fsl_qbman: remove reference to archdata.iommu_domain for v5.9

The dev->archdata.iommu_domain was removed in upstream kernel v5.9
in commit 6255c8c8d256 ("powerpc/dma: Remove dev->archdata.iommu_domain").

Signed-off-by: Camelia Groza <camelia.groza@nxp.com>

powerpc/configs/sdk_dpaa: update targets to corenet_base.config for v5.5

The base config was renamed in upstream commit 58b12eb28e34
("powerpc/configs: Rename foo_basic_defconfig to foo_base.config").

Signed-off-by: Camelia Groza <camelia.groza@nxp.com>

LF-3296-1 arm64:move elfcorehdr reservation early for crash dump kernel

elfcorehdr_addr is fixed address passed to 2nd kernel which may be conflicted
with potential reserved memory in 2nd kernel,so reserve_elfcorehdr() ahead of
early_init_fdt_scan_reserved_mem() can relieve this situation.

Signed-off-by: Nikhil Gupta <nikhil.gupta@nxp.com>
Signed-off-by: Poonam Aggrwal <poonam.aggrwal@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
Reviewed-by: Aisheng Dong <aisheng.dong@nxp.com>

LF-3296-2 watchdog: sbsa_gwdt: add shutdown hook to driver

Kexec maybe need more time than timeout of wdt(sbsa)
which will reset the system.
So it is necessary to add shutdown hook to disable the
wdt when run kexec.

Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>

MLK-25508: dmaengine: imx-sdma: fix kernel dump in audio record

Check whether audiomix really off or not in runtime resume, if not, do
nothing at HW level including script load to avoid the below crash:

[   40.348730] kernel BUG at mm/vmalloc.c:2064!
[   40.353001] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[   40.358486] Modules linked in:
[   40.361547] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.35-05035-g08680b128d38-dirty #490
[   40.369984] Hardware name: NXP i.MX8MPlus EVK board (DT)
[   40.375297] pstate: 00000005 (nzcv daif -PAN -UAO -TCO BTYPE=--)
[   40.381310] pc : __get_vm_area_node+0x164/0x188
[   40.385842] lr : vmap+0x84/0x100
[   40.389069] sp : ffff800011bdba80
[   40.392384] x29: ffff800011bdba80 x28: 0000000000000000
[   40.397700] x27: ffff0000c0447548 x26: ffff0000c69b80d4
[   40.403015] x25: 0000000000001000 x24: 006800000000070b
[   40.408333] x23: ffff0000c7399300 x22: 0000000000001000
[   40.413651] x21: 0000000000000010 x20: 0000000000000001
[   40.418972] x19: fffffdfffff01540 x18: 00000000000000c0
[   40.424290] x17: 0000000000000000 x16: 0000000000000000
[   40.429605] x15: fffffdfffff024c0 x14: fffffdfffff024c8
[   40.434921] x13: dead000000000122 x12: 0000000000001000
[   40.440236] x11: ffff00017f3fba08 x10: ffff80016dc2b000
[   40.445552] x9 : ffffffffffffffff x8 : 0000000000010001
[   40.450870] x7 : ffff8000100f51a0 x6 : 0000000000000cc0
[   40.456187] x5 : 00000000ffffffff x4 : fffffdffbfff0000
[   40.461505] x3 : ffff800010000000 x2 : 0000000000000010
[   40.466821] x1 : 0000000000000001 x0 : 0000000000001000
[   40.472137] Call trace:
[   40.474588]  __get_vm_area_node+0x164/0x188
[   40.478775]  dma_common_contiguous_remap+0xa8/0xe8
[   40.483568]  dma_direct_alloc+0x194/0x320
[   40.487581]  dma_alloc_attrs+0x7c/0xe0
[   40.491333]  sdma_load_script+0x64/0x170
[   40.495260]  sdma_runtime_resume+0x1cc/0x1e8
[   40.499533]  pm_generic_runtime_resume+0x28/0x40
[   40.504153]  __genpd_runtime_resume+0x2c/0xa0
[   40.508512]  genpd_runtime_resume+0x88/0x208
[   40.512784]  __rpm_callback+0xd4/0x148
[   40.516535]  rpm_callback+0x20/0x80
[   40.520025]  rpm_resume+0x39c/0x580
[   40.523515]  __pm_runtime_resume+0x38/0x80
[   40.527614]  sdma_int_handler+0x40/0x380
[   40.531539]  __handle_irq_event_percpu+0x4c/0x160
[   40.536243]  handle_irq_event_percpu+0x30/0x88
[   40.540686]  handle_irq_event+0x44/0xd8
[   40.544525]  handle_fasteoi_irq+0xb4/0x160
[   40.548621]  generic_handle_irq+0x2c/0x40
[   40.552632]  __handle_domain_irq+0x60/0xb8
[   40.556730]  gic_handle_irq+0x54/0x118
[   40.560482]  el1_irq+0xc0/0x180
[   40.563626]  cpuidle_enter_state+0x134/0x2e8
[   40.567898]  cpuidle_enter+0x34/0x48
[   40.571476]  call_cpuidle+0x18/0x38
[   40.574963]  do_idle+0x1f4/0x258
[   40.578190]  cpu_startup_entry+0x20/0x68
[   40.582116]  rest_init+0xd4/0xe0
[   40.585347]  arch_call_rest_init+0xc/0x14
[   40.589359]  start_kernel+0x470/0x4a4
[   40.593027] Code: aa1403e0 a94153f3 a8c67bfd d65f03c0 (d4210000)
[   40.599126] ---[ end trace 1207e0499c4741de ]---

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-1723: spi: lpspi: run transfer speed_hz sanity check

Coverity reports Division or modulo by zero potential issue(CWE-369)
about the provided transfer speed_hz. Run sanity check first to avoid this
problem.

Signed-off-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Reviewed-by: Jun Li <jun.li@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

dpaa2-mac: workaround for zero advertising on the MAC

It seems there are some circumstances in the latest MC firmware versions
where an empty advertising field is returned by the dpmac_get_link_cfg()
command. This will eventually lead to the link not going up.
Work around this issue by skipping PHY reconfiguration if this happens.

Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>

dpaa2-eth: Set congestion group before the Rx queues become operational

Setting  the CGID for the first time or dynamically changing it
with a different one  on a FQ that has been in service (has frames in it)
is not supported, the byte/frame counts in both the old and new CGRs may be
corrupted if this is done.

This patch adds the configuration of the CGR(congestion group record)
for the network interface RX queues, in the probe function before the queues
become operational,  to prevent the corruption of the aforementioned counter.

Signed-off-by: Radu Bulie <radu-andrei.bulie@nxp.com>

dpaa2-console.c: free buffer before returning from dpaa2_console_read

Dpaa2_console_read function frees kbuf buffer before returning.
The variable no longer goes out of scope, leaking the storage it
points to.

Signed-off-by: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>

dpaa2-eth: fix a possible null pointer dereference

In case the FD that we are cleaning up on the Tx confirmation path
is corrupted (carries a wrong SWA type), there will be no skb
to work with.

Signed-off-by: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>

LF-3799 dpaa2-switch: convert BR_STATE enum to DPSW_STP_STATE enum

Starting with mc 10.28.0, the firmware returns an error any time
an invalid STP state is configured.
An explicit function converts from BR_STATE_* kernel enums to
DPSW_STP_STATE_* mc enums.

Signed-off-by: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>

LF-3798: dprc-driver.c: resource pools are no longer initialized

dprc_scan_container() function is no longer called on a device
endpoint lookup, which, in turn, called fsl_mc_init_all_resource_pools.
Scanning for objects is done using the dprc_scan_objects()
function directly.

Signed-off-by: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>

LF-3715-2 arm64: dts: imx8mp-evk: add "rtl821x,clkout-disable" property for PHY

Add "rtl821x,clkout-disable" property to disable CLKOUT clock for
Ethernet PHY.

Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Reviewed-by: Jun Li <jun.li@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3715-1 net: phy: realtek: change "rtl821x,clkout_en" to "rtl821x,clkout-disable"

For PHY RTL8211FDI-CG, CLKOUT clock default is enabled by hardware, use
"rtl821x,clkout-disable" property to disable CLKOUT if user required. If
use "rtl821x,clkout_en" property to enable CLKOUT clock, it will block existing
cases which need this CLKOUT for MAC but doesn't add this property. It's
safe to change "rtl821x,clkout_en" to "rtl821x,clkout-disable", as to be
removed property("rtl821x,clkout_en") never been used in the kernel
tree.

Camelia Groza validated on LS1043ARDB.

Tested-by: Camelia Groza <camelia.groza@nxp.com>
Reviewed-by: Camelia Groza <camelia.groza@nxp.com>
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3886 [#imx-2532] Coverity Issue:15625673 Uninitialized scalar variable

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3811 net: fec: fix TX Bandwidth Fluctuations

MAC-NET IP with AVB support, queue 0 for best-effor, and queue 1&2 for AVB.
The default bandwidth configured of queue 1&2 is 50% in the driver, which
leads to TX bandwidth fluctuations when selecting queue 1&2 for transmitting
packets. Select queue based on VLAN info when AVB enabled.

Commit da722186f654 ("net: fec: set GPR bit on suspend by DT configuration.")
refactor the fec_devtype, need adjust downstream code accordingly.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3831 net: stmmac: fix system hang if change mac address after interface ifdown

Fix system hang with below sequences:
~# ifconfig ethx down
~# ifconfig ethx hw ether xx:xx:xx:xx:xx:xx

After ethx down, stmmac all clocks gated off and then register access
causes system hang.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3861 arm64: dts: imx8mm/n-evk: disable over current for usb1

Since imx8mm and imx8mn evk base board does not support over current
detection for usb1, so disable it.

Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3803: drm: imx: mhdp: Move phy_power function to encoder_enable

Split power up function to arc and phy only power up functions.
Move phy power up function to encoder_enable.

Signed-off-by: Sandor Yu <Sandor.yu@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3830 Revert "MLK-21499 arm: imx: put pads into OFF state before entering VLLS"

This reverts commit 6bec1553aaf630b80c9239d8895d423843f31801.

Put all the pads into off mode have side effect if the pad used for
GPIO interrupt. system suspend/resume will be broken, We can not
add it in our generic release.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3794: ASoC: fsl_xcvr: Fix hang issue after suspend with RX recording

There is a unhandled interrupt after suspend, which cause endless
interrupt when system resume, so system will hang.

Disable all interrupt in runtime suspend callback.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3819: ASoC: fsl_spdif: Fix unexpected interrupt after suspend

When system enter suspend,  the machine driver suspend callback
function will be called, then the cpu driver trigger callback
(SNDRV_PCM_TRIGGER_SUSPEND) be called, the interrupt should be
disabled

But the machine driver suspend and cpu dai driver suspend order
maybe changed, the cpu dai driver's suspend callback is called before
machine driver's suppend callback, then the interrupt is not cleared
successfully in trigger callback.

So need to clear interrupts in cpu dai driver's suspend callback
to avoid such issue.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>

LF-3779 remoteproc: imx_rproc: fix earlyboot detection

Here the earlyboot detection updated to use 0xB for the low four bits.
The previous detection not work, because with BIT0 set, BIT1 will
be automatically set, and BIT3 are also set by us.

So we detect BIT[3,1,0] here.

Reviewed-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>

MLK-25413: fsl_xcvr: Fix channel swap issue with ARC

With pause and resume test for ARC, there is occassionally
channel swap. Change the clearing dpath operation after
the dma enablement to fix this issue.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>

LF-3773 media: isi: m2m: only fill colorspace when userspace don't touch them

Only fill colorspace, ycbcr_enc, xfer_func and quantization when userspace
don't touch them.

Signed-off-by: Bing Song <bing.song@nxp.com>
Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

LF-3774-3 ASoC: SOF: Fix sof_ipc_msg_data for compress streams

sof_ipc_msg_data relies on sof_pcm_stream to retrieve the Host position
offset. This doesn't work for compress audio.

For compressed audio we need to retrieve position offset from
sof_compr_stream.

Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>

LF-3774-2 ASoC: SOF: imx: Use newly introduced generic IPC stream ops

This makes IMX use the newly introduced generic IPC ops
instead of imx specific ones.

Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>

LF-3774-1 ASoC: sof: Make Intel IPC stream ops generic

This operations should be generic as there is nothing Intel
specific.
This works well for NXP i.MX8 stream IPC ops.

We start by moving sof/intel/intel-ipc.c into sof/stream.c and
rename
the functions to be generic.

Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>

MLK-25489 arm64: imx8mx: vpu: correct width-stride for RGB formats

For imx8mm(hantro h1 encoder), per width-stride need to align to 16.
RGB16: width-strde = bytesperline / 2
RGBX: width-stride = bytesperline / 4

Signed-off-by: Shijie Qin <shijie.qin@nxp.com>
Reviewed-by: Hou Qi <qi.hou@nxp.com>

MGS-6145 [#imx-2455] fix the QueryIdle fail when no weston

When GPU hardware become idle, FE address will fall into
last wait-link loop, Wait-link has 2 instructions,
each instruction is 8 bytes, the valid offset is [0, 16],
Original programming is wrong to test FE not in idle
with last wait-link + 16.

Signed-off-by: Jiyu Yang <jiyu.yang@nxp.com>

MLK-25468: seco_mu: hook v2x reset event

after get v2x reset event, return error at read
v2x reset after system enter ks1.

Signed-off-by: Frank Li <Frank.Li@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

Fixed the "vgHardware" case.

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

Move the suspend semaphore inside the suspend/resume routines.

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

The suspend will acquire the global semaphore, and a later gcvPOWER_ON_AUTO
determined by a new commit will wait for global semaphore until a GPU resume
(power ON) release the global semaphore, then the gcvPOWER_ON_AUTO will
continue to run. But during the stress test, the sequence might change.
For example:
1. GPU goes to suspend; if a new commit comes then gcvPOWER_ON_AUTO will
wait for global semaphore.
2. GPU goes to resume, a global power ON will release the global semaphore,
gcvPOWER_ON_AUTO acquire the global semaphore successfully but will release
it by itself because gcvPOWER_ON_AUTO is not a global state and it won't
occupy a global semaphore.
3. The next GPU suspend will also acquire the global semaphore successfully.
As the GPU suspend and gcvPOWER_ON_AUTO are in two threads, there is a certain
probability that suspend is executed first, then gcvPOWER_ON_AUTO, so that the
later GPU stall (from suspend) will occur at the same time with new
commit abd will cause the GPU hang.

Suggested-by: Zhe Pan <Zhe.Pan@verisilicon.com>
Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

Put GPU into suspend instead of idle. Suspend will also disable internal clocks.

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

Remove the unneded hack, I never run into that code and see it really
works.

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

No need to power on during suspend.
1. If the GPU core is already on, then no change performed.
2. If the GPU core is already in idle/suspend/power_off it means the
   Stall has already been done.
   No need to power it on again and put into idle state again.
3. If the GPU core is in idle and we want to put into suspend or
   power_off, that will be handled inside the
   gckHARDWARE_SetPowerState().

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

MGS-6197 [#imx-2532] GPU crash when changing gpu_govern mode

Add gckGALDEVICE_Suspend() and gckGALDEVICE_Resume() to be used by both
gpu_suspend/gpu_resume as well as by gpu_govern_store.
The suspendSemaphore will take care that those are kept running on race.

Signed-off-by: Nicușor Cîțu <nicusor.citu@nxp.com>

LF-3548-2: ASoC: fsl_easrc_m2m: Fix issue with double kfree

The pointer need to be NULL after kfree to avoid kernel dummp
in second kfree for same pointer.

[ 9285.401707] Call trace:
[ 9285.404171]  kfree+0x388/0x3fc
[ 9285.407238]  fsl_easrc_ioctl+0xf4/0xf80

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Peng Zhang <peng.zhang_8@nxp.com>

LF-3548-1: ASoC: fsl_asrc_m2m: Fix issue with double kfree

The pointer need to be NULL after kfree to avoid kernel dummp
in second kfree for same pointer.

[ 9285.401707] Call trace:
[ 9285.404171]  kfree+0x388/0x3fc
[ 9285.407238]  fsl_easrc_ioctl+0xf4/0xf80

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Peng Zhang <peng.zhang_8@nxp.com>

LF-3750 [#imx-2544] fix Out-of-bounds access

fix coverity issue CID 12329075 Out-of-bounds access
Signed-off-by: Jiyu Yang <jiyu.yang@nxp.com>

MLK-25465-2: arm64: dts: imx8mn-ddr4-evk: update vdd_soc in suspend to 0.75v

To match with the latest datasheet, besides, correct vdd_soc to buck1
instead of buck2. But this patch should be no any impact since uboot
has already done the same thing. Anyway correct it, since rohm driver
has this ability now and could be indepedent of  uboot in the future.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>

MLK-25465-1: arm64: dts: imx8mn-evk: update vdd_soc in suspend to 0.75v

To match with the latest datasheet, besides, correct vdd_soc to buck1
instead of buck2. But this patch should be no any impact since uboot
has already done the same thing. Anyway correct it, since pca9450 driver
has this ability now and could be indepedent of  uboot in the future.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>

M865SW-742: media: isi: add status checking when open video device

Add ISI stream status checking when user try to open it.

Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com>
Reviewed-by: Robby Cai <robby.cai@nxp.com>

MLK-25482: watchdog: imx2_wdt: clear WDOG_HW_RUNNING before suspend

For watchdog_ping_work is not freezable so that it maybe scheduled before
imx2_wdt_resume where watchdog clock is on, hence, kernel will hang in
imx2_wdt_ping with clock disabled, and then watchdog reset happen.
Prevent the above case by clearing WDOG_HW_RUNNING before suspend, and
restore it with ping in imx2_wdt_resume.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>

LF-2861 media: mx6s_capture: Fix Coverity Issue: 17695 Dereference before null check

Fix dereference before NULL check issue

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2860 media: mxc_capture: Fix Coverity Issue: 17691 Dereference before null check

Fix dereference before NULL check issue

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2859 media: mxc_capture: Fix Coverity Issue: 17678 Dereference before null check

Fix issue for dereference before NULL check

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2858 media: ipu: Fix Coverity Issue: 17676 Dereference before null check

Fix issue for dereference before NULL check

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2856 media: ipu: Fix Coverity Issue: 17672 Dereference before null check

Fixed dereference before NULL check issue

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2855 media: camera: Fix Coverity Issue: 17397 Unsigned compared against 0

remove the comparison against 0 which is not necessary

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2853 media: camera: Fix Coverity Issue: 17391 Unsigned compared against 0

remove the comparison against 0 which is not necessary

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2488 media: mxc_capture: Fix Coverity Issue:11024996 Unchecked return value

Add return value check for fb_set_var

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2088 media: epdc: Fix Coverity Issue:17663 Sizeof not portable

Use sizeof(u32) instead of sizeof(u32 *)

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

LF-2085 media: epdc: Fix Coverity Issue:17286 Unused value

Fixed unused value issue

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: G.n. Zhou <guoniu.zhou@nxp.com>

Merge tag 'v5.10.35' into lf-5.10.y

This is the 5.10.35 stable release

* tag 'v5.10.35': (174 commits)
  Linux 5.10.35
  vfio: Depend on MMU
  perf/core: Fix unconditional security_locked_down() call
  ...

Signed-off-by: Jason Liu <jason.hui.liu@nxp.com>

Linux 5.10.35

Tested-By: Patrick McCormick <pmccormick@digitalocean.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Link: https://lore.kernel.org/r/20210505112326.195493232@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

vfio: Depend on MMU

commit b2b12db53507bc97d96f6b7cb279e831e5eafb00 upstream.

VFIO_IOMMU_TYPE1 does not compile with !MMU:

../drivers/vfio/vfio_iommu_type1.c: In function 'follow_fault_pfn':
../drivers/vfio/vfio_iommu_type1.c:536:22: error: implicit declaration of function 'pte_write'; did you mean 'vfs_write'? [-Werror=implicit-function-declaration]

So require it.

Suggested-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Message-Id: <0-v1-02cb5500df6e+78-vfio_no_mmu_jgg@nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

perf/core: Fix unconditional security_locked_down() call

commit 08ef1af4de5fe7de9c6d69f1e22e51b66e385d9b upstream.

Currently, the lockdown state is queried unconditionally, even though
its result is used only if the PERF_SAMPLE_REGS_INTR bit is set in
attr.sample_type. While that doesn't matter in case of the Lockdown LSM,
it causes trouble with the SELinux's lockdown hook implementation.

SELinux implements the locked_down hook with a check whether the current
task's type has the corresponding "lockdown" class permission
("integrity" or "confidentiality") allowed in the policy. This means
that calling the hook when the access control decision would be ignored
generates a bogus permission check and audit record.

Fix this by checking sample_type first and only calling the hook when
its result would be honored.

Fixes: b0c8fdc7fdb7 ("lockdown: Lock down perf when in confidentiality mode")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Link: https://lkml.kernel.org/r/20210224215628.192519-1-omosnace@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: thinkpad_acpi: Correct thermal sensor allocation

commit 6759e18e5cd8745a5dfc5726e4a3db5281ec1639 upstream.

On recent Thinkpad platforms it was reported that temp sensor 11 was
always incorrectly displaying 66C. It turns out the reason for this is
that this location in EC RAM is not a temperature sensor but is the
power supply ID (offset 0xC2).

Based on feedback from the Lenovo firmware team the EC RAM version can
be determined and for the current version (3) only the 0x78 to 0x7F
range is used for temp sensors. I don't have any details for earlier
versions so I have left the implementation unaltered there.

Note - in this block only 0x78 and 0x79 are officially designated (CPU &
GPU sensors). The use of the other locations in the block will vary from
platform to platform; but the existing logic to detect a sensor presence
holds.

Signed-off-by: Mark Pearson <markpearson@lenovo.com>
Link: https://lore.kernel.org/r/20210407212015.298222-1-markpearson@lenovo.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: Add reset-resume quirk for WD19's Realtek Hub

commit ca91fd8c7643d93bfc18a6fec1a0d3972a46a18a upstream.

Realtek Hub (0bda:5487) in Dell Dock WD19 sometimes fails to work
after the system resumes from suspend with remote wakeup enabled
device connected:
[ 1947.640907] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71)
[ 1947.641208] usb 5-2.3-port5: cannot disable (err = -71)
[ 1947.641401] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71)
[ 1947.641450] usb 5-2.3-port4: cannot reset (err = -71)

Information of this hub:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480  MxCh= 5
D:  Ver= 2.10 Cls=09(hub  ) Sub=00 Prot=02 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=5487 Rev= 1.47
S:  Manufacturer=Dell Inc.
S:  Product=Dell dock
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=01 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=256ms
I:* If#= 0 Alt= 1 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=02 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=256ms

The failure results from the ETIMEDOUT by chance when turning on
the suspend feature for the specified port of the hub. The port
seems to be in an unknown state so the hub_activate during resume
fails the hub_port_status, then the hub will fail to work.

The quirky hub needs the reset-resume quirk to function correctly.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210420174651.6202-1-chris.chiu@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet

commit 8f23fe35ff1e5491b4d279323a8209a31f03ae65 upstream.

This is another branded 8153 device that doesn't work well with LPM
enabled:
[ 400.597506] r8152 5-1.1:1.0 enx482ae3a2a6f0: Tx status -71

So disable LPM to resolve the issue.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/1922651
Link: https://lore.kernel.org/r/20210412135455.791971-1-kai.heng.feng@canonical.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX

commit 64f40f9be14106e7df0098c427cb60be645bddb7 upstream.

ToneLab EX guitar pedal device requires the same quirk like ToneLab ST
for supporting the MIDI.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212593
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210407144549.1530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ovl: allow upperdir inside lowerdir

commit 708fa01597fa002599756bf56a96d0de1677375c upstream.

Commit 146d62e5a586 ("ovl: detect overlapping layers") made sure we don't
have overlapping layers, but it also broke the arguably valid use case of

 mount -olowerdir=/,upperdir=/subdir,..

where upperdir overlaps lowerdir on the same filesystem.  This has been
causing regressions.

Revert the check, but only for the specific case where upperdir and/or
workdir are subdirectories of lowerdir.  Any other overlap (e.g. lowerdir
is subdirectory of upperdir, etc) case is crazy, so leave the check in
place for those.

Overlaps are detected at lookup time too, so reverting the mount time check
should be safe.

Fixes: 146d62e5a586 ("ovl: detect overlapping layers")
Cc: <stable@vger.kernel.org> # v5.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ovl: fix leaked dentry

commit eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41 upstream.

Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in
ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a
metacopy error, which leads to dentry leaks when shutting down the related
superblock:

  overlayfs: refusing to follow metacopy origin for (/file0)
  ...
  BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]
  ...
  WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d
  CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1
  ...
  RIP: 0010:umount_check.cold+0x107/0x14d
  ...
  Call Trace:
   d_walk+0x28c/0x950
   ? dentry_lru_isolate+0x2b0/0x2b0
   ? __kasan_slab_free+0x12/0x20
   do_one_tree+0x33/0x60
   shrink_dcache_for_umount+0x78/0x1d0
   generic_shutdown_super+0x70/0x440
   kill_anon_super+0x3e/0x70
   deactivate_locked_super+0xc4/0x160
   deactivate_super+0xfa/0x140
   cleanup_mnt+0x22e/0x370
   __cleanup_mnt+0x1a/0x30
   task_work_run+0x139/0x210
   do_exit+0xb0c/0x2820
   ? __kasan_check_read+0x1d/0x30
   ? find_held_lock+0x35/0x160
   ? lock_release+0x1b6/0x660
   ? mm_update_next_owner+0xa20/0xa20
   ? reacquire_held_locks+0x3f0/0x3f0
   ? __sanitizer_cov_trace_const_cmp4+0x22/0x30
   do_group_exit+0x135/0x380
   __do_sys_exit_group.isra.0+0x20/0x20
   __x64_sys_exit_group+0x3c/0x50
   do_syscall_64+0x45/0x70
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  ...
  VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

This fix has been tested with a syzkaller reproducer.

Cc: Amir Goldstein <amir73il@gmail.com>
Cc: <stable@vger.kernel.org> # v5.8+
Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 6815f479ca90 ("ovl: use only uppermetacopy state in ovl_lookup()")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Link: https://lore.kernel.org/r/20210329164907.2133175-1-mic@digikod.net
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

nvme-pci: set min_align_mask

commit: 3d2d861eb03e8ee96dc430a54361c900cbe28afd

The PRP addressing scheme requires all PRP entries except for the
first one to have a zero offset into the NVMe controller pages (which
can be different from the Linux PAGE_SIZE).  Use the min_align_mask
device parameter to ensure that swiotlb does not change the address
of the buffer modulo the device page size to ensure that the PRPs
won't be malformed.

Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: respect min_align_mask

commit: 1f221a0d0dbf0e48ef3a9c62871281d6a7819f05

swiotlb: respect min_align_mask

Respect the min_align_mask in struct device_dma_parameters in swiotlb.

There are two parts to it:
 1) for the lower bits of the alignment inside the io tlb slot, just
    extent the size of the allocation and leave the start of the slot
     empty
 2) for the high bits ensure we find a slot that matches the high bits
    of the alignment to avoid wasting too much memory

Based on an earlier patch from Jianxiong Gao <jxgao@google.com>.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single

commit: 16fc3cef33a04632ab6b31758abdd77563a20759

swiotlb_tbl_map_single currently nevers sets a tlb_addr that is not
aligned to the tlb bucket size.  But we're going to add such a case
soon, for which this adjustment would be bogus.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: refactor swiotlb_tbl_map_single

commit: 26a7e094783d482f3e125f09945a5bb1d867b2e6

Split out a bunch of a self-contained helpers to make the function easier
to follow.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: clean up swiotlb_tbl_unmap_single

commit: ca10d0f8e530600ec63c603dbace2c30927d70b7

swiotlb: clean up swiotlb_tbl_unmap_single

Remove a layer of pointless indentation, replace a hard to follow
ternary expression with a plain if/else.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: factor out a nr_slots helper

commit: c32a77fd18780a5192dfb6eec69f239faebf28fd

Factor out a helper to find the number of slots for a given size.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: factor out an io_tlb_offset helper

commit: c7fbeca757fe74135d8b6a4c8ddaef76f5775d68

Replace the very genericly named OFFSET macro with a little inline
helper that hardcodes the alignment to the only value ever passed.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

swiotlb: add a IO_TLB_SIZE define

commit: b5d7ccb7aac3895c2138fe0980a109116ce15eff

Add a new IO_TLB_SIZE define instead open coding it using
IO_TLB_SHIFT all over.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Jianxiong Gao <jxgao@google.com>
Tested-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

driver core: add a min_align_mask field to struct device_dma_parameters

commit: 36950f2da1ea4cb683be174f6f581e25b2d33e71

Some devices rely on the address offset in a page to function
correctly (NVMe driver as an example). These devices may use
a different page size than the Linux kernel. The address offset
has to be preserved upon mapping, and in order to do so, we
need to record the page_offset_mask first.

Signed-off-by: Jianxiong Gao <jxgao@google.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tools/cgroup/slabinfo.py: updated to work on current kernel

[ Upstream commit 1974c45dd7745e999b9387be3d8fdcb27a5b1721 ]

slabinfo.py script does not work with actual kernel version.

First, it was unable to recognise SLUB susbsytem, and when I specified
it manually it failed again with

  AttributeError: 'struct page' has no member 'obj_cgroups'

.. and then again with

  File "tools/cgroup/memcg_slabinfo.py", line 221, in main
    memcg.kmem_caches.address_of_(),
  AttributeError: 'struct mem_cgroup' has no member 'kmem_caches'

Link: https://lkml.kernel.org/r/cec1a75e-43b4-3d64-2084-d9f98fda037f@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Tested-by: Roman Gushchin <guro@fb.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

perf ftrace: Fix access to pid in array when setting a pid filter

[ Upstream commit 671b60cb6a897a5b3832fe57657152f2c3995e25 ]

Command 'perf ftrace -v -- ls' fails in s390 (at least 5.12.0rc6).

The root cause is a missing pointer dereference which causes an
array element address to be used as PID.

Fix this by extracting the PID.

Output before:
  # ./perf ftrace -v -- ls
  function_graph tracer is used
  write '-263732416' to tracing/set_ftrace_pid failed: Invalid argument
  failed to set ftrace pid
  #

Output after:
   ./perf ftrace -v -- ls
   function_graph tracer is used
   # tracer: function_graph
   #
   # CPU  DURATION                  FUNCTION CALLS
   # |     |   |                     |   |   |   |
   4)               |  rcu_read_lock_sched_held() {
   4)   0.552 us    |    rcu_lockdep_current_cpu_online();
   4)   6.124 us    |  }

Reported-by: Alexander Schmidt <alexschm@de.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Link: http://lore.kernel.org/lkml/20210421120400.2126433-1-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

capabilities: require CAP_SETFCAP to map uid 0

[ Upstream commit db2e718a47984b9d71ed890eb2ea36ecf150de18 ]

cap_setfcap is required to create file capabilities.

Since commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities"),
a process running as uid 0 but without cap_setfcap is able to work
around this as follows: unshare a new user namespace which maps parent
uid 0 into the child namespace.

While this task will not have new capabilities against the parent
namespace, there is a loophole due to the way namespaced file
capabilities are represented as xattrs.  File capabilities valid in
userns 1 are distinguished from file capabilities valid in userns 2 by
the kuid which underlies uid 0.  Therefore the restricted root process
can unshare a new self-mapping namespace, add a namespaced file
capability onto a file, then use that file capability in the parent
namespace.

To prevent that, do not allow mapping parent uid 0 if the process which
opened the uid_map file does not have CAP_SETFCAP, which is the
capability for setting file capabilities.

As a further wrinkle: a task can unshare its user namespace, then open
its uid_map file itself, and map (only) its own uid.  In this case we do
not have the credential from before unshare, which was potentially more
restricted.  So, when creating a user namespace, we record whether the
creator had CAP_SETFCAP.  Then we can use that during map_write().

With this patch:

1. Unprivileged user can still unshare -Ur

   ubuntu@caps:~$ unshare -Ur
   root@caps:~# logout

2. Root user can still unshare -Ur

   ubuntu@caps:~$ sudo bash
   root@caps:/home/ubuntu# unshare -Ur
   root@caps:/home/ubuntu# logout

3. Root user without CAP_SETFCAP cannot unshare -Ur:

   root@caps:/home/ubuntu# /sbin/capsh --drop=cap_setfcap --
   root@caps:/home/ubuntu# /sbin/setcap cap_setfcap=p /sbin/setcap
   unable to set CAP_SETFCAP effective capability: Operation not permitted
   root@caps:/home/ubuntu# unshare -Ur
   unshare: write failed /proc/self/uid_map: Operation not permitted

Note: an alternative solution would be to allow uid 0 mappings by
processes without CAP_SETFCAP, but to prevent such a namespace from
writing any file capabilities.  This approach can be seen at [1].

Background history: commit 95ebabde382 ("capabilities: Don't allow
writing ambiguous v3 file capabilities") tried to fix the issue by
preventing v3 fscaps to be written to disk when the root uid would map
to the same uid in nested user namespaces.  This led to regressions for
various workloads.  For example, see [2].  Ultimately this is a valid
use-case we have to support meaning we had to revert this change in
3b0c2d3eaa83 ("Revert 95ebabde382c ("capabilities: Don't allow writing
ambiguous v3 file capabilities")").

Link: https://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux.git/log/?h=2021-04-15/setfcap-nsfscaps-v4
Link: https://github.com/containers/buildah/issues/3071
Signed-off-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Andrew G. Morgan <morgan@kernel.org>
Tested-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>
Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

perf data: Fix error return code in perf_data__create_dir()

[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]

Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

net: qrtr: Avoid potential use after free in MHI send

commit 47a017f33943278570c072bc71681809b2567b3a upstream.

It is possible that the MHI ul_callback will be invoked immediately
following the queueing of the skb for transmission, leading to the
callback decrementing the refcount of the associated sk and freeing the
skb.

As such the dereference of skb and the increment of the sk refcount must
happen before the skb is queued, to avoid the skb to be used after free
and potentially the sk to drop its last refcount..

Fixes: 6e728f321393 ("net: qrtr: Add MHI transport layer")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

bpf: Fix leakage of uninitialized bpf stack under speculation

commit 801c6058d14a82179a7ee17a4b532cac6fad067f upstream.

The current implemented mechanisms to mitigate data disclosure under
speculation mainly address stack and map value oob access from the
speculative domain. However, Piotr discovered that uninitialized BPF
stack is not protected yet, and thus old data from the kernel stack,
potentially including addresses of kernel structures, could still be
extracted from that 512 bytes large window. The BPF stack is special
compared to map values since it's not zero initialized for every
program invocation, whereas map values /are/ zero initialized upon
their initial allocation and thus cannot leak any prior data in either
domain. In the non-speculative domain, the verifier ensures that every
stack slot read must have a prior stack slot write by the BPF program
to avoid such data leaking issue.

However, this is not enough: for example, when the pointer arithmetic
operation moves the stack pointer from the last valid stack offset to
the first valid offset, the sanitation logic allows for any intermediate
offsets during speculative execution, which could then be used to
extract any restricted stack content via side-channel.

Given for unprivileged stack pointer arithmetic the use of unknown
but bounded scalars is generally forbidden, we can simply turn the
register-based arithmetic operation into an immediate-based arithmetic
operation without the need for masking. This also gives the benefit
of reducing the needed instructions for the operation. Given after
the work in 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic
mask"), the aux->alu_limit already holds the final immediate value for
the offset register with the known scalar. Thus, a simple mov of the
immediate to AX register with using AX as the source for the original
instruction is sufficient and possible now in this case.

Reported-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

bpf: Fix masking negation logic upon negative dst register

commit b9b34ddbe2076ade359cd5ce7537d5ed019e9807 upstream.

The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.

Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

igb: Enable RSS for Intel I211 Ethernet Controller

commit 6e6026f2dd2005844fb35c3911e8083c09952c6c upstream.

The Intel I211 Ethernet Controller supports 2 Receive Side Scaling (RSS)
queues. It should not be excluded from having this feature enabled.

Via commit c883de9fd787 ("igb: rename igb define to be more generic")
E1000_MRQC_ENABLE_RSS_4Q was renamed to E1000_MRQC_ENABLE_RSS_MQ to
indicate that this is a generic bit flag to enable queues and not
a flag that is specific to devices that support 4 queues

The bit flag enables 2, 4 or 8 queues appropriately depending on the part.

Tested with a multicore CPU and frames were then distributed as expected.

This issue appears to have been introduced because of confusion caused
by the prior name.

Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
Tested-by: David Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: ax88179_178a: initialize local variables before use

commit bd78980be1a68d14524c51c4b4170782fada622b upstream.

Use memset to initialize local array in drivers/net/usb/ax88179_178a.c, and
also set a local u16 and u32 variable to 0. Fixes a KMSAN found uninit-value bug
reported by syzbot at:
https://syzkaller.appspot.com/bug?id=00371c73c72f72487c1d0bfe0cc9d00de339d5aa

Reported-by: syzbot+4993e4a0e237f1b53747@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

netfilter: conntrack: Make global sysctls readonly in non-init netns

commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.

These sysctls point to global variables:
- NF_SYSCTL_CT_MAX (&nf_conntrack_max)
- NF_SYSCTL_CT_EXPECT_MAX (&nf_ct_expect_max)
- NF_SYSCTL_CT_BUCKETS (&nf_conntrack_htable_size_user)

Because their data pointers are not updated to point to per-netns
structures, they must be marked read-only in a non-init_net ns.
Otherwise, changes in any net namespace are reflected in (leaked into)
all other net namespaces. This problem has existed since the
introduction of net namespaces.

The current logic marks them read-only only if the net namespace is
owned by an unprivileged user (other than init_user_ns).

Commit d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in
unprivileged namespaces") "exposes all sysctls even if the namespace is
unpriviliged." Since we need to mark them readonly in any case, we can
forego the unprivileged user check altogether.

Fixes: d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
Signed-off-by: Jonathon Reinhart <Jonathon.Reinhart@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mips: Do not include hi and lo in clobber list for R6

commit 1d7ba0165d8206ac073f7ac3b14fc0836b66eae7 upstream.

From [1]
"GCC 10 (PR 91233) won't silently allow registers that are not
architecturally available to be present in the clobber list anymore,
resulting in build failure for mips*r6 targets in form of:
...
.../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
  146 |  __asm__ volatile (      \
      |  ^~~~~~~

This is because base R6 ISA doesn't define hi and lo registers w/o DSP
extension. This patch provides the alternative clobber list for r6 targets
that won't include those registers."

Since kernel 5.4 and mips support for generic vDSO [2], the kernel fail to
build for mips r6 cpus with gcc 10 for the same reason as glibc.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] '24640f233b46 ("mips: Add support for generic vDSO")'

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

MLK-23277: 8qm: Fix SW workaround for i.MX8QM TKT340553

Current workaround is looping uselessly on the address
range doing a  _tlbi(vmalle1is) which is harmful for
the system performance and buggy as the instruction is
flushing the entire TLB and there is no benefit of
redoing it more than once. Also fix missing barriers.

Signed-off-by: Nitin Garg <nitin.garg@nxp.com>
Signed-off-by: Marouen Ghodhbane <marouen.ghodhbane@nxp.com>
Reviewed-by: Jason Liu <jason.hui.liu@nxp.com>

MA-18519 drm/imx: lcdifv3: Enable axi clock before access register

Without axi clock, lcdif register access will cause system hang.
This issue happens when this driver built as module.

Signed-off-by: Jindong Yue <jindong.yue@nxp.com>
Reviewed-by: Sandor Yu <Sandor.yu@nxp.com>

MLK-25314 arm64: imx8dxl: add all lpspi nodes

Add lpspi1 definition.
Add the missing lpspi0~2 interrupt definitions for imx8dxl.

Signed-off-by: pferrao <pedro.ferrao@strypes.pt>
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Reviewed-by: Han Xu <han.xu@nxp.com>

MLK-25382: arm64: dts: fix the wrong pinctrl pad settings for lpspi

Correct the pad settings, the bit 2,3 should be reserved.

Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Clark Wang <xiaoning.wang@nxp.com>

LF-2090: spi: spi-fsl-qspi: fix dereference null return value issue

dereference null return value issue found by coverity, #18373, CWE-476.
Check if variable res is null first to fix the issue.

Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>

LF-3626: mtd: nand: gpmi: fix the explicit null dereference issue

A potiential null pointer dereference issue may occur in
gpmi_nfc_exec_op(), found by coverity, CID 9000785.

In the for loop, if loop continues in NAND_OP_CMD_INSTR case, the desc
pointer may leave as null, so move the pointer sanity check outside the
loop.

Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>

LF-3622: mtd: nand: gpmi: fix the unintentional integer overflow issue

cast the variable from int to loff_t to avoid potential overflow issue,
reported by coverity. CID 17332.

Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>

MPSDK-172 remoteproc: imx_rproc: Re-building communication channels when a remote crashes

When the crash of a remote proc is detected, the physical communication
channels may get corrupted or reset, and it will impact the subsequent
transfers of rpmsg message. So the communication channels should be
re-built when a remote crash is detected.

Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>

Linux 5.10.34

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210430141910.693887691@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mei: me: add Alder Lake P device id.

commit 0df74278faedf20f9696bf2755cf0ce34afa4c3a upstream.

Add Alder Lake P device ID.

Cc: <stable@vger.kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20210414045200.3498241-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()

commit e7020bb068d8be50a92f48e36b236a1a1ef9282e upstream.

Analogically to what we did in 2800aadc18a6 ("iwlwifi: Fix softirq/hardirq
disabling in iwl_pcie_enqueue_hcmd()"), we must apply the same fix to
iwl_pcie_gen2_enqueue_hcmd(), as it's being called from exactly the same
contexts.

Reported-by: Heiner Kallweit <hkallweit1@gmail.com
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2104171112390.18270@cbobk.fhfr.pm
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dpaa2-mac: remove erroneous symlink

Remove a symlink which was left in the tree by mistake.

Fixes: 64e7f931c2ae ("dpaa2-mac: probe standalone DPMAC objects")
Reported-by: Horia Geanta <horia.geanta@nxp.com>
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>

dpaa2-mac: fix unused label warning

When the CONFIG_FSL_DPAA2_MAC_NETDEVS Kconfig is not enabled, the
free_netdev label is not used, thus a warning is generated.
Fix this by moving the label under the #ifdef Kconfig.

Fixes: 64e7f931c2ae ("dpaa2-mac: probe standalone DPMAC objects")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>

LF-3724-9: ASoC: fsl_sai: Set proper burst size for multi-fifo case

multi fifo sdma script needs the maxburst = words_per_fifo * pins
And the update the watermark level accordingly.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>

LF-3756-3: ASoC: fsl_ssi: switch back to imx-pcm-dma

Switch back to imx-pcm-dma,as the power control is handled
by dma driver already, the special imx-pcm-dma-v2 can be dropped

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>