+0xe0/0x100
[  136.705684] lr : clk_core_unprepare+0xe0/0x100
[  136.705686] sp : ffff800012433a20
[  136.705688] x29: ffff800012433a20 x28: ffff800011aafd68
[  136.705692] x27: 0000000000000000 x26: ffff800010784040
[  136.705696] x25: ffff800011ba0000 x24: 0000001fd4235124
[  136.705700] x23: 0000000000000000 x22: ffff800011b4e000
[  136.705704] x21: ffff0000c0defe00 x20: ffff0000c0e40940
[  136.705708] x19: ffff0000c0addb00 x18: ffff0000c74f44c0
[  136.705712] x17: 0000000000000000 x16: 0000000000000000
[  136.705716] x15: 0000000000000000 x14: 00000000000000fe
[  136.705720] x13: ffff8000119f1650 x12: 0000000000000001
[  136.705724] x11: 0000000000000000 x10: 00000000000009d0
[  136.705728] x9 : 00000000fffffffe x8 : 646165726c61206b
[  136.705731] x7 : 6c635f746f6f725f x6 : ffff800012433738
[  136.705735] x5 : ffff00017f36f900 x4 : 0000000000000000
[  136.705739] x3 : 0000000000000027 x2 : 0000000000000023
[  136.705743] x1 : 5d31c447452a7300 x0 : 0000000000000000
[  136.705747] Call trace:
[  136.705751]  clk_core_unprepare+0xe0/0x100
[  136.705754]  clk_unprepare+0x28/0x40
[  136.705757]  stmmac_bus_clks_enable+0x58/0xf0
[  136.705760]  stmmac_noirq_suspend+0x38/0x50
[  136.705764]  dpm_run_callback.isra.0+0x38/0xd8
[  136.705767]  __device_suspend_noirq+0xc4/0x1b8
[  136.705770]  dpm_suspend_noirq+0x100/0x258
[  136.705772]  suspend_devices_and_enter+0x160/0x5b8
[  136.705775]  pm_suspend+0x2ec/0x350
[  136.705778]  state_store+0x88/0x108
[  136.705781]  kobj_attr_store+0x14/0x28
[  136.705784]  sysfs_kf_write+0x40/0x50
[  136.705786]  kernfs_fop_write_iter+0x110/0x1a0
[  136.705789]  new_sync_write+0xe4/0x178
[  136.705792]  vfs_write+0x24c/0x380
[  136.705795]  ksys_write+0x68/0xf0
[  136.705798]  __arm64_sys_write+0x18/0x20
[  136.705801]  el0_svc_common.constprop.0+0x68/0x160
[  136.705804]  do_el0_svc+0x20/0x80
[  136.705807]  el0_svc+0x10/0x18
[  136.705810]  el0_sync_handler+0xa8/0xb0
[  136.705812]  el0_sync+0x140/0x180
[  136.705814] ---[ end trace f87fd1287132338f ]---

Fixes: 0ad8ae3531f2 LF-3101-1 net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>

MLK-25446-5: arm64: dts: imx8mp-evk: enable usdhc1 bus on M.2 interface

The patch is to enable usdhc1 on M.2 interface for SDIO wlan, and need
to disable PCIE interface on M.2.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>

MLK-25446-4: arm64: dts: imx8mq-evk: add gpio interrupt for M.2 SDIO wifi to wakeup the host

Add a child node to the SDIO controller to provide the wakeup gpio
interrupt properties for M.2 SDIO interface 89xx wifi driver.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>

MLK-25446-3: arm64: dts: imx8m: add gpio interrupt for wifi to wakeup the host

Add a child node to the SDIO/PCIE controller to provide the wakeup gpio
interrupt properties for 8987/8997 wifi driver.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>

MLK-25446-2: arm64: dts: imx8mn-evk: remove unused brcmf node

Now imx8mn only supports the on-board nxp 8987 wifi chip, not the brcm
wifi chip, so brcmf device node is useless, remove it here.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>

MLK-25446-1: dt-bindings: nxp,wifi-wake-host: add DT Binding doc for nxp,wifi-wake-host

Add DT Binding doc for nxp,wifi-wake-host, which is used for nxp 89XX
wireless device to wakeup the host.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>

Merge tag 'v5.10.31' into lf-5.10.y

This is the 5.10.31 stable release

* tag 'v5.10.31': (213 commits)
  Linux 5.10.31
  xen/events: fix setting irq affinity
  net: sfp: cope with SFPs that set both LOS normal and LOS inverted
  ...

Signed-off-by: Jason Liu <jason.hui.liu@nxp.com>
 Conflicts:
drivers/gpu/drm/imx/imx-ldb.c

arm64: imx8mx: vpu: integrate vsi 20210416 release

- M865SW-738: VSI V4L2 Engineer release package 20210416
  M865SW-636: [VPU/V4L2] H264 decoder: Resolution change stream seek hang
  M865SW-696: [VPU/V4L2] VC8000E： Flush encoder then get V4L2_EVENT_CODEC_ERROR event
  M865SW-730: [VPU/V4L2] encoder: Android poll() waiting timeout at beginning
  M865SW-734: [VPU/V4L2] decoder: daemon occurs error when running unit test
  M865SW-697: [VPU/V4L2] encoder: the bitrate of encoding vp8 is not accurate
  M865SW-726: [VPU/V4L2] 8MM/8MP HEVC 10bit decoder: cannot play on Android

Signed-off-by: Zhou Peng <eagle.zhou@nxp.com>
(cherry picked from commit ddf936035cb532689a9442529089e648729ac378)

Linux 5.10.31

Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Andrei Rabusov <a.rabusov@tum.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20210415144413.165663182@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xen/events: fix setting irq affinity

The backport of upstream patch 25da4618af240fbec61 ("xen/events: don't
unmask an event channel when an eoi is pending") introduced a
regression for stable kernels 5.10 and older: setting IRQ affinity for
IRQs related to interdomain events would no longer work, as moving the
IRQ to its new cpu was not included in the irq_ack callback for those
events.

Fix that by adding the needed call.

Note that kernels 5.11 and later don't need the explicit moving of the
IRQ to the target cpu in the irq_ack callback, due to a rework of the
affinity setting in kernel 5.11.

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: sfp: cope with SFPs that set both LOS normal and LOS inverted

commit 624407d2cf14ff58e53bf4b2af9595c4f21d606e upstream.

The SFP MSA defines two option bits in byte 65 to indicate how the
Rx_LOS signal on SFP pin 8 behaves:

bit 2 - Loss of Signal implemented, signal inverted from standard
        definition in SFP MSA (often called "Signal Detect").
bit 1 - Loss of Signal implemented, signal as defined in SFP MSA
        (often called "Rx_LOS").

Clearly, setting both bits results in a meaningless situation: it would
mean that LOS is implemented in both the normal sense (1 = signal loss)
and inverted sense (0 = signal loss).

Unfortunately, there are modules out there which set both bits, which
will be initially interpret as "inverted" sense, and then, if the LOS
signal changes state, we will toggle between LINK_UP and WAIT_LOS
states.

Change our LOS handling to give well defined behaviour: only interpret
these bits as meaningful if exactly one is set, otherwise treat it as
if LOS is not implemented.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/E1kyYQa-0004iR-CU@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Pali Rohár <pali@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: sfp: relax bitrate-derived mode check

commit 7a77233ec6d114322e2c4f71b4e26dbecd9ea8a7 upstream.

Do not check the encoding when deriving 1000BASE-X from the bitrate
when no other modes are discovered. Some GPON modules (VSOL V2801F
and CarlitoxxPro CPGOS03-0490 v2.0) indicate NRZ encoding with a
1200Mbaud bitrate, but should be driven with 1000BASE-X on the host
side.

Tested-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches

commit 77d02bd00cea9f1a87afe58113fa75b983d6c23a upstream.

Noticed on a debian:experimental mips and mipsel cross build build
environment:

  perfbuilder@ec265a086e9b:~$ mips-linux-gnu-gcc --version | head -1
  mips-linux-gnu-gcc (Debian 10.2.1-3) 10.2.1 20201224
  perfbuilder@ec265a086e9b:~$

    CC       /tmp/build/perf/util/map.o
  util/map.c: In function 'map__new':
  util/map.c:109:5: error: '%s' directive output may be truncated writing between 1 and 2147483645 bytes into a region of size 4096 [-Werror=format-truncation=]
    109 |    "%s/platforms/%s/arch-%s/usr/lib/%s",
        |     ^~
  In file included from /usr/mips-linux-gnu/include/stdio.h:867,
                   from util/symbol.h:11,
                   from util/map.c:2:
  /usr/mips-linux-gnu/include/bits/stdio2.h:67:10: note: '__builtin___snprintf_chk' output 32 or more bytes (assuming 4294967321) into a destination of size 4096
     67 |   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
        |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     68 |        __bos (__s), __fmt, __va_arg_pack ());
        |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  cc1: all warnings being treated as errors

Since we have the lenghts for what lands in that place, use it to give
the compiler more info and make it happy.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: x_tables: fix compat match/target pad out-of-bound write

commit b29c457a6511435960115c0f548c4360d5f4801d upstream.

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: Andy Nguyen <theflow@google.com>
Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: don't ignore REQ_NOWAIT for direct IO

[ Upstream commit f8b78caf21d5bc3fcfc40c18898f9d52ed1451a5 ]

If IOCB_NOWAIT is set on submission, then that needs to get propagated to
REQ_NOWAIT on the block side. Otherwise we completely lose this
information, and any issuer of IOCB_NOWAIT IO will potentially end up
blocking on eg request allocation on the storage side.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

riscv,entry: fix misaligned base for excp_vect_table

[ Upstream commit ac8d0b901f0033b783156ab2dc1a0e73ec42409b ]

In RV64, the size of each entry in excp_vect_table is 8 bytes. If the
base of the table is not 8-byte aligned, loading an entry in the table
will raise a misaligned exception. Although such exception will be
handled by opensbi/bbl, this still causes performance degradation.

Signed-off-by: Zihao Yu <yuzihao@ict.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

io_uring: don't mark S_ISBLK async work as unbounded

[ Upstream commit 4b982bd0f383db9132e892c0c5144117359a6289 ]

S_ISBLK is marked as unbounded work for async preparation, because it
doesn't match S_ISREG. That is incorrect, as any read/write to a block
device is also a bounded operation. Fix it up and ensure that S_ISBLK
isn't marked unbounded.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

null_blk: fix command timeout completion handling

[ Upstream commit de3510e52b0a398261271455562458003b8eea62 ]

Memory backed or zoned null block devices may generate actual request
timeout errors due to the submission path being blocked on memory
allocation or zone locking. Unlike fake timeouts or injected timeouts,
the request submission path will call blk_mq_complete_request() or
blk_mq_end_request() for these real timeout errors, causing a double
completion and use after free situation as the block layer timeout
handler executes blk_mq_rq_timed_out() and __blk_mq_free_request() in
blk_mq_check_expired(). This problem often triggers a NULL pointer
dereference such as:

BUG: kernel NULL pointer dereference, address: 0000000000000050
RIP: 0010:blk_mq_sched_mark_restart_hctx+0x5/0x20
...
Call Trace:
  dd_finish_request+0x56/0x80
  blk_mq_free_request+0x37/0x130
  null_handle_cmd+0xbf/0x250 [null_blk]
  ? null_queue_rq+0x67/0xd0 [null_blk]
  blk_mq_dispatch_rq_list+0x122/0x850
  __blk_mq_do_dispatch_sched+0xbb/0x2c0
  __blk_mq_sched_dispatch_requests+0x13d/0x190
  blk_mq_sched_dispatch_requests+0x30/0x60
  __blk_mq_run_hw_queue+0x49/0x90
  process_one_work+0x26c/0x580
  worker_thread+0x55/0x3c0
  ? process_one_work+0x580/0x580
  kthread+0x134/0x150
  ? kthread_create_worker_on_cpu+0x70/0x70
  ret_from_fork+0x1f/0x30

This problem very often triggers when running the full btrfs xfstests
on a memory-backed zoned null block device in a VM with limited amount
of memory.

Avoid this by executing blk_mq_complete_request() in null_timeout_rq()
only for commands that are marked for a fake timeout completion using
the fake_timeout boolean in struct null_cmd. For timeout errors injected
through debugfs, the timeout handler will execute
blk_mq_complete_request()i as before. This is safe as the submission
path does not execute complete requests in this case.

In null_timeout_rq(), also make sure to set the command error field to
BLK_STS_TIMEOUT and to propagate this error through to the request
completion.

Reported-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Tested-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Reviewed-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Link: https://lore.kernel.org/r/20210331225244.126426-1-damien.lemoal@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

idr test suite: Create anchor before launching throbber

[ Upstream commit 094ffbd1d8eaa27ed426feb8530cb1456348b018 ]

The throbber could race with creation of the anchor entry and cause the
IDR to have zero entries in it, which would cause the test to fail.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

idr test suite: Take RCU read lock in idr_find_test_1

[ Upstream commit 703586410da69eb40062e64d413ca33bd735917a ]

When run on a single CPU, this test would frequently access already-freed
memory.  Due to timing, this bug never showed up on multi-CPU tests.

Reported-by: Chris von Recklinghausen <crecklin@redhat.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

radix tree test suite: Register the main thread with the RCU library

[ Upstream commit 1bb4bd266cf39fd2fa711f2d265c558b92df1119 ]

Several test runners register individual worker threads with the
RCU library, but neglect to register the main thread, which can lead
to objects being freed while the main thread is in what appears to be
an RCU critical section.

Reported-by: Chris von Recklinghausen <crecklin@redhat.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

block: only update parent bi_status when bio fail

[ Upstream commit 3edf5346e4f2ce2fa0c94651a90a8dda169565ee ]

For multiple split bios, if one of the bio is fail, the whole
should return error to application. But we found there is a race
between bio_integrity_verify_fn and bio complete, which return
io success to application after one of the bio fail. The race as
following:

split bio(READ)          kworker

nvme_complete_rq
blk_update_request //split error=0
  bio_endio
    bio_integrity_endio
      queue_work(kintegrityd_wq, &bip->bip_work);

                         bio_integrity_verify_fn
                         bio_endio //split bio
                          __bio_chain_endio
                             if (!parent->bi_status)

                               <interrupt entry>
                               nvme_irq
                                 blk_update_request //parent error=7
                                 req_bio_endio
                                    bio->bi_status = 7 //parent bio
                               <interrupt exit>

                               parent->bi_status = 0
                        parent->bi_end_io() // return bi_status=0

The bio has been split as two: split and parent. When split
bio completed, it depends on kworker to do endio, while
bio_integrity_verify_fn have been interrupted by parent bio
complete irq handler. Then, parent bio->bi_status which have
been set in irq handler will overwrite by kworker.

In fact, even without the above race, we also need to conside
the concurrency beteen mulitple split bio complete and update
the same parent bi_status. Normally, multiple split bios will
be issued to the same hctx and complete from the same irq
vector. But if we have updated queue map between multiple split
bios, these bios may complete on different hw queue and different
irq vector. Then the concurrency update parent bi_status may
cause the final status error.

Suggested-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20210331115359.1125679-1-yuyufen@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

XArray: Fix splitting to non-zero orders

[ Upstream commit 3012110d71f41410932924e1d188f9eb57f1f824 ]

Splitting an order-4 entry into order-2 entries would leave the array
containing pointers to 000040008000c000 instead of 000044448888cccc.
This is a one-character fix, but enhance the test suite to check this
case.

Reported-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

gpu: host1x: Use different lock classes for each client

[ Upstream commit a24f98176d1efae2c37d3438c57a624d530d9c33 ]

To avoid false lockdep warnings, give each client lock a different
lock class, passed from the initialization site by macro.

Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

drm/tegra: dc: Don't set PLL clock to 0Hz

[ Upstream commit f8fb97c915954fc6de6513cdf277103b5c6df7b3 ]

RGB output doesn't allow to change parent clock rate of the display and
PCLK rate is set to 0Hz in this case. The tegra_dc_commit_state() shall
not set the display clock to 0Hz since this change propagates to the
parent clock. The DISP clock is defined as a NODIV clock by the tegra-clk
driver and all NODIV clocks use the CLK_SET_RATE_PARENT flag.

This bug stayed unnoticed because by default PLLP is used as the parent
clock for the display controller and PLLP silently skips the erroneous 0Hz
rate changes because it always has active child clocks that don't permit
rate changes. The PLLP isn't acceptable for some devices that we want to
upstream (like Samsung Galaxy Tab and ASUS TF700T) due to a display panel
clock rate requirements that can't be fulfilled by using PLLP and then the
bug pops up in this case since parent clock is set to 0Hz, killing the
display output.

Don't touch DC clock if pclk=0 in order to fix the problem.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

tools/kvm_stat: Add restart delay

[ Upstream commit 75f94ecbd0dfd2ac4e671f165f5ae864b7301422 ]

If this service is enabled and the system rebooted, Systemd's initial
attempt to start this unit file may fail in case the kvm module is not
loaded. Since we did not specify a delay for the retries, Systemd
restarts with a minimum delay a number of times before giving up and
disabling the service. Which means a subsequent kvm module load will
have kvm running without monitoring.
Adding a delay to fix this.

Signed-off-by: Stefan Raspl <raspl@linux.ibm.com>
Message-Id: <20210325122949.1433271-1-raspl@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

ftrace: Check if pages were allocated before calling free_pages()

[ Upstream commit 59300b36f85f254260c81d9dd09195fa49eb0f98 ]

It is possible that on error pg->size can be zero when getting its order,
which would return a -1 value. It is dangerous to pass in an order of -1
to free_pages(). Check if order is greater than or equal to zero before
calling free_pages().

Link: https://lore.kernel.org/lkml/20210330093916.432697c7@gandalf.local.home/
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

gfs2: report "already frozen/thawed" errors

[ Upstream commit ff132c5f93c06bd4432bbab5c369e468653bdec4 ]

Before this patch, gfs2's freeze function failed to report an error
when the target file system was already frozen as it should (and as
generic vfs function freeze_super does. Similarly, gfs2's thaw function
failed to report an error when trying to thaw a file system that is not
frozen, as vfs function thaw_super does. The errors were checked, but
it always returned a 0 return code.

This patch adds the missing error return codes to gfs2 freeze and thaw.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

drm/imx: imx-ldb: fix out of bounds array access warning

[ Upstream commit 33ce7f2f95cabb5834cf0906308a5cb6103976da ]

When CONFIG_OF is disabled, building with 'make W=1' produces warnings
about out of bounds array access:

drivers/gpu/drm/imx/imx-ldb.c: In function 'imx_ldb_set_clock.constprop':
drivers/gpu/drm/imx/imx-ldb.c:186:8: error: array subscript -22 is below array bounds of 'struct clk *[4]' [-Werror=array-bounds]

Add an error check before the index is used, which helps with the
warning, as well as any possible other error condition that may be
triggered at runtime.

The warning could be fixed by adding a Kconfig depedency on CONFIG_OF,
but Liu Ying points out that the driver may hit the out-of-bounds
problem at runtime anyway.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Liu Ying <victor.liu@nxp.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

KVM: arm64: Disable guest access to trace filter controls

[ Upstream commit a354a64d91eec3e0f8ef0eed575b480fd75b999c ]

Disable guest access to the Trace Filter control registers.
We do not advertise the Trace filter feature to the guest
(ID_AA64DFR0_EL1: TRACE_FILT is cleared) already, but the guest
can still access the TRFCR_EL1 unless we trap it.

This will also make sure that the guest cannot fiddle with
the filtering controls set by a nvhe host.

Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210323120647.454211-3-suzuki.poulose@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

KVM: arm64: Hide system instruction access to Trace registers

[ Upstream commit 1d676673d665fd2162e7e466dcfbe5373bfdb73e ]

Currently we advertise the ID_AA6DFR0_EL1.TRACEVER for the guest,
when the trace register accesses are trapped (CPTR_EL2.TTA == 1).
So, the guest will get an undefined instruction, if trusts the
ID registers and access one of the trace registers.
Lets be nice to the guest and hide the feature to avoid
unexpected behavior.

Even though this can be done at KVM sysreg emulation layer,
we do this by removing the TRACEVER from the sanitised feature
register field. This is fine as long as the ETM drivers
can handle the individual trace units separately, even
when there are differences among the CPUs.

Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210323120647.454211-2-suzuki.poulose@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

gfs2: Flag a withdraw if init_threads() fails

[ Upstream commit 62dd0f98a0e5668424270b47a0c2e973795faba7 ]

Interrupting mount with ^C quickly enough can cause the kthread_run()
calls in gfs2's init_threads() to fail and the error path leads to a
deadlock on the s_umount rwsem. The abridged chain of events is:

  [mount path]
  get_tree_bdev()
    sget_fc()
      alloc_super()
        down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); [acquired]
    gfs2_fill_super()
      gfs2_make_fs_rw()
        init_threads()
          kthread_run()
            ( Interrupted )
      [Error path]
      gfs2_gl_hash_clear()
        flush_workqueue(glock_workqueue)
          wait_for_completion()

  [workqueue context]
  glock_work_func()
    run_queue()
      do_xmote()
        freeze_go_sync()
          freeze_super()
            down_write(&sb->s_umount) [deadlock]

In freeze_go_sync() there is a gfs2_withdrawn() check that we can use to
make sure freeze_super() is not called in the error path, so add a
gfs2_withdraw_delayed() call when init_threads() fails.

Ref: https://bugzilla.kernel.org/show_bug.cgi?id=212231

Reported-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

interconnect: core: fix error return code of icc_link_destroy()

[ Upstream commit 715ea61532e731c62392221238906704e63d75b6 ]

When krealloc() fails and new is NULL, no error return code of
icc_link_destroy() is assigned.
To fix this bug, ret is assigned with -ENOMEM hen new is NULL.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Link: https://lore.kernel.org/r/20210306132857.17020-1-baijiaju1990@gmail.com
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

LF-3714-02 clk: imx: Remove the audio ipg clock from imx8mp

There is no audio ipg clock on i.MX8MP, so remove this from
the clock driver.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

LF-3714-01 arm64: dts: freescale: Remove the reference to the audio ipg clock on imx8mp

On i.MX8MP, there is no audio ipg clock, so remove the wrong
reference to this clock in dts file.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

MA-18499 soc: imx: Replace driver_deferred_probe_check_state

Symbol driver_deferred_probe_check_state is not exported
in kernel, blocking this pm driver built as module.
Using -EPROBE_DEFER to replace it.

Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Jindong Yue <jindong.yue@nxp.com>

MA-17422-3 soc: imx: Allow IMX8M_PM_DOMAINS to be loadable as module

Allow i.mx8m power domain driver to be loaded as module.
Do not select IMX8M_PM_DOMAINS by default after enable ARCH_MXC.

Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Jindong Yue <jindong.yue@nxp.com>

MA-17911 soc: imx: Allow IMX8M_BUSFREQ to be loadable as module

Allow imx8m busfreq driver to be loaded as a module.
Do not select IMX8M_BUSFREQ by default after enable ARCH_MXC.

Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Jindong Yue <jindong.yue@nxp.com>

MA-17597 clk: imx8mp: remove __init in imx_clk_init_on

Fix below section mismatch build warnings:
  The function imx8mp_clocks_probe() references
  the function __init imx_clk_init_on().
  This is often because imx8mp_clocks_probe lacks a __init
  annotation or the annotation of imx_clk_init_on is wrong.

  FATAL: modpost: Section mismatches detected.
  Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.

Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Jindong Yue <jindong.yue@nxp.com>

MLK-25018 soc: imx: Correct the default noc setting on imx8mq

The config for lcdif should be removed, and need to add vpu
qos setting by default. this patch is just to add back the
vpu qos config that is missed when resolving cherry-pick
conflict for patch:
3a3f54750294: MLK-19380 driver: soc: update the noc QoS setting on imx8mq

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Anson Huang <Anson.Huang@nxp.com>

LF-3709 PCI: imx: fix the build warning

Fix the build warning introduced by the previouse commit merge
conflictions.

Fixes: commit 1713c6ce909c ("MLK-25283-4 PCI: imx: adjust the l1ss support to proper place")

Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Reviewed-by: Jun Li <jun.li@nxp.com>

LF-3707 Revert "LF-3696: caam: fix that the caam driver cannot identify the SoC"

This reverts commit ed321757672f3d8b8ad0e2d40a19a9b2411d0940.

caam test failed with 5.10.27-lf-5.10.y-1.0.0-2413-ged321757672f.

Signed-off-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>

Linux 5.10.30

Tested-by: Andrei Rabusov <a.rabusov@tum.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Patrick McCormick <pmccormick@digitalocean.com>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Link: https://lore.kernel.org/r/20210412084013.643370347@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Revert "net: sched: bump refcount for new action in ACT replace mode"

commit 4ba86128ba077fbb7d86516ae24ed642e6c3adef upstream.

This reverts commit 6855e8213e06efcaf7c02a15e12b1ae64b9a7149.

Following commit in series fixes the issue without introducing regression
in error rollback of tcf_action_destroy().

Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: stop dump llsec params for monitors

commit 1534efc7bbc1121e92c86c2dabebaf2c9dcece19 upstream.

This patch stops dumping llsec params for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Reported-by: syzbot+cde43a581a8e5f317bc2@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-16-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: forbid monitor for del llsec seclevel

commit 9dde130937e95b72adfae64ab21d6e7e707e2dac upstream.

This patch forbids to del llsec seclevel for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Reported-by: syzbot+fbf4fc11a819824e027b@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-15-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: forbid monitor for set llsec params

commit 88c17855ac4291fb462e13a86b7516773b6c932e upstream.

This patch forbids to set llsec params for monitor interfaces which we
don't support yet.

Reported-by: syzbot+8b6719da8a04beeafcc3@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: fix nl802154 del llsec devkey

commit 27c746869e1a135dffc2f2a80715bb7aa00445b4 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVKEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+368672e0da240db53b5f@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: fix nl802154 add llsec key

commit 20d5fe2d7103f5c43ad11a3d6d259e9d61165c35 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_KEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+ce4e062c2d51977ddc50@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: fix nl802154 del llsec dev

commit 3d1eac2f45585690d942cf47fd7fbd04093ebd1b upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVICE is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+d946223c2e751d136c94@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-2-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: fix nl802154 del llsec key

commit 37feaaf5ceb2245e474369312bb7b922ce7bce69 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_KEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+ac5c11d2959a8b3c4806@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-1-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: nl-mac: fix check on panid

commit 6f7f657f24405f426212c09260bf7fe8a52cef33 upstream.

This patch fixes a null pointer derefence for panid handle by move the
check for the netlink variable directly before accessing them.

Reported-by: syzbot+d4c07de0144f6f63be3a@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210228151817.95700-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: mac802154: Fix general protection fault

commit 1165affd484889d4986cf3b724318935a0b120d8 upstream.

syzbot found general protection fault in crypto_destroy_tfm()[1].
It was caused by wrong clean up loop in llsec_key_alloc().
If one of the tfm array members is in IS_ERR() range it will
cause general protection fault in clean up function [1].

Call Trace:
 crypto_free_aead include/crypto/aead.h:191 [inline] [1]
 llsec_key_alloc net/mac802154/llsec.c:156 [inline]
 mac802154_llsec_key_add+0x9e0/0xcc0 net/mac802154/llsec.c:249
 ieee802154_add_llsec_key+0x56/0x80 net/mac802154/cfg.c:338
 rdev_add_llsec_key net/ieee802154/rdev-ops.h:260 [inline]
 nl802154_add_llsec_key+0x3d3/0x560 net/ieee802154/nl802154.c:1584
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210304152125.1052825-1-paskripkin@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers: net: fix memory leak in peak_usb_create_dev

commit a0b96b4a62745397aee662670cfc2157bac03f55 upstream.

syzbot reported memory leak in peak_usb.
The problem was in case of failure after calling
->dev_init()[2] in peak_usb_create_dev()[1]. The data
allocated int dev_init() wasn't freed, so simple
->dev_free() call fix this problem.

backtrace:
    [<0000000079d6542a>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000079d6542a>] kzalloc include/linux/slab.h:682 [inline]
    [<0000000079d6542a>] pcan_usb_fd_init+0x156/0x210 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:868   [2]
    [<00000000c09f9057>] peak_usb_create_dev drivers/net/can/usb/peak_usb/pcan_usb_core.c:851 [inline] [1]
    [<00000000c09f9057>] peak_usb_probe+0x389/0x490 drivers/net/can/usb/peak_usb/pcan_usb_core.c:949

Reported-by: syzbot+91adee8d9ebb9193d22d@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers: net: fix memory leak in atusb_probe

commit 6b9fbe16955152626557ec6f439f3407b7769941 upstream.

syzbot reported memory leak in atusb_probe()[1].
The problem was in atusb_alloc_urbs().
Since urb is anchored, we need to release the reference
to correctly free the urb

backtrace:
    [<ffffffff82ba0466>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff82ba0466>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<ffffffff82ad3888>] atusb_alloc_urbs drivers/net/ieee802154/atusb.c:362 [inline][2]
    [<ffffffff82ad3888>] atusb_probe+0x158/0x820 drivers/net/ieee802154/atusb.c:1038 [1]

Reported-by: syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>